Privacy Policy

Welcome to PharmicoLearn. This Privacy Policy explains how PharmicoLearn Ltd ("we," "us," or "our") collects, uses, and protects your personal information when you use our mobile application (the "App"). PharmicoLearn Ltd is the data controller responsible for your personal data. We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We collect information to provide and improve our App.

We use your data for the following purposes:

• To create and manage your account, including converting a guest account when you register.
• To provide the App's core functionality — generating consultation scenarios, playing the simulated patient, and producing AI feedback, hints and debriefs on your responses.
• To convert spoken responses into text where you use voice input.
• To personalise that feedback to you, using your first name, year of study, exam date proximity, onboarding answers and quotes from your previous consultations.
• To record and check your agreement to AI processing before any of your content is sent to an AI provider.
• To process and manage your subscription and entitlements.
• To send you marketing emails and updates, where you have consented to receive them (you may opt out of these at any time).
• To analyse App usage and improve our services.
• To detect, investigate, and prevent fraud, abuse, and technical issues.

Under the UK GDPR, we rely on the following legal bases:

• Contract: to create your account and provide the App's core features, including subscription management.
• Legitimate interests: to analyse usage, improve the App, and detect or prevent fraud and abuse, in a way that does not override your rights.
• Consent: for marketing communications, which you can withdraw at any time.

We do not sell your personal data. We share data with the following trusted third-party service providers who help us operate the App, each acting for the purpose described:

• Google Firebase: authentication, database (Firestore), file storage, analytics, crash reporting, and push notifications. Our backend infrastructure also runs on Google Cloud.
• Google (Gemini API): plays the simulated patient, marks your consultation, and writes your feedback, hints and debriefs. Google receives the text you type during consultations, your recorded voice answers, your live microphone audio during voice consultations, and the personalisation data described in Section 2 — your first name, year of study, exam date proximity, onboarding answers and short quotes from previous consultations. In voice consultations, Google also converts your speech to text as part of running the conversation.
• OpenAI: converts recorded voice answers into text in text-based consultations. OpenAI receives only the audio recording itself and is used for nothing else — no name, account details or other profile information are sent to it.
• Apple App Store / Google Play: process your subscription payment directly. We do not receive or store your payment card details.
• RevenueCat: subscription-management infrastructure. It does not process your payment; it receives your purchase and entitlement status from Apple/Google so we can keep your subscription in sync across devices.
• PostHog (EU-hosted): limited product analytics — feature usage, screen views, app version and coarse technical information — to help us understand how the App is used and fix problems. Session replay/screen recording is disabled. Events are not linked to a PostHog person profile or account identifier, and never contain your consultation content, recordings, or AI output. You can turn this off at any time in Settings; see Section 7.
• Resend: sends account emails (verification, password reset) and processes messages submitted through our website contact form.

Any third party we share data with is required to provide the same or an equivalent level of protection for your data as set out in this Privacy Policy. Some of these providers, including Google, OpenAI, and PostHog, process data outside the UK, including in the United States. Where this happens, we rely on safeguards such as Standard Contractual Clauses or equivalent data protection frameworks to ensure your data continues to receive an equivalent level of protection.

What our AI providers may not do with your content. We use Google and OpenAI on paid commercial terms under which they act as our processors: they may use what we send only to return a result to us. Your consultation content is not sold, is not used for advertising, and is not used to train Google's or OpenAI's models. We do not use your consultation content to train models of our own.

Before your first consultation, the App shows you a disclosure explaining what is sent to our AI providers and who receives it, and asks you to agree. Nothing you type or say is sent to Google or OpenAI until you have agreed — this is enforced by our servers, not only by the App.

You can read that disclosure again at any time in the App under Settings → Legal → How AI uses your data. If you would rather not have your content processed this way, do not agree — the AI features simply will not run. Because the App is a simulator built around AI-marked consultations, this means its core features are unavailable without that agreement.

You can withdraw this agreement independently at any time, without deleting your account, using Settings → Legal → How AI uses your data → AI processing. Withdrawing stops all AI-powered features — consultations, dictation, Live Voice, marking, hints and personalised feedback (including Phil's Debrief) — across every device signed in to your account, while your account and previously saved progress remain. You can turn it back on at any time, which shows you the disclosure again. Deleting your account is a separate, further step that permanently removes your consultations and the rest of your data — see Section 7. If we materially change what we send or who receives it, we will ask you again regardless of your current setting.

We retain your account data for as long as your account remains active, and for a reasonable period afterwards to comply with our legal obligations or resolve disputes. Dormant guest accounts (no activity for 30 days or more) are periodically reviewed and deleted along with their associated data; this is not an instantaneous process, so a dormant guest account may take longer than 30 days to actually be removed. You can delete your account and associated data at any time directly within the App's settings, which starts deletion immediately — see Section 6 of our Terms of Service for how this differs from withdrawing AI permission or cancelling a subscription.

Consultation transcripts and their feedback are kept for as long as your account is active, so that you can revisit your history and track your progress; they are deleted with your account. We do not store your voice recordings as audio files on our servers — a recording is passed straight through for transcription, and only the resulting text is kept as part of the transcript. Live voice audio is streamed for the duration of the session and is not retained by us afterwards. Third-party AI providers may briefly retain content for abuse monitoring or legal compliance under their own terms — see Section 5.

Billing and referral/commission records associated with a deleted account are not erased outright: the account identifier in them is replaced with a non-reversible reference and any name/email is removed, and the underlying financial record is kept for as long as UK accounting and tax law requires. Product-analytics events (Section 5) are not linked to your account and are retained in aggregate. Operational and security logs are retained for a limited period for debugging and abuse prevention, then deleted or aggregated.

Under the UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data (you can do this directly within the App's settings, or by contacting us).
• Restrict or object to our processing of your data, including for direct marketing.
• Receive a copy of your data in a portable format.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data properly.

The App is for pharmacy students aged 18 and over — this reflects both our target audience and the age restriction in our AI providers' own terms. The App asks you to confirm you are 18 or over when you create an account; this is a self-declaration, not an independently verified age check. The App is not directed at anyone under 18, and we do not knowingly collect personal data from anyone under that age. If you believe someone under 18 has provided us with personal data, please contact us and we will delete it.

We use reasonable technical and organisational measures to protect your data, including encryption in transit and access controls on our databases. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you within the App or by email. The "Last updated" date at the top of this page reflects the most recent revision.

If you have any questions about this Privacy Policy or your data, please contact us at: hello@pharmicolearn.com.