Privacy Policy
1. Who is the data controller
The data controller is BDYAM Medical Services Ltd, a company registered in England & Wales (company number 16892799). Our registered office address and ICO registration details are available on request. Contact: [email protected].
2. What we collect
- Account data: name, email, password (stored hashed), training stage.
- Usage & progress: practice activity, scores, readiness, streaks and your free-trial usage counters. These are saved in your browser (local storage) and, when you are signed in, mirrored to our backend so they follow your account across devices.
- Payment data: subscriptions are handled by PayPal. We never see or store your card or bank details — only whether your plan is active.
- Technical data: with your consent, privacy-friendly aggregate analytics (page views and feature usage) to improve the site. We do not use advertising or cross-site tracking cookies.
3. How and why we use it (lawful basis)
- To provide your account and save your progress — performance of a contract.
- To process subscriptions and payments — contract / legal obligation.
- To improve the service and for security — legitimate interests.
- To send you service or (if you opt in) marketing emails — consent / legitimate interests.
4. Sharing
We share data only with the processors who help us run the service: PayPal (payments), Cloudflare (hosting, backend Workers and account storage), and Anthropic (the AI provider behind our practice features). We do not sell your data or share it for advertising.
5. AI features
When you use an AI practice feature (Ask, Consult Scribe, the AI Patient Simulator, the Consultation Spine draft and similar), the text or speech you enter is sent through our Cloudflare backend to Anthropic’s Claude to generate a response. Do not enter real patient-identifiable information — use fictional or fully anonymised details only. Anthropic processes inputs to return a response and does not use data submitted through its API to train its models; we cache some non-identifying answers to reduce cost and speed up replies.
6. International transfers
Our AI provider (Anthropic) processes data in the United States. Where data leaves the UK we rely on appropriate safeguards (UK International Data Transfer Agreement / standard contractual clauses). Because you should never enter patient-identifiable data into the AI, these transfers do not involve patient data.
7. Retention
We keep account data while your account is active and for 12 months after closure, then delete or anonymise it, unless the law requires us to keep it longer (for example, payment records for tax purposes). You can ask us to delete your account and data sooner at any time.
8. Security
Passwords are stored hashed (never in plain text), the site is served over HTTPS, and access to account data is restricted. No online service can be guaranteed completely secure, but we take reasonable technical and organisational measures to protect your information and will notify you and the ICO of any breach where legally required.
9. Age of users
Reasoning GP is intended for qualified healthcare professionals and doctors in training and is not directed at anyone under 18. We do not knowingly collect data from children.
10. Your rights
Under UK GDPR you may access, correct, delete, restrict or port your data, object to processing, and withdraw consent. To exercise these, email [email protected]. You can also complain to the ICO (ico.org.uk).
11. Cookies & local storage
We use browser local storage (not advertising cookies) to keep you signed in and to save your progress and free-trial counters on your device — this is essential to the service. We only use aggregate, privacy-friendly analytics if you accept them via our cookie banner, and you can decline without losing any functionality. We set no third-party advertising or tracking cookies.
12. Changes
We may update this policy and will post the new version here with a revised date.