1. Introduction
OsteoTutor ("we," "our," "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our mobile application and website (collectively, the "Platform"). We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Please read this Privacy Policy carefully. By using the Platform, you consent to the data practices described in this policy.
2. Data Controller
OsteoTutor is the data controller responsible for your personal data. If you have any questions about this Privacy Policy, please contact us at: hello.osteotutor@gmail.com.
3. Personal Data We Collect
We may collect the following categories of personal data:
- Account Data: When you register, we collect your name, email address, and password.
- Profile Data: Your student/professional status, institution, and learning preferences.
- Usage Data: Information about how you use the Platform, including cases attempted, scores, time spent, features accessed, and diagnostic accuracy metrics.
- Technical Data: IP address, device type, operating system, browser type, and app version.
- Payment Data: If you subscribe to Pro, payment processing is handled by our third-party payment processor (Stripe). We do not store full credit card details on our servers.
4. How We Use Your Personal Data
We use your personal data for the following purposes:
| Purpose | Lawful Basis |
|---|---|
| To create and manage your account | Performance of a contract |
| To provide educational content and track your progress | Performance of a contract |
| To process subscription payments | Performance of a contract |
| To improve and optimise the Platform | Legitimate interests |
| To communicate important updates (e.g., changes to terms, security notices) | Legitimate interests / Legal obligation |
| To respond to your enquiries | Legitimate interests |
| To comply with legal obligations | Legal obligation |
Special Category Data: If you voluntarily provide health-related information (e.g., in case notes or your profile), we process this only with your explicit consent, which you may withdraw at any time.
5. Cookies and Tracking Technologies
We use cookies and similar tracking technologies to enhance your experience, analyse usage, and support our analytics. For more information, please see our Cookie Policy.
6. Data Sharing and Disclosure
We do not sell your personal data. We may share your data in the following circumstances:
- Service Providers: With third-party vendors who help us operate the Platform (e.g., hosting, analytics, payment processing). These providers are bound by data protection agreements.
- Legal Requirements: If required by law, regulation, or legal process.
- Business Transfers: In connection with a merger, acquisition, or sale of assets.
7. International Data Transfers
We primarily store data within the United Kingdom and European Economic Area. If we transfer data outside the UK/EEA, we ensure appropriate safeguards are in place, such as UK International Data Transfer Agreements.
8. Data Retention
We retain your personal data only as long as necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required by law.
- Account data: Retained while your account is active, plus a reasonable period thereafter in case of reactivation.
- Usage data: Retained for up to 24 months for analytics and improvement.
- You may request deletion of your data at any time (see Section 10).
9. Data Security
We implement appropriate technical and organisational measures to protect your personal data from unauthorised access, alteration, disclosure, or destruction. These include encryption, secure servers, access controls, and regular security reviews.
However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.
10. Your Legal Rights
Under UK GDPR, you have the following rights:
- Right to Access: Request a copy of the personal data we hold about you.
- Right to Rectification: Correct inaccurate or incomplete data.
- Right to Erasure ("Right to be Forgotten"): Request deletion of your data.
- Right to Restrict Processing: Limit how we use your data.
- Right to Data Portability: Receive your data in a structured, machine-readable format.
- Right to Object: Object to processing based on legitimate interests or direct marketing.
- Right to Withdraw Consent: Withdraw any consent you have given at any time.
To exercise any of these rights, contact us at hello.osteotutor@gmail.com. We will respond within one month.
11. Children's Privacy
OsteoTutor is not intended for children under the age of 18. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected personal data from a child under 18, we will take steps to delete it.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Platform or via email. The "Last Updated" date at the top of this policy indicates when it was last revised.
13. Complaints
If you believe we have not complied with data protection laws, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk. However, we encourage you to contact us first so we can attempt to resolve your concern directly.
14. Contact Us
If you have any questions about this Privacy Policy, please contact us at: hello.osteotutor@gmail.com