Terms, Privacy, and Data Protection

Last updated: 25 September 2026. These Terms and this Privacy Notice apply to the FRCS Urology Viva revision website, also referred to as "we", "us", or "our". The service is operated by Cotswold Machine Learning Ltd. This notice explains our use of personal data under the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR), as amended.

The platform is an educational revision tool for healthcare professionals and examination candidates. It is not a medical device, healthcare provider, clinical decision-support system, or emergency service. Do not rely on the platform for diagnosis, treatment, patient management, or any other clinical decision.

Using the service or accepting its terms does not give consent to optional advertising, analytics or sharing your details with advertisers. Those choices are separate and refusing them does not prevent you from using the revision service.

1. Contact and Controller

For privacy, data protection, account, or legal requests, contact support@frcsurologyviva.com.

For most direct-to-user use of the website, Cotswold Machine Learning Ltd is the data controller. If we provide the service to an institution under a separate written agreement, that agreement may define different controller, processor, or joint controller roles.

Cotswold Machine Learning Limited is registered in England and Wales, company number 15299735. Its registered office and postal contact address is 40 Leighton Road, Cheltenham, England, GL52 6BD.

2. Terms of Use

• You must use the service only for lawful educational and revision purposes.
• You are responsible for keeping your login credentials and devices secure.
• You must not attempt to bypass access controls, scrape non-public content, disrupt the service, reverse engineer protected parts of the platform, or upload malicious files.
• You must not submit real patient-identifiable data, protected health information, or confidential clinical records.
• Subscription, trial, and payment features may be administered through Stripe or another payment provider. The payment provider handles card details under its own terms and privacy notice.
• We may restrict access where reasonably necessary to address a breach of these terms, protect users or comply with law. Where practicable, we will explain the reason and give you an opportunity to resolve the issue or challenge the decision through our contact address. This does not remove your statutory rights.
• Some pages include paid advertising or sponsorship, identified as Advertisement. Sponsorship does not buy influence over your score, feedback or assessment. An advert is a commercial communication, not our clinical recommendation or an endorsement by an examination body, regulator or professional association. Advertiser claims and prescribing information should be checked against current authorised product information and clinical guidance.

2A. Plans, cancellation and refunds

The features, price, currency, billing interval and access period for a paid plan are shown before purchase. Recurring plans renew until cancelled; fixed-term purchases end after their stated access period without automatic renewal. Free access does not authorise a charge unless you separately agree to a paid plan. Access requires an internet connection and a supported browser; voice features also require a microphone and permission to use it.

To stop a recurring subscription, sign in and use Dashboard → Manage subscription, or contact us using section 1. Cancelling renewal normally leaves access in place until the end of the paid period. Deleting a conversation does not cancel a subscription. Account deletion is a separate action: check its cancellation confirmation and contact us if a payment or deletion error is reported.

If you buy as a UK consumer, you normally have 14 days from entering the contract to cancel without giving a reason. Tell us clearly by email or post before the deadline; you do not have to use the form below. Where the law requires a refund following cancellation, we will make it within 14 days of being told, using the original payment method unless you agree otherwise, without a refund fee.

For services started during the cancellation period at your express request, a proportionate charge may be due only where the legal conditions are met. For immediately supplied digital content, loss of the cancellation right requires your prior express consent, acknowledgement and the required confirmation. Merely accepting these terms, signing in or using the service is not a substitute for those steps. Rights concerning faulty or misdescribed content or services still apply.

Optional cancellation form: To Cotswold Machine Learning Limited at the email or postal address in section 1. I give notice that I cancel my contract for [plan/service], ordered on [date]. Name: [name]. Address: [address]. Account email or order reference: [reference]. Date: [date]. Signature: [only if sent on paper].

If something is wrong with your purchase or you want to complain, contact us with the plan, date and a description of the issue. We will consider the remedies required by consumer law, including correction, repeat performance, price reduction or refund where applicable. This process does not prevent you from seeking independent advice or exercising your legal rights.

3. Educational Content and AI Feedback

The service includes question banks, model answers, mock viva workflows, transcripts, scoring, summaries, and examiner-style feedback. Some outputs are generated or assisted by AI systems and may be incomplete, inaccurate, or unsuitable for a particular circumstance.

You should check educational content against current clinical guidance, examination requirements, and professional judgement. AI feedback is for revision only and has no legal, employment, clinical, or similarly significant effect.

4. Intellectual Property

The website, software, question banks, model answers, feedback formats, scoring logic, design, and other platform materials are owned by us or our licensors. You may use them for your own personal revision or the authorised use agreed with us. You must not copy, redistribute, resell, publish, or train another system on platform content without written permission.

You retain any rights you hold in content you submit. You give us permission to host, copy and process it only as needed to provide the requested service and the uses explained in this notice, subject to your data protection rights. Submit only material you are entitled to use. This permission does not transfer ownership or give blanket permission for unrelated model training or publication.

5. Data We Collect

• Account data, such as email address, user identifier, role, programme, and plan status.
• Optional professional profile data, such as career stage, training grade, country or UK region, examination timing, and revision-topic interests.
• Authentication, trial, subscription, and billing metadata.
• Practice data, such as selected topics, questions, typed answers, audio recordings, transcripts, normalised transcripts, scores, feedback, confidence ratings, progress, and session history.
• Revision-assistant data, where the feature is available: your questions, generated answers, conversation titles and history, dates, source references, request outcomes and associated account identifiers. Personalised responses may also use recorded practice feedback, scores and learning recommendations. Saved notes and copies of answers are stored separately from conversations.
• Content you submit or administer, such as feedback messages, key paper submissions, uploaded Anki decks, guideline documents, custom flashcards, and admin edits.
• Technical data, such as device and browser information, IP-derived security signals, request logs, diagnostic events, hashed user identifiers, analytics events, and error reports.
• With advertising consent: the section being viewed, display counts, views, clicks and timestamps. Signed-in records are linked internally to your account and saved answers to control frequency and avoid repeat counting.
• If you separately opt in to an advertiser invitation: only the contact and professional profile fields expressly listed in that invitation, together with evidence of your choice and any later withdrawal. Completing a professional profile alone does not opt you in.

We receive data directly from your submissions and activity, from payment and authentication providers, and from educational feedback and recommendations generated within the service. Core account and request information is needed to provide the corresponding feature; optional profile fields and optional marketing choices are not required for revision access.

6. Patient Data, Special Category Data, and HIPAA

The service is designed for simulated examination practice, not for storing or processing real patient records. Do not upload or speak any information that identifies a real patient, including names, dates of birth, hospital numbers, NHS numbers, medical record numbers, addresses, images, or other identifiers.

Unless we have a separate written agreement that expressly says otherwise, we do not operate the service as a HIPAA covered entity or business associate, and the service is not intended to receive protected health information under HIPAA. If you are a HIPAA covered entity or business associate, you must not use the service for PHI unless we have signed a Business Associate Agreement and enabled the required HIPAA operational controls.

If you accidentally submit patient-identifiable, special category, or protected health information, contact us promptly so that we can assess, delete, restrict, or anonymise it where feasible and legally appropriate.

7. How We Use Data and Lawful Bases

• To create accounts, authenticate users, manage access, provide trials and subscriptions, and deliver the service: contract or steps taken before a contract.
• To transcribe submitted answers, evaluate practice attempts, generate feedback, save and reopen conversations, and personalise learning using relevant recorded progress: performance of our contract with you. You choose whether to submit audio and can refuse microphone access and use available text features. Device microphone permission is not consent to unrelated uses of your information.
• To secure the service, prevent abuse, debug errors, monitor reliability, improve content quality, and understand aggregate product usage: legitimate interests.
• To assess educational quality and understand which topics need better coverage using usage records and, where necessary, limited question or practice content: legitimate interests in improving the revision service. Access must be limited to authorised staff and contracted providers who need it for that task. Reports should use grouped results and minimise identifying details; removing a name or replacing an account identifier alone does not make content anonymous.
• To prepare grouped audience insights for service planning and discussions with potential advertisers, training bodies, or registrar organisations, without sharing individual answers, performance, or contact details: legitimate interests.
• To process payments, tax, accounting, legal requests, disputes, and regulatory obligations: contract and legal obligation.
• To load optional advertising resources, control advertising frequency, and measure campaign views and clicks: consent. Advertising consent is separate from analytics consent and from consent to share contact or profile details.
• To share specified contact or profile fields with a named advertiser, and enable the particular marketing or follow-up described in its invitation: your separate consent. Email, text or other marketing channels must be specifically identified in that choice.
• To send necessary account and service messages: contract or legitimate interests in administering the service. Optional email marketing requires consent unless a specific legal exception applies. For our own similar services, a customer soft opt-in is used only if all its conditions are met, including an opt-out when details are collected and in each message; legitimate interests is not a substitute for required consent. A customer relationship with us does not authorise another advertiser to contact you.

You may object to processing based on legitimate interests by contacting us. For direct marketing, including related profiling, your right to object is absolute: we will stop processing for that purpose. For other legitimate-interest purposes, we will assess your objection and stop unless we have compelling overriding grounds or need the information for legal claims.

Before introducing a materially different use of identifiable conversations, such as a new research project, external publication or model training, we will explain that use, assess its lawful basis and safeguards, and obtain separate consent where required. Saving a conversation or accepting these terms is not blanket consent to these activities.

8. Processors and Sharing

We do not sell or rent our user contact lists. We use service providers to run, secure and improve the platform, and may share limited information where the law requires it. Contact or profile sharing with advertisers is subject to the separate opt-in described below.

We may share grouped audience statistics and campaign results with advertisers, training bodies or registrar organisations. These exclude contact details, individual answers and performance. We check small groups before sharing and combine or withhold results where someone could be identified.

• Supabase or equivalent infrastructure for authentication, database, and file storage.
• Stripe or equivalent payment processors for checkout, subscriptions, invoices, and billing events.
• AI providers, including OpenAI where configured, for transcription, revision-assistant answers, scoring, feedback, summaries and speech. Relevant questions, conversation context, learning evidence and submitted content may be processed for these tasks.
• PostHog or equivalent analytics/observability services using pseudonymous identifiers where configured.
• Sentry or equivalent error monitoring services using minimised diagnostic context where configured.
• Hosting, email, security, legal, accounting, and professional service providers.
• Authorities, regulators, courts, or counterparties where required by law or to protect legal rights.

8A. Advertising

We may show clearly labelled adverts related to the section you are using. Adverts do not affect your scores or the educational content. We do not use your answers, recordings or performance to choose adverts, or track you across other websites for advertising.

If you allow advertising, we use display counts, views and clicks to manage frequency and report campaign results. For signed-in members, these records are linked to the account internally. Advertisers receive aggregate reports, not your individual revision data.

You can turn advertising off using Cookie preferences in the footer. This stops further adverts and measurement in that browser. The Hide button only dismisses one campaign for the current tab session.

8B. Sharing details with advertisers

If we offer an introduction to an advertiser, we will only share contact or profile details after you separately opt in. Before you decide, we will name the advertiser, list the details to be shared, explain why and how they would contact you, and link to their privacy notice. We will also explain retention, any overseas transfers and any referral benefit we receive.

Accepting these terms, allowing adverts or following an advert link does not give this permission. Your choice will be unticked by default, and declining or withdrawing it will not affect your revision access. We will not share your answers, recordings, scores, feedback or payment credentials for advertiser introductions.

We keep a record of your permission. You can withdraw as easily as you opted in, using the supplied control or by contacting support@frcsurologyviva.com. We will stop future sharing and notify the advertiser. Withdrawal does not undo earlier lawful processing; any information still retained must have a lawful reason.

The advertiser will normally be responsible for the information it receives under its own privacy notice. Contact sharing will only start once the separate invitation, consent records and recipient arrangements are in place.

8C. Providers and external links

Adverts may load images, fonts or scripts from other providers, which receive technical details such as your IP address and browser information. Advertiser code is isolated from your account, answers and scores.

The current Consilient Health Elmiron advert uses Supabase-hosted files and Google Fonts. Its links lead to Urology Academy, Bladder Pain (Consilient Health) and the European Association of Urology. External sites apply their own privacy and cookie notices.

We will update this information and ask for fresh consent where required before changing providers or using information for new purposes.

Provider information: Supabase privacy notice; Google Fonts privacy information.

9. AI Processing

When you submit audio, text answers, or admin content, relevant content may be sent to AI providers to transcribe, normalise, score, compare, summarise, generate draft content, or provide feedback. We aim to send only the information needed for the specific educational task. Do not include confidential patient, colleague, employer, or third-party personal data in prompts, recordings, uploaded documents, or feedback messages.

The revision assistant may combine your current question with relevant earlier turns, saved feedback and learning recommendations to generate an answer. These are educational inferences, may be wrong and are not an official assessment of competence or fitness to practise. You can report an inaccurate response and request correction of personal information through section 1.

Saved conversations are held in our account database, including Supabase where configured, so you can return to them across sessions. They are not published to other learners. Authorised support, operational or quality reviewers may access relevant content when needed for the purposes described above.

AI processing by a provider and storage in your account are separate. Deleting an account conversation does not itself erase copies already held in provider security logs or backups. Provider processing, retention and international transfers depend on the service and contractual controls in use; contact us for details applicable to your request. We do not promise that all provider processing has zero retention.

10. International Transfers

Our providers may process data in the UK, the EEA, the United States, or other locations where they operate. Where data protection law requires safeguards for international transfers, we rely on appropriate mechanisms such as adequacy regulations, the UK International Data Transfer Agreement or Addendum, EU Standard Contractual Clauses, or equivalent contractual and organisational safeguards.

Before any optional advertiser referral involving an international transfer, its invitation will explain the destination and applicable safeguards. A general opt-in is not a substitute for required transfer safeguards. You can contact us for information about the transfer mechanism or to request a copy of relevant safeguards.

11. Retention

• Account, profile, subscription, and practice history are kept while your account is active.
• Optional professional profile fields are kept while your account remains active or until you update or delete them through your account rights.
• Audio, transcripts, scores, feedback, and progress may be kept so that you can review prior attempts, receive delayed feedback, and track learning over time.
• Security, audit, usage and diagnostic records are retained according to their purpose, including investigating errors or abuse, resolving disputes and meeting legal obligations. Retention depends on whether the record is still needed for an active issue or obligation. Revision-assistant usage records currently have no automatic expiry; contact us to request access, erasure or a review of continued retention.
• Payment, tax, accounting, and dispute records may be kept for legally required retention periods.
• Deletion requests are assessed under applicable data protection law. Any exception must have a specific lawful justification; a general operational preference is not enough. Backup copies may persist until the applicable backup cycle expires. Contact us for the relevant retention arrangements and any reason for retaining information about you.
• Account-linked advertising records are kept while your account is active to manage frequency, reporting and enquiries. Disabling a campaign preserves its records. These records are included in account export and deletion handling.
• Analytics and advertising consent choices saved in this browser are remembered for up to 180 days (approximately six months), unless you change them or clear browser storage sooner. Campaign Hide choices last for the tab session. Browser storage and server account records have different lifetimes.
• For an optional advertiser referral, the invitation will state the applicable retention period or criteria before consent. After withdrawal, limited evidence of consent and a suppression record may be retained to demonstrate compliance, resolve complaints and prevent further marketing. Genuinely anonymous totals can be kept longer.

Saved conversations have no automatic expiry and remain until you delete them or they are removed through account deletion. Deleting a conversation removes its stored questions, answers and associated response events from the active conversation database. It does not remove copies you saved separately as notes, exported or shared.

Separate usage records can remain after conversation deletion, including the account identifier, question fingerprint, source references, date, response outcome and usage measurements. They are still personal data when linkable to you. A question preview may be recorded if diagnostic preview logging is enabled. These records are included in the account data-rights workflow; deleting a conversation is not the same as deleting your account.

The account-deletion workflow removes saved conversations, personal notes and account-linked assistant usage records. Certain practice answers, attempts, scores and summaries are retained for educational evaluation or research with the account identifier replaced. This is pseudonymisation, not a guarantee of anonymity: text, associated records or audit information may still permit identification. Data protection rights continue to apply wherever identification remains possible; you can ask us to erase or restrict that retained information.

Resetting learning progress, cancelling a subscription, withdrawing optional analytics permission, deleting a conversation and deleting an account have different effects. Use the control for the data or service you intend to change. Contact us if a control reports incomplete processing or you want to request wider erasure.

12. Your Data Protection Rights

Depending on your location and the lawful basis for processing, you may have rights to access, rectify, erase, restrict, object to processing, receive a portable copy of your data, and withdraw consent where processing is based on consent.

Cookie preferences lets you change analytics and advertising choices separately in this browser. For advertiser contact-sharing consent, use the withdrawal method provided with the specific invitation or contact us. We normally respond to data-rights requests within one month, subject to the lawful rules for clarification, identity verification and extensions; we will explain any applicable extension or restriction. You do not need to complain to us before contacting the ICO.

You can contact us to exercise these rights. If you are in the UK, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint. If you are in the EEA, you may also complain to your local supervisory authority.

Where available, use your account controls to export data or request account deletion, and the conversation controls to delete individual saved conversations. An export may omit material that can no longer be retrieved or must be withheld to protect others; an incomplete export is not confirmation that no other data is held. You can contact us for assistance, correction, restriction, objection or a portable copy where that right applies.

13. Cookies, browser storage and your choices

Essential storage supports sign-in, security and remembering your choices. Analytics and advertising are optional and have separate controls. You can accept both, reject both or choose each separately using Cookie preferences in the footer. Continuing to browse is not consent.

Analytics helps us improve the service. Advertising uses display counts, views and clicks to manage frequency and report results. Turning a choice off stops new activity in that browser; it does not automatically erase earlier records.

Choices apply to the current browser and device. Clearing browser storage means you may be asked again. Sharing contact or profile details always needs the separate opt-in described in section 8B.

14. Security

We use technical and organisational measures intended to protect personal data, including authenticated access, role-based admin controls, transport encryption, upload validation, rate limiting, logging, monitoring, redacted audit events, and separation of service credentials. We investigate suspected security incidents, take containment and remediation steps, and make legally required notifications to affected users or regulators. No internet service can be guaranteed to be completely secure.

15. Children

The service is intended for adult healthcare professionals, trainees, and examination candidates. It is not directed to children, and users must not create accounts for children or submit children's personal data.

16. Liability

We will provide services with reasonable care and skill. Where consumer law applies, digital content must meet the applicable requirements for quality, fitness for purpose and description. Educational outcomes and AI accuracy cannot be guaranteed, but that does not remove your statutory remedies.

We do not exclude or restrict liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any liability or consumer right that cannot lawfully be excluded. Subject to those protections, we are responsible for loss or damage that is a foreseeable result of our breach of contract or failure to use reasonable care and skill. The educational-use restrictions do not override these protections.

17. Changes

We may update the service and these terms for reasonable reasons such as security, legal requirements or improvements. Material changes will be brought to your attention before they take effect where required. We will not use a change clause to remove accrued rights or retrospectively authorise a new use of personal data. If a change materially disadvantages a paid customer, applicable cancellation and refund rights remain available.

Where a new purpose or recipient needs consent, we will ask before starting that use. We do not treat continued use of the service after a notice update as consent to new advertising, contact sharing or marketing.

18. Governing law and complaints

These terms are governed by the law of England and Wales. If you are a consumer, this does not deprive you of mandatory protections or rights to bring proceedings in the courts available to you under the law of your country of residence. You can raise a complaint through section 1; data protection complaints can also be made directly to the relevant supervisory authority.