Privacy Policy

PathologyLabTraining ("we," "our," or "us") is committed to protecting your privacy and personal data.PathologyLabTraining is a trading name of Elohim Solutions Ltd. Registered in England and Wales, company number 16525778. Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Registered with the Information Commissioner's Office, registration number ZC044280. Elohim Solutions Ltd is the controller of your personal data when you use the platform on your own account. If your account is provided through a university or NHS organisation under its agreement with us, that organisation is the controller for providing the service to you and for the records shared with it, we process that data on its behalf, and we remain the controller for the purposes listed in section 6. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

We comply with UK GDPR and the Data Protection Act 2018, and with the Privacy and Electronic Communications Regulations (PECR) for cookies and marketing emails.

The service is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has created an account, email [email protected] and we will delete it.

Personal Information:

• Name (first and last)
• Email address
• Account credentials (passwords are hashed by our authentication provider and never stored in readable form)
• Profile information (if provided)

Usage Data:

• Practice test results and performance metrics
• Questions answered and study progress
• Feature usage and interaction patterns
• Login timestamps and session data

AI features:

• What is sent. When you use an AI feature (the interview coach, the STP supporting statement and interview coaches, the help chat, the biomedical assistant, or blood-film image analysis), the text you type or the image you upload is sent to Google's Gemini API to generate a response. No name, email address or account identifier is sent with it. The text is still your own words and may contain details that identify you, so we treat it as personal data, not as anonymised data.
• Not used to train models. We use Google's paid Gemini API tier, on which Google does not use prompts or responses to improve its models. Google processes the request to produce the response and may keep logs for a short period for abuse and reliability purposes under its own terms; it is not given any way to link a request to you.
• What we keep. Your answers and the feedback you receive are stored in your own training record so you can return to them. For the STP Supporting Statement Coach we do not store your draft text, only the feedback, a word count, the question and any specialism you selected. All of this is deleted when you delete your account.
• A person stays in charge. AI feedback is guidance for you to weigh; it is not an assessment of you and no decision about your account, your access or your standing with any institution is made by it. If you are enrolled through an institution, the time you spend in coaching sessions counts towards that institution's group activity figures, where small groups are suppressed. The text of your answers and the feedback are not shown to the institution, even if you choose to share your training record with it (section 6).
• The coaching, chat and application-writing features carry a short notice at the point of use saying the same. The laboratory interpretation tools that send structured results (not free text about you) to the AI are covered by this section.

Technical Information:

• IP address and device information
• Browser type and version
• Operating system
• Cookies and similar tracking technologies

Payment Information:

• Stripe customer ID (payment processing handled by Stripe)
• Subscription status and history
• We do not store credit card details

We use your information for the following purposes:

• Service Provision: To provide and maintain our training and interview preparation platform
• Account Management: To create and manage your user account
• Personalisation: To customise your learning experience and track progress
• Communication: To send service-related notifications and updates
• Payment Processing: To process subscription payments and manage billing
• Analytics: To analyse usage patterns and improve our service
• Security: To detect and prevent fraud and unauthorised access
• Legal Compliance: To comply with legal obligations and enforce our terms

Under UK GDPR and the Data Protection Act 2018, each use of your data has a legal basis. This table sets out what we use, why, on what basis and for how long.

Where we rely on legitimate interests, you can object at any time (see Your Rights below). To have an account you must give us your name, email address and a password, because we cannot provide the service without them. Everything else is optional.

We do not sell, trade, or rent your personal information. We may share information with:

• Service Providers: Supabase (data hosting), Cloudflare (website delivery), Stripe and Paystack (payments), Resend (email delivery); the full list with locations is in our sub-processor register
• AI Services: Google (Gemini API, paid tier), which receives only the text or image you submit to an AI feature, with no identifier, and does not train on it (see section 2, AI features)
• Our own support staff: If you use the platform through a university or NHS organisation, our platform administrators can view that organisation's member records only after opening a logged access session with a stated reason; the organisation's administrators can see every such session. Account profiles may also be viewed by our administrators to resolve support requests.
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In case of merger, acquisition, or sale of assets

Each provider we use, what it receives and the safeguard that applies (a data processing agreement or the provider's published terms) is listed in our sub-processor register.

• Who is responsible: If your account is provided by a university, NHS organisation or other institution under its agreement with us (a data processing agreement), the organisation is the controller for providing the service to its members and for the records shared with it. Elohim Solutions Ltd processes that data on its behalf as its processor, only on its instructions. The organisation's own privacy notice explains how it uses your data.
• What we remain responsible for: Elohim Solutions Ltd remains the controller for account security and fraud prevention, legal and tax records, operating and improving our own service, marketing emails (only if you opt in), and any personal use of your account or purchases you make with it, including after you leave the organisation.
• What we receive from the organisation: your name and email address when it sends you an invitation, your membership of the organisation and your role in it, and, if you sign in through your organisation's single sign-on, the details your identity provider releases to us, such as your name, email address, a persistent identifier and your affiliation (for example student or staff).
• What its administrators and managers always see: its administrators and managers always see your name, email address, role, membership status and the date you joined, and whether you have chosen to share your training record. If you sign in through the organisation's single sign-on, its owners and administrators can also see the sign-in records for your account (time, email address, IP address, browser and the attributes sent by the identity provider), kept for 180 days for security. They do not see your answers, your AI coach conversations or the details of your simulations.
• Sharing your individual training record: this is off by default. If you turn it on for an organisation in your Account settings, its administrators and managers also see only these fields: the date you were last active, the modules you attempted and the number of attempts, your recorded learning time, your median score and the number of practice tests you completed. Sharing does not show them your answers, anything you have written, your AI coach conversations or your simulation details. You can turn sharing off again at any time in the same place.
• Aggregate figures: the organisation also sees figures for its members as a group, such as activity, module coverage and practice test performance. In these cohort analytics, groups smaller than five are suppressed so that individuals cannot be picked out. Some figures, such as the number of seats in use, are shown whatever the size of the organisation.

We store a small amount of information on your device for:

• Strictly necessary storage: Keeping you signed in, single sign-on, checkout, your cookie choices and the training record kept on your device
• Analytics: Our page statistics come from ReachSurge, which is loaded only if you allow analytics. It sets no cookie and stores nothing on your device, but it works out a daily visitor count from your browser type and screen size. With the same consent, a random identifier lets us count views of site notices when you are not signed in
• Marketing cookies: Google Ads, Meta and TikTok pixels, loaded only with your marketing consent

Every item, what it does and how long it lasts is listed in our Cookie Policy, and you can change your choices in the consent banner.

Security Measures:

• Encrypted in transit (TLS) and at rest (AES-256)
• Secure HTTPS connections
• Access controls and authentication

Data Retention:

We retain your data only for as long as necessary for the purposes for which it was collected:

• Account data: Retained while you use your account. Deleted when you delete your account, or after 2 years without any use, once we have emailed you at least 30 days before (see Account Deletion below)
• Usage analytics: Retained for 2 years for service improvement
• Learning progress: Retained for as long as your account is kept, as above
• Payment records: Retained for 7 years after the transaction (HMRC tax compliance requirement)
• VAT invoices: Retained for 7 years (Making Tax Digital requirements)
• Security logs (sign-in and single sign-on): Retained for 180 days for security purposes
• Administrator access logs and change audit logs: Retained for 2 years as audit evidence
• Cookie consent records: Retained for 3 years as evidence of your choice, then deleted automatically

Account Deletion and Backups:

When you delete your account:

• Immediate deletion: Your profile, test results, and learning data are permanently deleted from our live systems
• Financial records: Payment data is anonymised (not deleted) and retained for 7 years to comply with HMRC requirements
• Security logs: Authentication and single sign-on logs are retained for 180 days, then permanently deleted; administrator access logs and change audit logs are retained for 2 years, then permanently deleted
• Backups: Data in backups is put "beyond use" per ICO guidance: it cannot be accessed or used for any purpose and is permanently deleted when the backups roll over, within 7 days
• Payment providers: We cancel any subscription with Stripe or Paystack before your account is deleted. They keep their own payment records under their own policies

Unused Accounts:

If you do not use your account for 2 years, we email you to say it will be deleted. If you do not sign in within 30 days of that email, we delete the account in the same way as above and email you to confirm. Using your account means signing in, staying signed in or taking a practice test. We do not delete unused accounts while you have a paid subscription, access through an organisation, or premium access we have granted you.

Note: Some data must be retained for legal compliance (Article 17(3) UK GDPR). We clearly identify what is deleted versus anonymised in your deletion confirmation.

Under the UK GDPR, you have the following rights regarding your personal data:

• Right of Access (Article 15): Request copies of your personal data in a portable format (JSON or CSV)
• Right to Rectification (Article 16): Correct inaccurate or incomplete data through your account settings
• Right to Erasure (Article 17): Request permanent deletion of your personal data (with some legal exceptions)
• Right to Restrict Processing (Article 18): Limit how we use your data in certain circumstances
• Right to Data Portability (Article 20): Receive your data in a machine-readable format to transfer to another service
• Right to Object (Article 21): Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent (Article 7): Withdraw consent at any time for consent-based processing
• Right not to be subject to automated decision-making (Article 22): Object to decisions made solely by automated means

How to Exercise Your Rights:

Response Timeline:

• Standard response: Within one month of receiving your request
• Complex requests: May be extended by up to 2 additional months - we will inform you within the first month
• Data exports: Typically processed immediately via our self-service portal
• Account deletion: Completed within 30 days after email verification

Identity Verification:

For your protection, we use proportionate verification methods:

• Data exports: Authenticated login required
• Account deletion: Email verification code sent to your registered email address
• We do NOT require photo ID for standard requests (ICO proportionate verification guidance)

Contact for Manual Requests:

For requests that cannot be handled via self-service, contact:

Data protection lead: [email protected]

Subject line: "Data protection request: [type of request]"

Rate Limits: For security, data exports are limited to once per 24 hours and deletion requests to once per 30 days.

Your account, learning-record and organisation data is stored in the United Kingdom (AWS London, via Supabase). Some of the providers we use to run the service, such as our email, payment and AI providers, process data in the United States or elsewhere. Where personal data leaves the UK we use one of the transfer tools UK GDPR allows:

• The UK adequacy regulations, for providers processing in the European Economic Area
• The UK Addendum to the EU Standard Contractual Clauses, or the UK International Data Transfer Agreement (IDTA), issued by the ICO and written into each provider's data processing agreement
• The UK-US data bridge (the UK Extension to the EU-US Data Privacy Framework), where a US provider is certified under it

Every provider, what it receives, where it processes and which tool covers it is listed in our sub-processor register. Advertising pixels are only ever loaded with your marketing consent.

Users in Africa

If you live in Nigeria, Ghana, Kenya, South Africa, Côte d'Ivoire, Egypt or Rwanda, where we offer payment through Paystack, your own country's data protection law may also apply to how we handle your data (for example the Nigeria Data Protection Act 2023, Ghana's Data Protection Act 2012, Kenya's Data Protection Act 2019 or South Africa's Protection of Personal Information Act 2013). Your data is stored in the United Kingdom as described above, and Paystack payments are processed by Paystack Payments Ltd, which processes payment data in AWS Ireland. We transfer your data out of your country because it is needed to provide the service you signed up for; the providers we use outside the United Kingdom, and the safeguard for each, are listed in our sub-processor register.

You can ask to see, correct or delete your data, object to how we use it, withdraw consent you have given, and receive your data in a portable format. You can do all of this from your Data Protection Centre or by emailing [email protected]. You can also complain at any time to the data protection authority in your country; in Nigeria that is the Nigeria Data Protection Commission (ndpc.gov.ng).

We may update this Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last updated" date
• Emailing you at least 14 days before any significant change takes effect

For questions about this Privacy Policy or your personal data:

Data protection lead: [email protected]

General Contact: [email protected]

Controller: PathologyLabTraining is a trading name of Elohim Solutions Ltd. Registered in England and Wales, company number 16525778. Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Registered with the Information Commissioner's Office, registration number ZC044280.

How to complain

If you think we have infringed your data protection rights you can complain to us first, under section 164A of the Data Protection Act 2018, using our complaints form or by emailing the data protection lead. We acknowledge every complaint by email with a reference (the law allows 30 days; we do it on receipt), investigate it, and write to you with the outcome, which we aim to do within 30 days.

If you are not satisfied with our response, or would rather go straight to the regulator, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.