Your data and your choices

This site is run by Jamie McKernan, trading as DClinPsy Prep, who is responsible for the data described here (the controller, in UK GDPR’s terms). Email hello@dclinpsyprep.co.uk.

In your browser

These are kept in your browser on the device you are using. Clearing your browser data deletes the local copies. Account copies described below can appear on your other devices.

• Your practice scores, with or without an account. Without one, this is the only copy, and nothing about your practice leaves the device.
• Your research methods and deductive reasoning results: for each set, the date, how many you got right in each topic or reasoning style, and the time taken if it was timed. Each sitting of the untimed reasoning drill counts as one set. Removing this site’s data from your account page deletes them from the browser.
• The courses you choose and the items you tick on the applying checklist. Without an account they stay in your browser only. If you then sign in, both are added to your account, up to four courses. The ticks are then removed from the browser. The courses stay. While you are signed in, the browser keeps a copy of your account’s courses and ticks, so every page shows the same courses and your dashboard and checklist can be shown without a connection. Signing out leaves these copies unless you tick “Also remove this site’s data from this browser”. Deleting the account removes them.
• Two preferences about your courses, which stay in your browser and are not sent to us: that you have finished choosing, which applies only to the exact courses you chose, and, for this visit only, that you asked to see all 30. That one is forgotten when you close the tab.
• Whether you chose to hide ticked tasks on the applying checklist. This is not sent to us.
• Your reflective log, and any reflection you save from the Breathe page: each entry’s text, its date, the prompt it answers and the tags you chose. These stay on your device by default, even when you sign in. They upload and sync only if you explicitly turn on account storage. Each browser asks before connecting and merging its existing notes with that account. Removing this site’s data from your account page deletes this browser’s copies. The log page lets you download a copy and import it in another browser. The reflection box on the Breathe page keeps nothing unless you press its save button.
• Where you said you are in the process, if you choose your stage on the homepage. The answer is also added to an anonymous count on our server: a number for each stage, with no identity, session or time attached. If you are signed in, it is saved on your account too.
• A licence key, if you enter one on the Your pass page, so that this browser keeps the pass.
• Copies of Breathe, the sample tests and the pages you open, so they work without signal, and whether you added the site to your Home Screen or said “Not now”. The pages are the same for everyone, and removing this site’s data from your account page deletes them.
• Whether you chose “Not now” on the note about the pass that follows a practice result, or “Hide this note” on its form for a later year, so that it does not show again in this browser. The choice stays in this browser, and removing this site’s data from your account page deletes it.

On your account, if you sign in

• A second copy of your practice history, kept on our server so that it follows you between devices: the date of each test, how many questions it had, your score, and your score per clinical domain. Other account holders cannot read it.
• A second copy of your research methods and reasoning results, kept in the same way as your practice history.
• If you use your dashboard, the courses you choose (up to four), the checklist items you have ticked, and where you are in the cycle, if you say so while signed in. They are kept so that your timeline, checklist and calendar file show your own courses and progress on any device. These dashboard choices are fixed lists, with no documents or free text.
• If you choose reflective-log sync, your notes, prompts, tags, dates and edit times, together with your account’s consent time and statement version. Deleted entries leave only an ID and deletion time to prevent an older device restoring them. Cloudflare stores the account copy for us. This is not end-to-end encrypted: authorised operators and Cloudflare personnel may technically access it. Notes are not sent to AI, courses, advertisers or in email, or used for research.

The calendar file is made when you download it, from your chosen courses and the published dates, and is not stored.

Choosing reflective-log sync

Optional note storage uses your consent (UK GDPR Article 6(1)(a)), including explicit consent under Article 9(2)(a) if you choose to include your own health or other sensitive personal information. You can keep using the device-only log without agreeing. Do not include identifiable information about patients, clients or other people: names are not the only identifiers; exact dates, places or unusual circumstances can identify someone too.

On the log page you can stop sync and delete the server copy. Your device copy remains. Other offline devices and files you downloaded cannot be remotely erased. Deleted notes disappear from the live database; Cloudflare’s recovery history may retain them for up to 30 days. We do not use recovery copies for any other purpose and must reapply deletions before restored data is served. Minimal consent/withdrawal and disabled-sync records remain until account deletion, to demonstrate your choice and prevent unwanted uploads; these are kept for those legitimate interests, rather than continued consent-based note storage.

Cookies and measurement

Optional measurement stays off until you choose. Use “Cookie settings” in the footer to accept, reject or change each choice. Your browser remembers your choices and when you made them for 180 days. This choice is separate from your account and newsletter.

• Site statistics: Cloudflare Web Analytics counts visits to public pages. It reports the page, referring site, loading speed, country, browser and device type. Cloudflare says it does not use cookies, local storage or fingerprinting to collect these statistics.
• Advertising measurement: Google Analytics uses cookies to measure public page visits and confirmed purchases, so we can assess our advertising. A purchase event includes a pseudonymous order reference and the product, without a payment amount. We do not send your name, email, account details, notes, practice answers or scores. Google signals and advertising personalisation are disabled.

Account, sign-in, private-note, practice exercise, newsletter management and pending-payment pages are excluded. The verified purchase page sends only a purchase event after your consent. Page addresses sent to Google omit query strings and fragments; referring addresses are reduced to their site. Google also handles your IP address, browser and device information. Its analytics cookies are set for 180 days without extending their lifetime on each visit. Rejecting advertising measurement removes these cookies from this site.

Google may process information outside the UK under Google’s privacy policy. We use basic consent mode, which blocks the tag until you allow it. The ICO’s advertising guidance explains the consent requirement. Its statistics exception does not cover advertising measurement (checked 18 October 2026).

Signing in without a password

An account is your email address and nothing else. There is no password, because we would rather not store one. You ask for a sign-in link, which works once, expires after fifteen minutes, and is emailed to you through Resend, as every email from this site is. Clicking it sets a cookie that keeps you signed in on that browser. The cookie lasts 90 days and is renewed about once a week while you use the site. It is used only to know which account you are, not for advertising, analytics or tracking across other sites.

Signing out ends that sign-in and leaves your practice history and choices in the browser. On a shared computer, tick the box on your account to remove them too. You can also sign out of every device at once from there.

If you buy a pass

Checkout uses your verified account email. We keep that address, an internal licence key, when you bought it and when it ends, the payment reference Stripe gives us, and the words of the box you ticked about your right to cancel. That record is what makes the pass work, so it is kept until a week after the pass ends and then removes itself. If you add a pass to an account with its licence key, that account’s address is kept with it for the same time.

Passes are sold only to buyers in the UK. If your card or your billing address is from elsewhere, the payment is cancelled before any money is taken and no pass is issued. We then keep only Stripe’s reference for that payment, for 35 days, so that it is not handled twice, and send you one email saying why.

If you contact us

If you send a message through the contact form, we receive what you type and the email address you give, and use them only to reply. They are not added to the newsletter unless you subscribe separately.

The newsletter

If you choose to subscribe, we use your email address to send recommended reading, published application dates and a short preparation task, usually once a fortnight during the application cycle. Issues are reviewed before they are sent. They may include occasional updates about practice and passes. We do not subscribe sign-in, purchase, contact-form or launch-notice addresses automatically; newsletter consent is a separate choice.

The unticked signup choice asks for your consent to this newsletter. We record the wording and version you saw, when and where you chose it, and whether you confirmed. This is consent under UK GDPR Article 6(1)(a) and PECR. You will not receive newsletter issues until you confirm using the button on the page opened by your email link. This does not create an account or sign you in.

Confirmation links expire after 24 hours. Pending details remain while a working confirmation link exists, then are removed during a later clean-up. We keep a confirmed subscription until you unsubscribe or delete it. After you unsubscribe, the address and consent record are kept for 365 days to honour your choice and prevent unwanted messages, then removed during clean-up. You can also delete the record straight away. The management link in your email works without an account and lets you check your status, unsubscribe, download your data or delete it. If you have an account with the same address, its data download includes the newsletter record; deleting that account also deletes newsletter details for that address. Signing in does not subscribe you.

Who else handles it

• Resend, an email delivery service, sends every email from this site: sign-in links, account and payment messages, newsletter confirmation and preference emails, and messages sent through the site’s forms. If a newsletter issue is sent, Resend also receives its destination address and content. Form messages include your name, email address and what you wrote; newsletter emails include links and newsletter content. We use Resend to deliver these emails, and it handles them under Resend’s privacy policy.

  Our emails are sent from Resend’s Ireland region. Resend stores message content and delivery logs in the United States whichever region sends them, and says those transfers are covered by standard contractual clauses and by the EU-US Data Privacy Framework, including its UK extension.

• Stripe handles your full card number and security code. The site receives payment status, email and billing details from Stripe to check UK eligibility and provide access. We keep the limited purchase record described above; billing names and full addresses are not copied into that record. Stripe also handles information under Stripe’s privacy policy.
• Cloudflare serves the site and keeps standard server logs, including IP addresses, for security and abuse prevention, under Cloudflare’s privacy policy. They are not used to build a profile of you.
• Google also receives an event if you click an “Add to Google Calendar” link. That sends the one event’s title, dates and description, and nothing about your account, and Google handles it under Google’s privacy policy.

What is not collected

• Optional measurement runs only after the relevant choice is allowed.
• No sale of personal data or sharing for advertising. Service providers are described above.
• Practice scenarios are fictional. We do not ask for health information or information about patients or clients. Optional reflective-note sync can include sensitive information you choose to write about yourself, under the consent described above.

Your rights

Under UK GDPR you have the right to access, correct and erase personal data held about you (the ICO explains each right). Where we can make that immediate rather than a request, we have:

• Without an account, practice data lives only on your device. Reflective notes stay there unless you explicitly choose sync. Clearing site data removes local copies, not a copy you have chosen to keep on your account.
• With an account, you can download everything the site holds on it, as one file, from your account: your address, your courses, checklist and stage, your practice history and results, any synced reflective notes and deletion markers, when you signed in and when sign-in links were sent, and any pass. It also includes newsletter consent and subscription details for the same address. It leaves out sign-in codes, which are credentials, and says what is held elsewhere, such as Stripe’s record of a payment.
• You can delete the account from the same page. That immediately removes your email address, your stored history and results, synced reflective notes, your chosen courses, your checklist ticks and any active sign-in and newsletter details for that address. A pass you have bought is not cancelled: the pass record keeps the address it was bought with until a week after it ends, so the pass still works, and signing in again with that address finds it.
• For anything sent through the contact form, write to us and we will act on the request.

Changes

If this policy changes materially, the date at the top will change and the substance of the change will be described here.

23 October 2026. Added the “Not now” and “Hide this note” choices on the note about the pass that follows a practice result. They are kept in this browser only.

22 October 2026. Active sign-ins are now renewed about once a week, for another 90 days. You can still end one or all devices’ sign-ins from your account.

Sources