Privacy notice

Who is responsible for your data

Laneapps Limited (company number 08950053) is the data controller for AKT Revision. Privacy contact: laneappsltd@gmail.com. Registered office: Rockingham, Calf Hill Road, Thongsbridge, Holmfirth, HD9 3TG, United Kingdom. Primary application hosting location: United Kingdom (Vercel London and Supabase London). This notice covers the AKT Revision website and mobile app.

AKT Revision is an exam-revision service, not a clinical-record system. Do not enter a real patient's name, NHS number, address, date of birth or other identifying information in notes, reports or AI Tutor messages.

Data we process

• Account identity: email, sign-in records, name and authentication/security state.
• Profile and preferences: exam date, onboarding answers and confidence settings.
• Learning activity: answers, correctness, confidence, timing, notes, flags, reads, revision schedule, mocks, Learn progress, XP and streaks.
• Support and editorial data: content reports, queries and our response or resolution.
• Subscription data: website purchases use Stripe. App Store purchases use Apple and RevenueCat. We process account-linked customer/purchase references, plan, status, expiry, restoration and refund information to provide access. The payment provider handles card details; AKT does not receive them.
• App data: secure sign-in sessions, an installation identifier and notification token if you connect reminders, reminder choices, pending progress submissions, and downloaded revision media and listening positions you choose to keep on your device.
• AI data: with your permission, messages, recent conversation, revision context and study statistics used for Tutor answers and eligible daily updates. We also keep usage counts and your versioned AI permission choice. AI permission is optional and separate from agreeing to our Terms.
• Legal acceptance: the Terms and Privacy notice versions acknowledged when you create an account, and the server-recorded acceptance time.
• Security and technical data: essential session information, IP/device details in provider logs, and diagnostic records needed to protect and operate the service.

Why we use it and our lawful bases

Withdrawing optional measurement consent does not affect processing that occurred lawfully before withdrawal.

Optional feedback after your trial

We may send one research email after your free trial if you have not taken out a membership, to understand what we could improve. This uses our legitimate interest in improving the resource. Answering is optional and the email lets you decline. It is not an offer or a sales message.

The private survey link works for 30 days without logging in. Your answer and any comment are linked to your account, visible to the owner and included in account export and deletion. We delete the answer and comment after 12 months. A minimal send/decline record stays until account deletion to prevent repeat requests. Resend processes the address and email needed to deliver the request. Survey responses are stored in Supabase; we do not load optional analytics or advertising measurement on the survey page. Please do not include patient details.

The mobile app

Google or Apple supplies the identity information needed for your chosen sign-in method. Apple may provide a private relay email address. The app uses secure device storage for your session. Website and app progress use the same account. Unsent study actions may stay on your phone until they sync.

If you opt in to phone reminders, Apple delivers them using a notification token linked to your installation. Registrations last up to 365 days; finished delivery records are removed after 30 days. You can stop reminders in Account or iPhone settings. Reminder text does not include your answers, notes or conversations.

If you download audio or video, the app keeps those files, their catalogue details and your playback position privately on the device, outside device backups. Downloaded playback needs an access refresh at least every seven days. Playback position is currently local to that device. You can remove downloads; signing out or deleting your account removes this app's account-bound downloads. The app checks free space before downloading; that capacity value is not sent to us. The native app has no advertising tracking.

AI features

AI Tutor uses OpenAI to answer questions and find relevant revision material. With your AI permission, fact-sheet search also sends search terms to OpenAI to find related meanings; without it, ordinary text search remains available. Daily tutor updates use Anthropic. Before we share your information for these features, we ask you to allow AI features. The choice applies to your website and app account and is off until you choose Allow. Search terms, messages, recent conversation and relevant revision context may be sent to OpenAI. OpenAI also receives a coded account identifier for abuse prevention. Daily updates use computed study statistics, learning activity and exam timing; they do not include your Tutor conversation. Your data is not used to train AI models. We do not add your name or email to these AI requests. Some progress answers and recommendations are calculated within AKT without an AI provider. Turn AI features off in Account to stop new AI requests and new AI-generated daily updates. A request already sent cannot be recalled. Previously saved daily updates remain part of your account. Ordinary study tools and locally calculated summaries continue to work. OpenAI Responses requests have response storage disabled. We do not save ordinary Tutor conversations as an account history. If you choose Report reply, the displayed exchange, your reason and optional note are saved for review; the form shows the exact information before sending. Operational logs exclude Tutor messages and search terms derived from them. AI providers may retain API data for safety or legal purposes under their business-service terms.

Do not include patient-identifiable or other special-category data. AI output can be wrong and is for revision only. It is not used to make a legal, employment, clinical or similarly significant decision about you.

Analytics, cookies and peer comparisons

Essential authentication/session storage is required to keep you signed in. Vercel Analytics stays disabled unless you opt in through the cookie banner or Cookie settings. Practice results are included in the anonymous comparison service described in the Terms. A scheduled job converts eligible scores into count buckets; the persisted comparison snapshot contains no name, email or user identifier, and small cohorts are not displayed.

Optional Google Ads measurement

Google Ads measurement is off unless you specifically opt in through Cookie settings or choose Accept all on the current banner. Earlier analytics consent does not enable it. It helps us understand whether an advert led to a completed registration. Google receives ad-click identifiers, a random registration-event reference and technical connection information such as your IP address and browser details. We do not send names, email addresses, question answers, learning records or Tutor conversations. Enhanced conversions and personalised advertising are disabled.

The Google tag runs in a separate measurement document on selected public pages and the registration confirmation step. It does not run in the member learning area. First-party Google attribution cookies (names beginning _gcl_) may remain for up to 90 days. Our consent preference is stored on your device; a short-lived registration marker expires within five minutes or is cleared when used. You can withdraw through Cookie settings at any time; this stops further measurement and clears the site's attribution cookies. Ad blockers, declining consent or confirming on a different device can prevent attribution.

Google may process measurement data outside the UK. See Google's business privacy information and how Google uses information from partner sites.

Service providers and international transfers

We use a limited set of providers to operate the service:

• Supabase — authentication, database and account email infrastructure.
• Stripe — checkout, subscriptions, invoices, refunds and payment compliance.
• Resend — contact-form delivery and transactional email, including names, email addresses and message contents needed to send those emails.
• Apple — Apple sign-in, App Store payments and optional push notification delivery.
• RevenueCat — App Store purchase validation, restoration and account-linked membership status.
• Google — Google sign-in and, on the website only, optional advertising measurement after your consent.
• Vercel — application hosting, security/diagnostic logs and optional analytics.
• Cloudflare — delivery of editorial images, audio, video and 3D media, plus associated access/security logs; ordinary account and learning records are not stored in R2.
• OpenAI and Anthropic — the AI features described above, only after your permission.
• Airtable — the editorial question bank; ordinary member account and Tutor data are not stored there.

Some providers and subprocessors operate outside the UK/EEA. Where a restricted transfer occurs, we rely on an applicable adequacy mechanism or contractual safeguards such as the EU Standard Contractual Clauses and UK Addendum, and assess supplementary protections where required. You may ask the privacy contact for the current processor/transfer register.

Retention and deletion

Account, profile and learning data are kept while your account exists so progress remains available. Tutor metering, daily tutor updates, Terms acceptances, AI permission choices, content reports, submitted Tutor reply reports and phone registrations are deleted with the account. Self-service deletion cancels website subscriptions, removes the verified Stripe customer, clears Question Bank and Learn data, revokes Apple sign-in where applicable, and deletes authentication. App Store subscriptions must be cancelled separately in Apple subscription settings; deleting AKT does not cancel those charges. The deletion screen provides a subscription-management link. Interrupted deletion is retried by the server. Rights-request audit records are separated from the account after deletion and retained only for the documented compliance period.

Providers may retain encrypted backups under their documented rolling schedules. Stripe or we may retain limited invoice, tax, fraud, dispute or rights-request evidence where law requires or permits it; it is then restricted to that purpose and deleted or anonymised when the retention period ends.

Your rights

Depending on the law that applies, you may ask to be informed, access your data, correct it, erase it, restrict processing, object, receive portable data, withdraw consent, and obtain information about safeguards. Account provides JSON export, correction controls and account deletion. Small exports can download immediately; larger exports are prepared in the background. Prepared export files and their download access expire 24 hours after the export was requested. For restriction, objection, a different format, or anything not covered there, contact laneappsltd@gmail.com.

We may need to verify identity. We normally respond without undue delay and within one month. A right can have legal exceptions; if we refuse or limit a request, we will explain why and describe complaint options.

You can complain to the UK Information Commissioner's Office or, in the EEA, the data protection authority where you live, work, or believe an infringement occurred. We would appreciate the chance to address the issue first, but you do not have to contact us before a regulator.

Security, children and changes

We use access controls, row-level database rules, server-side entitlement checks, MFA for privileged editorial/owner access, encrypted provider connections and ownership checks for billing operations. No internet service is risk-free; please report a suspected account or data incident promptly.

The service is for adult medical professionals and trainees and is not directed to children.

We may update this notice when processing changes. Material changes will be highlighted in the service or by email where appropriate. You can manage Account preferences in Accountand optional analytics or Google Ads measurement through Cookie settings.