Privacy notice
Last updated: 18 July 2026
Who is responsible for your data
MRCGP Revision Limited (company number 17267291) is the data controller for AKT Revision. Privacy contact: laneappsltd@gmail.com. Primary application hosting location: United Kingdom (Vercel London and Supabase London).
AKT Revision is an exam-revision service, not a clinical-record system. Do not enter a real patient's name, NHS number, address, date of birth or other identifying information in notes, reports or AI Tutor messages.
Data we process
- Account identity: email, sign-in records, name and authentication/security state.
- Profile and preferences: exam date, onboarding answers and confidence settings.
- Learning activity: answers, correctness, confidence, timing, notes, flags, reads, revision schedule, mocks, Learn progress, XP and streaks.
- Support and editorial data: content reports, queries and our response or resolution.
- Subscription data: Stripe customer and subscription references, plan, status, invoices and refund information. Card details are handled by Stripe and are not stored in this application.
- AI data: the message/context you deliberately send to the Tutor, metering records, and computed revision statistics used to generate automatic daily tutor updates for Unlimited AI members with an active Question Bank or Learn membership.
- Legal acceptance: the Terms and Privacy notice versions acknowledged when you create an account, and the server-recorded acceptance time.
- Security and technical data: essential session information, IP/device details in provider logs, and diagnostic records needed to protect and operate the service.
Why we use it and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Create your account, provide paid/free content, save progress, provide anonymous peer comparisons, respond to Tutor requests, provide automatic daily tutor updates to eligible Unlimited AI members, and manage billing. | Performance of our contract with you. Anonymous result aggregation and the automatic updates included with Unlimited AI are disclosed parts of the relevant services. |
| Secure accounts, prevent fraud/abuse, diagnose faults, operate the service and review reported content. | Our legitimate interests in a safe, reliable and accurate service, balanced against your rights. |
| Optional product analytics. | Your consent, controlled through the cookie banner or Cookie settings. It defaults off and can be withdrawn at any time. |
| Tax/accounting records, responding to rights requests, disputes and legally required disclosures. | Legal obligation and, where applicable, legitimate interests in establishing or defending legal claims. |
Withdrawing analytics consent does not affect processing that occurred lawfully before withdrawal.
AI features
For questions about your Progress evidence, the Tutor builds its answer in the application from your computed results. For other Tutor questions, it sends your question, recent Tutor conversation and relevant revision material to the configured AI API only when you ask it to respond. Daily tutor updates are separate and included only with the Unlimited AI add-on. Each day, for every eligible member with an active Question Bank or Learn membership, a scheduled process automatically sends computed statistics about your effort, pace, question use and Learn progress to the configured AI API and stores a concise Home update and fuller Progress update in your account. The prompt contains no name, email or Tutor message text, and the update is displayed in the service rather than emailed or otherwise sent to you. OpenAI Responses requests are sent with response storage disabled. The application does not persist Tutor message text, although the provider may retain API data for safety or legal purposes under its account terms.
Do not include patient-identifiable or other special-category data. AI output can be wrong and is for revision only. It is not used to make a legal, employment, clinical or similarly significant decision about you.
Analytics, cookies and peer comparisons
Essential authentication/session storage is required to keep you signed in. Vercel Analytics stays disabled unless you opt in through the cookie banner or Cookie settings. Practice results are included in the anonymous comparison service described in the Terms. A scheduled job converts eligible scores into count buckets; the persisted comparison snapshot contains no name, email or user identifier, and small cohorts are not displayed.
Service providers and international transfers
We use a limited set of providers to operate the service:
- Supabase — authentication, database and account email infrastructure.
- Stripe — checkout, subscriptions, invoices, refunds and payment compliance.
- Vercel — application hosting, security/diagnostic logs and optional analytics.
- Cloudflare — delivery of public editorial images and 3D media, plus associated access/security logs; ordinary account and learning records are not stored in R2.
- OpenAI or Anthropic — the configured AI API for Tutor responses and automatic daily tutor updates.
- Airtable — the editorial question bank; ordinary member account and Tutor data are not stored there.
Some providers and subprocessors operate outside the UK/EEA. Where a restricted transfer occurs, we rely on an applicable adequacy mechanism or contractual safeguards such as the EU Standard Contractual Clauses and UK Addendum, and assess supplementary protections where required. You may ask the privacy contact for the current processor/transfer register.
Retention and deletion
Account, profile and learning data are kept while your account exists so progress remains available. Tutor metering, daily tutor updates, Terms-acceptance records and content reports are deleted with the account. Self-service deletion cancels active subscriptions, removes the verified Stripe customer, atomically clears Question Bank and Learn data, then deletes authentication. Rights-request audit records are separated from the account after deletion and retained only for the documented compliance period.
Providers may retain encrypted backups under their documented rolling schedules. Stripe or we may retain limited invoice, tax, fraud, dispute or rights-request evidence where law requires or permits it; it is then restricted to that purpose and deleted or anonymised when the retention period ends.
Your rights
Depending on the law that applies, you may ask to be informed, access your data, correct it, erase it, restrict processing, object, receive portable data, withdraw consent, and obtain information about safeguards. Account provides immediate JSON export, correction controls and account deletion. For restriction, objection, a different format, or anything not covered there, contact laneappsltd@gmail.com.
We may need to verify identity. We normally respond without undue delay and within one month. A right can have legal exceptions; if we refuse or limit a request, we will explain why and describe complaint options.
You can complain to the UK Information Commissioner's Office or, in the EEA, the data protection authority where you live, work, or believe an infringement occurred. We would appreciate the chance to address the issue first, but you do not have to contact us before a regulator.
Security, children and changes
We use access controls, row-level database rules, server-side entitlement checks, MFA for privileged editorial/owner access, encrypted provider connections and ownership checks for billing operations. No internet service is risk-free; please report a suspected account or data incident promptly.
The service is for adult medical professionals and trainees and is not directed to children.
We may update this notice when processing changes. Material changes will be highlighted in the service or by email where appropriate. You can manage Account preferences in Accountand optional analytics through Cookie settings.