Privacy Policy

1. Who We Are

MerMo (Medical Revision Moments) is a medical exam revision platform operated as a sole trader business registered in England. We are the data controller for your personal data.

Contact: support@ukmer.co.uk

2. What Data We Collect

We collect the following personal data:

• Account data: Email address, name (if provided), authentication details via Supabase Auth
• Subscription data: Subscription status, plan type, billing period dates (processed by Stripe — we do not store full card details)
• Usage data: Study progress, quiz answers, AI session usage, learning analytics
• Technical data: Browser type, IP address, access times (collected automatically via server logs)

3. How We Use Your Data

We use your data to:

• Provide and personalise the MerMo platform, including spaced repetition scheduling
• Process payments and manage subscriptions
• Send transactional emails (welcome, subscription confirmations, payment notices)
• Monitor platform performance and fix bugs
• Improve our content and features based on aggregate usage patterns

We will never sell your personal data to third parties.

4. Legal Basis for Processing (UK GDPR)

We process your data under the following legal bases:

• Contract: To provide you with the MerMo service and manage your subscription
• Legitimate interest: To improve the platform, monitor performance, and ensure security
• Consent: For optional marketing communications (you can opt out at any time)

5. Data Sharing and Third Parties

We share data with the following service providers who process data on our behalf:

• Supabase (database and authentication) — data stored in the EU
• Stripe (payment processing) — PCI DSS compliant
• Vercel (hosting) — servers in EU/US regions
• Anthropic (AI features via Claude API) — data sent for AI generation only, not stored by Anthropic for training
• Resend (transactional emails) — used to send account and subscription emails

Some of these providers may process data outside the UK. Where this occurs, appropriate safeguards are in place including Standard Contractual Clauses (SCCs) or UK adequacy decisions.

6. International Users

MerMo is primarily designed for users preparing for UK medical examinations. If you access MerMo from outside the UK, your data will be processed in accordance with UK GDPR. By using the platform, you consent to the transfer and processing of your data as described in this policy.

7. Data Retention

We retain your personal data for as long as your account is active. If you delete your account:

• Account and usage data is deleted within 30 days
• Payment records are retained for 7 years as required by UK tax law
• Anonymised, aggregate data may be retained indefinitely for analytics

8. Your Rights

Under UK GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data (subject to legal obligations)
• Restrict processing in certain circumstances
• Data portability — receive your data in a structured format
• Object to processing based on legitimate interest
• Withdraw consent for optional processing at any time

To exercise any of these rights, email support@ukmer.co.uk. We will respond within 30 days.

9. Cookies

MerMo uses essential cookies for authentication and theme preferences. We do not use third-party advertising or tracking cookies. No cookie consent banner is required as we only use strictly necessary cookies.

10. Security

We implement appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), secure authentication, and access controls. Payment data is handled entirely by Stripe and never touches our servers.

11. Children

MerMo is not intended for users under 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or an in-app notice. Continued use of MerMo after changes constitutes acceptance of the updated policy.

13. Complaints

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.