Privacy Policy

AuroPrep (“we”, “us”) provides an online question bank and study tools for UK ophthalmology exams. We are the data controller for the personal data described here. You can reach us about privacy at privacy@auroprep.com.

• Account & profile: email, password (stored only as a secure hash) or Google sign-in identifier, and the name, title, training grade and country you choose to provide.
• Study activity: your answers, scores, sessions, bookmarks, spaced-repetition schedule, topic mastery, comments you post, and your target exam and sitting date.
• AI tutoring: the questions you ask the AI tutor and the answers you submit for AI marking, together with the AI’s response (kept as a clinical-safety audit record).
• Billing: your subscription status and payment records. Card details are entered directly with our payment providers and are never seen or stored by us.
• Consent: a record that you accepted this policy, including the version and time.

• To provide the service (contract): running your account, delivering questions, tracking progress and processing your subscription.
• Consent: creating your account on the terms of this policy. You can withdraw consent by deleting your account at any time.
• Legitimate interests: securing the platform, preventing abuse, and keeping a clinical-safety audit trail for AI interactions and content moderation.
• Legal obligation: retaining financial records for tax and accounting.

We use a small number of processors, and share only what each needs to do its job:

• Stripe / Razorpay - payment processing. They collect your card and billing details directly on their own checkout.
• Microsoft Azure OpenAI - powers the AI tutor and AI marking. Your question or answer plus the relevant study material is sent to generate a response.
• Google - only if you choose “Sign in with Google”, to verify your identity.

We do not sell your personal data, and we do not use it for advertising.

We do not use advertising or analytics cookies. To keep you signed in, we store sign-in tokens in your browser’s local storage - this is strictly necessary for the service you asked for, so no consent banner is required. If this ever changes, we will ask for your consent first.

Some processors (for example our AI provider) may process data outside the UK. Where they do, we rely on the provider’s approved safeguards (such as UK/EU standard contractual clauses) to protect your data.

• Account and study data: until you delete your account.
• AI interaction audit logs: for a limited retention period, after which they are deleted.
• Financial records: kept (without your identifying details where possible) for as long as the law requires, typically about six years.

Under UK data protection law you can:

• access a copy of your data - use “Download your data” on your Account page;
• correct your details - edit your profile or change your email on your Account page;
• erase your account and personal data - use “Delete account” on your Account page;
• restrict or object to certain processing, and withdraw consent;
• receive your data in a portable, machine-readable format (the export above is JSON).

For anything you can’t do in the app, email privacy@auroprep.com. We aim to respond within one month.

If you have a concern about how we handle your data, please tell us first so we can put it right. You also have the right to complain to the UK Information Commissioner’s Office (ICO).

We may update this policy. When we make material changes we will update the version and date above and, where appropriate, ask you to review the new version.