Quesmed Privacy Policy

This Privacy Policy explains how SYSMED LTD, trading as Quesmed ("Quesmed", "we", "us" or "our"), collects and uses personal data when you use our websites, web applications, mobile applications and educational services (together, the "Services").

SYSMED LTD is a company registered in England and Wales (company number 10241223), with registered office at 124 City Road, London, England, EC1V 2NX. For most direct-to-consumer use of Quesmed, SYSMED LTD is the controller of your personal data.

Where a university, employer or other organisation provides access to Quesmed under an institutional licence, that organisation may be the controller of personal data it provides to us or instructs us to process, and Quesmed may act as its processor. In other circumstances, Quesmed may act as an independent controller for data we process for our own legitimate business purposes, such as account security, service administration and compliance with law.

If you have questions about this Privacy Policy or wish to exercise your data-protection rights, contact us at support@quesmed.com.

The personal data we collect depends on how you use the Services. It may include:

- Identity and account data, such as your name, email address, username, account identifiers and password-related authentication information.

- Education and institutional data, such as your university or organisation, course or year group, licence entitlement and other information provided by you or your institution to provision or administer access.

- Learning and assessment data, such as questions attempted, answers, scores, progress, revision history, notes, bookmarks, flashcard activity, OSCE/PACES/interview practice activity and other educational interactions.

- AI and consultation interaction data, such as text you submit, prompts, audio recordings of your voice during AI stations, transcripts of AI sessions, automated marking outputs and feedback, where you use AI-enabled features.

- Purchase and billing data, such as products purchased, subscription status, transaction references and billing-related information. Payment-card details are processed by our payment provider and are not stored by Quesmed.

- Communications and support data, such as emails, help-desk messages, feedback, survey responses and other communications with us.

- Technical and usage data, such as IP address, browser and device type, operating system, app version, approximate location derived from IP, log-in events, timestamps, referring pages, pages and features used, diagnostic information, crash data and security logs.

- Cookie and similar-technology data, as described in section 11.

We may receive personal data directly from you, automatically from your use of the Services, from an institution that provides you with access, and from service providers that support functions such as payments, authentication, analytics or customer support.

Quesmed is an educational service. The patients in our AI stations and question bank are fictional. We do not require users to submit identifiable patient information, and you must not upload or disclose identifiable patient data through the Services unless Quesmed has expressly agreed a lawful and secure workflow for that purpose.

Some educational interactions may contain clinical scenarios, medical terminology or user-generated health-related content. This does not necessarily mean that the information is personal health data about you or another identifiable person. If you choose to provide information that constitutes special-category personal data, including personal health information, we will process it only where a valid legal basis and an applicable condition for special-category processing are available.

Where possible, clinical and patient-related educational content should be anonymised before it is submitted to Quesmed.

Where we rely on legitimate interests, we have considered whether our interests are necessary and balanced against your rights and expectations. You can object to processing based on legitimate interests (see section 15).

How we handle some of your data depends on how you access Quesmed.

- Individual users. If you have your own Quesmed account (for example, you signed up or paid for a subscription yourself), this Policy applies in full and Quesmed is the controller of your personal data.

- Institutional users. If you access Quesmed through a university, NHS organisation, employer or other organisation, that organisation may provide us with information such as your name, institutional email address, year group or course and licence entitlement so that we can create, match or administer your account.

Depending on the institutional agreement, we may provide authorised institutional administrators with agreed usage, engagement, progress or assessment information relating to users covered by that licence. The categories of data shared and the purposes for which they may be used are governed by the relevant institutional agreement and, where applicable, a Data Processing Agreement.

An institutional agreement may also set its own rules for the data of its users, for example which AI features are available, whether audio is recorded, and how long recordings and transcripts are kept. We do not use institutional users' data to train our AI models unless the institution has agreed to this. Where an institutional agreement sets different rules, those rules apply instead of the general rules in this Policy.

If you have questions about how your institution uses information obtained from Quesmed, you should also review the institution's own privacy information.

Some Quesmed features use artificial intelligence to simulate clinical encounters, process voice or text, generate feedback, mark performance or support personalised learning. These include our AI OSCE and PACES stations and our AI tutor.

What happens during an AI session. When you use an AI station or the AI tutor:

- your typed messages, or your voice audio and its transcript, are sent to the service providers that run the feature for us: real-time voice and language-model hosting, speech-to-text, text-to-speech, and language models for marking and tutoring;

- these providers process the data in the United States (see section 9);

- the providers that receive your voice, typed messages or transcripts process them only to provide the service to us, under contract terms and account settings that do not allow them to use the data to train their own models. Our text-to-speech provider receives only the words the AI patient or examiner is about to say, not your audio or typed messages.

The AI models only generate text, speech and feedback. They cannot access our database or take actions on your account.

Recordings and transcripts. Voice sessions are recorded, and a transcript of each AI session is kept, so that we can run and mark the session, let you review it, and maintain the quality and safety of the Services. Recordings and transcripts are stored by Amazon Web Services in Ireland. How long we keep them is explained in section 10.

Masking of personal details. Before text is stored or sent to an AI provider, we automatically mask certain structured personal details, such as email addresses, phone numbers, NHS and National Insurance numbers, postcodes, card numbers and addresses. This reduces risk but does not catch everything: for example, names and dates of birth are not masked, and audio recordings cannot be masked. Please do not give personal information about yourself or anyone else beyond what a station asks of you, and never enter real patient information.

Automated outputs. Quesmed uses automated methods to generate educational scores, feedback, recommendations and content. These outputs are for learning and revision only and may contain errors. They are not medical advice, and Quesmed does not use them to make solely automated decisions that produce legal or similarly significant effects on you.

If you have an individual account, we may use masked transcripts of your AI sessions to test, evaluate and improve our AI features, including training or fine-tuning our own AI models. We rely on our legitimate interests in improving the accuracy and educational quality of the Services. Transcripts are masked as described in section 6 before they are used in this way.

You can object to this use at any time by emailing support@quesmed.com. If you do, we will exclude your sessions from future training and evaluation. If you ask us to delete your recordings and transcripts, they will not be used in any future training. Information already reflected in a model trained before your request cannot be extracted from that model.

If you access Quesmed through an institutional licence, we do not use your sessions to train our AI models unless your institution has agreed to this.

We do not allow the AI providers that receive your voice, typed messages or transcripts to use them to train their own models (see section 6).

We do not sell personal data. We share personal data only where necessary for the purposes described in this Policy.

We require service providers that process personal data on our behalf to handle it only for agreed purposes and subject to appropriate confidentiality and data-protection obligations.

Our recipients include:

- cloud hosting and storage providers;

- AI service providers (section 6);

- payment and subscription processors;

- email delivery and customer-support providers;

- search providers;

- analytics and advertising providers, such as Google and Meta, where you accept non-essential cookies;

- contracted engineers who support and maintain the Services and who may access personal data where needed to investigate and fix problems;

- the institution that gives you access, where applicable (section 5);

- professional advisers, auditors, regulators, law-enforcement bodies and others where the law requires or permits it.

If our business, or part of it, is sold or reorganised, personal data may be transferred to the new owner, who will be bound by this Policy.

A list of our service providers, what each does for us and where it processes data is available on request from support@quesmed.com. Institutions with a licence agreement receive this list as part of their data processing terms.

Our primary application infrastructure is hosted by Amazon Web Services in the eu-west-1 region in Ireland. Our main database and our storage of recordings and transcripts are held there, within the European Economic Area (EEA).

Some processing takes place outside the UK and EEA:

- AI features. When you use an AI station or the AI tutor, your voice audio, typed messages and transcripts are processed by our AI providers in the United States.

- Support, email and payments. Our customer-support, email-delivery and payment providers may process limited personal data in the United States.

- Engineering support. Our contracted engineers are based in India and may access personal data remotely where needed to support and debug the Services.

Where personal data is transferred outside the UK or EEA, we use a safeguard recognised by data-protection law. Depending on the recipient, this is the UK Extension to the EU-US Data Privacy Framework (the "UK-US Data Bridge"), the European Commission's Standard Contractual Clauses with the UK International Data Transfer Addendum, the UK International Data Transfer Agreement, or another approved mechanism. You can contact us for more information about the safeguards that apply to your data.

We keep personal data only for as long as reasonably necessary for the purposes for which it was collected, including to provide the Services, maintain your learning history, keep appropriate business and security records, comply with legal or regulatory obligations, resolve disputes and enforce agreements.

Retention periods vary according to the type of data, the nature of the account, whether access is provided under an institutional agreement, and applicable legal or contractual requirements.

AI session recordings and transcripts. For individual accounts, we keep the audio recordings and transcripts of your AI sessions, stored by Amazon Web Services in Ireland, until you ask us to delete them. You can ask at any time by emailing support@quesmed.com. If you ask us to delete your account, we will delete your recordings and transcripts too. For institutional users, the retention period may be set by your institution's agreement with us, which may be shorter.

Provider and backup copies. Our AI and infrastructure providers may hold limited copies of session data for short periods for security, abuse prevention and debugging. This is generally no more than 30 days (for example, our real-time voice provider keeps session audio, transcripts and diagnostic traces for 30 days). Some providers keep basic request metadata, such as timestamps and usage records, for up to 90 days. Deleted data remains in our encrypted database backups for up to 30 days before it is overwritten.

Where an institution acts as controller and Quesmed acts as processor, deletion or return of personal data is also governed by the relevant Data Processing Agreement and the institution's documented instructions.

We may keep aggregated or effectively anonymised information that no longer identifies an individual for analytics, research, product development or reporting.

We use cookies and similar technologies to operate our websites and applications, remember preferences, maintain sessions, understand how the Services are used and, where you have consented or where otherwise permitted by law, support analytics or marketing.

Strictly necessary cookies may be used without consent where they are required for the operation or security of the Services. Where consent is required for non-essential cookies or similar technologies, you can make your choice through the cookie banner on our website.

Third-party services integrated into Quesmed may also set or access cookies or similar technologies in accordance with the choices and controls presented to you.

We may send information about Quesmed products, services, educational resources, events or offers where permitted by law. Where consent is required, we will rely on your consent. You can unsubscribe from marketing emails at any time using the unsubscribe link in the message or by contacting support@quesmed.com.

Service-related communications, such as account, security, subscription or important operational notices, are not marketing and may still be sent where necessary to provide the Services.

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. These include encryption in transit and at rest, access controls and authentication, restricted production access, automatic masking of certain personal details in AI session text, logging and monitoring, and cloud-security controls appropriate to the Services.

No internet-based service can guarantee absolute security. You are responsible for keeping your credentials confidential and for telling us promptly if you believe your account has been compromised.

Depending on the circumstances and the lawful basis on which we process your data, you may have the right to:

- request access to your personal data;

- request correction of inaccurate or incomplete data;

- request deletion of your personal data in certain circumstances, including your AI session recordings and transcripts (see section 10);

- request restriction of processing in certain circumstances;

- object to processing based on legitimate interests, including the use of your AI sessions to train our models (see section 7), and to direct marketing;

- receive certain personal data in a portable format; and

- withdraw consent at any time where we rely on consent, without affecting processing that was lawful before withdrawal.

To exercise your rights, contact support@quesmed.com. We may need to verify your identity before acting on a request. Some rights are subject to legal limitations or exemptions.

If Quesmed processes your data solely on behalf of an institution, we may refer your request to that institution or help it to respond, as appropriate.

You have the right to object at any time to our processing of your personal data for direct marketing. You also have the right to object to processing based on our legitimate interests, including the use of your AI session transcripts to train our models, depending on your particular circumstances.

If you have concerns about how we use your personal data, please contact us first at support@quesmed.com so that we can try to resolve them.

You also have the right to complain to the UK Information Commissioner's Office (ICO), the UK supervisory authority for data protection. Information about making a complaint is available at ico.org.uk. If you are located outside the UK, you may also have the right to complain to your local data-protection authority.

Quesmed is primarily designed for students and healthcare professionals. Some services, such as admissions-related educational products, may be used by people under 18. Where our Services are offered to children, we will take account of applicable age, transparency and consent requirements and will aim to provide privacy information in clear, age-appropriate language.

If you believe a child has provided personal data to us in circumstances where appropriate permission was required but not obtained, please contact support@quesmed.com.

The Services may contain links to websites or services operated by third parties. Their privacy practices are governed by their own privacy notices. We are not responsible for the privacy practices of third-party services that are not acting as our processors.

We may update this Privacy Policy from time to time to reflect changes to our Services, technology, legal requirements or data-processing practices. We will publish the updated version on our website and update the date shown at the top of the Policy. Where a change materially affects how we use personal data, we will take reasonable steps to bring the change to the attention of affected users before the new use begins, where required by law.

SYSMED LTD (trading as Quesmed)

Company number: 10241223

Registered office: 124 City Road, London, England, EC1V 2NX

Email: support@quesmed.com

ICO registration number: ZB894312