Privacy notice
Last updated 7 November 2026. SAS Medics is run by the operator of this site. The operator has not published a contact address yet.
What we store
- Account: your name, email address and a salted hash of your password (never the password itself), plus sign-in times.
- Study data: the exams you join, your exam date and daily goal, every answer and score, review schedule, plan and readiness estimates.
- Viva and station practice: transcripts of your answers, and the audio clips you choose to record, with a per-user storage limit.
- Security records: an audit log of sign-ins and sensitive actions, and your IP address and browser type for sessions.
Why, and on what basis
We use this to run the service you asked for: to select questions, schedule reviews, mark your answers and show your progress (performance of the contract), and to keep it secure and prevent abuse (legitimate interests). We do not sell your data and do not use advertising or tracking cookies.
AI and voice providers
To act as an examiner and to mark answers, the text of your answers and the relevant question are sent to an AI model provider chosen by the operator. If natural voice is enabled, the sentences to be read aloud are sent to a speech provider. Your browser's own speech recognition, if you use the microphone, is handled by your browser vendor. We do not send your name or email to these providers as part of those requests.
Cookies and local storage
SAS Medics sets one essential, HTTP-only session cookie to keep you signed in. Your browser local storage keeps small preferences, such as reading speed and chosen voice. There are no analytics or advertising cookies.
How long we keep it
Your data is kept while your account exists. Sessions expire after 14 days. When you delete your account, your profile, answers, recordings, plans and API keys are deleted from the live database. Audit records that do not identify you may be kept for security. Backups may hold deleted data for a limited period before they are overwritten.
Your rights
Under UK data-protection law you can ask to access, correct, export or erase your data, to restrict or object to its use, and to complain to the Information Commissioner's Office (ico.org.uk). You can delete your account yourself in Settings. For anything else, contact the operator.
Security
Passwords are hashed, sessions are signed and HTTP-only, traffic is encrypted in transit, cross-site requests are blocked, and access to your recordings is limited to your account. No system is perfectly secure; tell us promptly if you suspect a problem.
Children
The service is intended for adult professionals and trainees. It is not directed at children.
Drafting note for the operator: this notice describes how the software works today but was prepared without legal review. Name the controller (OPERATOR_NAME), publish a contact address (CONTACT_EMAIL), list the actual AI and speech providers you use, register with the ICO if required, and have a solicitor check it before launch.