Privacy

1.What we collect

• Your name, email and candidate number — to run your account and send results. Your password is stored only as a salted hash; nobody at Examora can read it.
• Your answers, timings and flags — they are the raw material of your knowledge map, and they stay on our server; correct answers are only ever released to you after you commit an answer.
• Your exam date, working pattern and timezone offset — the plan and the one-a-day digest are built from them.
• OSCE station transcripts and their mark sheets — the sheet cites your own words; that is the audit trail.
• Payment records via our processor (amount, product, reference). Card numbers never touch Examora's servers.
• First-party event counts (e.g. "a diagnostic was submitted") — numbers, not profiles.

2.What we never do

• Sell your data. To anyone. Including "partners".
• Show you advertising, or let advertisers see you.
• Run third-party trackers or analytics scripts. There are none on any page — view source and check.
• Record your IP address or browser fingerprint in our analytics. We keep counts, not profiles.
• Share your performance with employers, deaneries or regulators.
• Put your results in an email. Results live behind your sign-in; email gets a sealed envelope.
• Keep your data after you ask us not to.

3.How your answers are used

Your answers calibrate your map and, in anonymised aggregate, the difficulty ratings of items (every candidate quietly helps mark the bank itself). Cohort percentiles are computed over anonymised scores. No individual answer history is ever published or shared in identifiable form.

4.Where it lives, how long

Data is stored in the UK/EEA. Sessions are cookies we set ourselves (one, first-party, sign-in only — no consent banner needed because there is nothing to consent away). Your account and map persist while your account exists — cancelling a subscription does not delete them, because your map stays yours. Password-reset tokens die after two hours; expired sessions are swept daily. Delete your account and everything identifiable follows within 30 days.

5.Your rights

Access, correction, export and erasure — one email, no forms, no retention interview. UK GDPR applies; the supervisory authority is the ICO.