Privacy notice

Who we are

iLexiBox operates MediLexi and is the controller of the personal data described here. You can reach us at support.lexiteam@gmail.com.

We are based in Norway and have no establishment in the United Kingdom. This notice describes how we handle your personal data under the UK GDPR and the Data Protection Act 2018 when you use the UK pages of this service.

What we process

• Account details: your email address and the credentials you sign in with. If you sign in with Google, we receive your email address and name from Google.
• Practice activity: the questions, stations and cases you open, the answers you give, what you save, and the progress and statistics derived from them.
• An anonymous session, if you practise without signing in. That is a cookie in your browser, not a person.
• Subscription status, so the service knows what you have access to.
• Payment details are handled by Paddle. We do not receive your full card details.
• A record of the pages you open while signed in: which page, when, how long it was visible on your screen, and the page you came from. This is linked to your account and readable by us — it is not anonymous statistics. Nothing is recorded if you are not signed in, or if you are using an anonymous practice session.
• Anything you write to us when you contact support.

The UK pages do not record audio and do not send anything you write to an AI provider. The written practice, clinical stations, case practice and revision notes are marked and served by us. If that changes, this notice changes first.

Why we process it, and our lawful basis

• To provide and run the service and to administer your subscription — performance of a contract with you.
• To keep the service secure, fix faults and improve it — our legitimate interests in running a working service. You can object to this at any time.
• To send marketing email, if you ask for it — your consent, which you can withdraw at any time.
• To meet legal obligations, such as keeping accounting records — a legal obligation.

Processors and recipients

Do not enter information about real patients in the practice material.

The exercises are teaching simulations. Never type a name, an NHS number, a date of birth or anything else that could identify a real patient, colleague or relative — not even in altered form. Use invented details.

• Supabase — database and authentication. Data is stored in the EU.
• Vercel — hosting and operation of the site, plus anonymous visitor statistics (Vercel Web Analytics) and page-speed measurement (Vercel Speed Insights). See “Cookies” below.
• Cloudflare — storage and delivery of images and media files.
• Paddle — payment and invoicing. Paddle is the Merchant of Record for your purchase and an independent controller of your payment data.
• Resend (Plus Five Five, Inc.), USA — sends the confirmation email when you buy a subscription. That transfer is covered by the standard contractual clauses in Resend’s data processing agreement.

Where a provider processes data outside the UK, we rely on a lawful transfer mechanism such as standard contractual clauses. Ask us and we will tell you which one applies to a given provider.

How long we keep it

We keep personal data for as long as you have an account, and after that for as long as we need it to meet a legal obligation — accounting records, for example — or to deal with a claim. After that it is deleted or anonymised.

The record of pages you visited is deleted automatically twelve months after the visit.

If your account is deleted, the practice data attached to it goes with it.

Your rights

You have the right to ask for a copy of your personal data, to have it corrected, to have it erased, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on your consent, you can withdraw it at any time.

Use these rights by emailing support.lexiteam@gmail.com. There is no self-service export or account-deletion button on the UK pages yet, so this address is how a request reaches us. We answer within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk, or on 0303 123 1113. We would rather you told us first, but you do not have to.

Cookies

We use cookies that are strictly necessary for signing in, keeping you signed in and remembering which country’s pages you are reading. These are exempt from the consent requirement in the Privacy and Electronic Communications Regulations because the service cannot work without them. We do not use advertising or analytics cookies.

To improve the service we use anonymous visitor statistics (Vercel Web Analytics) and page-speed measurement (Vercel Speed Insights). These use no cookies, and the data is not linked to you as a person or to your IP address. What is recorded is the page opened, the page you came from, approximate location (country, region and city), browser, operating system and device type. A visit is counted using an anonymous code derived from the request, which is discarded after 24 hours. We do not send addresses that could point to you: admin pages are not sent, links to your own oral-exam sessions are sent without the session ID, and all parameters are removed from addresses before they are sent.

Contact

iLexiBox — support.lexiteam@gmail.com. See also our Terms and Cancellation rights.