MrcemUltra — Privacy Policy
1. Who we are
MrcemUltra (mrcemultra.com) is operated by CogniLoop Ltd, a company registered in England and Wales under company number 17237168, with its registered office at [INSERT REGISTERED OFFICE ADDRESS]. MrcemUltra is a trading name of CogniLoop Ltd.
CogniLoop Ltd is the data controller of the personal data described in this policy. For anything relating to your personal data, contact us at info@mrcemultra.com.
This policy explains what personal data we collect when you use MrcemUltra, why we collect it, what we do with it, how long we keep it, and the rights you have over it. It applies to both free and paid accounts.
2. The data we collect
Account data. Your name, email address, password (stored in protected form), and any profile details you choose to provide.
Purchase data. Records of what you bought, when, for how much, and the status of any refund. Your payment itself is processed by Stripe — we never see or store your full card number. Stripe shares with us limited payment metadata (such as the card type, the last four digits, and the outcome of the payment) so we can manage your purchase and any refund.
Study and performance data. Your activity on the platform: questions attempted and your answers, scores, confidence ratings, time spent, topics opened, mock examination results, and progress statistics. This data powers your dashboards and progress tracking, operates the usage thresholds in our Money-Back Guarantee, and — in anonymised form — helps us build better learning tools.
Technical data. IP address, browser and device information, login timestamps, and server logs generated automatically when you use the Service. We use this to keep the platform secure and working properly.
Communications. Emails and messages you send us, including support requests and refund claims.
We do not intentionally collect any special category data (such as health data), and we ask that you do not include it in communications with us.
3. Why we use your data, and our lawful bases
Under UK data protection law, we need a lawful basis for each way we use your personal data:
| What we do | Data involved | Lawful basis |
|---|---|---|
| Create and run your account; provide free and paid content; show your progress and analytics | Account, study and performance data | Contract — providing the Service you signed up for |
| Take payment, manage purchases and refunds, apply the Money-Back Guarantee usage thresholds | Purchase, study data (usage counts) | Contract |
| Keep proper accounting and tax records | Account, purchase data | Legal obligation |
| Secure the platform, prevent fraud and abuse, enforce our Terms (including detecting account sharing and content scraping) | Technical, account, study data | Legitimate interests — protecting the Service, our content, and our users |
| Improve the platform and develop new learning features, including adaptive and diagnostic tools, using anonymised and aggregated study data | Study and performance data (anonymised) | Legitimate interests — product improvement (see Section 4) |
| Send you marketing emails about MrcemUltra content, offers, and features | Account data | Consent — only if you opt in, and you can withdraw at any time |
| Respond to your messages and support requests | Communications | Legitimate interests — responding to you |
4. How we use study data to improve the platform
We are building learning tools that adapt to how doctors actually study — for example, analysis that combines accuracy, time, and confidence to identify weak areas. To develop these tools we analyse study and performance data in anonymised and aggregated form, meaning it can no longer be linked to you. Your identifiable study history is used only to provide your dashboards, progress tracking, and (in future) personalised features within your own account.
We have carried out and documented a legitimate interests assessment for this use. You have the right to object — see Section 10.
5. Marketing
We only send marketing emails if you opt in — for example, by ticking the marketing preference box when you register. Every marketing email we send includes an unsubscribe link, and you can also opt out at any time by emailing info@mrcemultra.com. Opting out does not affect service emails we need to send you, such as purchase confirmations, refund correspondence, and important notices about your account or changes to our terms.
Advertising audiences. We may in future use contact details (such as email addresses) to create custom or matched audiences with advertising platforms such as Meta, so that we can show relevant advertising to people who have expressed interest in MrcemUltra, or exclude existing customers from advertising. Where we do this, it will be limited to people who have consented to marketing, the data will be shared in hashed form, and you can object or withdraw at any time via info@mrcemultra.com.
6. Who we share your data with
We do not sell your personal data. We share it only with service providers who process it on our behalf under contracts that protect it, and only to the extent needed:
- Stripe — payment processing and fraud prevention;
- Site4Now — hosting of the platform and its database;
- Email providers — routing and management of our email correspondence;
- Meta Platforms — only as and when the advertising audiences described in Section 5 are activated;
- Professional advisers (such as our accountant) and authorities — where necessary for our legal obligations, or to establish, exercise, or defend legal claims.
If CogniLoop Ltd is ever party to a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction; this policy would continue to apply to it and you would be notified of any material change.
7. How long we keep your data
- While your account is open: we keep your account, purchase, and study data so we can provide the Service — including restoring your full study history if you buy a further Access Pass for a later examination sitting.
- After your paid access expires, your account stays open (with free-tier access) and your data is retained as above.
- If your account is closed — by you or by us — we delete or anonymise your identifiable personal data within 24 months of closure. We keep this window so that returning users can ask us to reinstate their study history. Purchase records are kept for up to 6 years after the transaction, as required for tax and accounting purposes.
- Anonymised data — study data from which you can no longer be identified — may be retained indefinitely for the product-improvement purposes in Section 4.
- If you ask us to delete your data (Section 10), we act within 30 days, subject only to records we are legally required to keep.
8. Where your data is stored and international transfers
Your data is stored on servers located in the UK / European Economic Area. Where any of our service providers processes personal data outside the UK, we ensure an appropriate safeguard recognised by UK data protection law is in place — such as a UK adequacy decision covering the destination country, or the UK International Data Transfer Agreement or Addendum — so that your data receives an equivalent standard of protection.
Our development work is carried out in a separate test environment that does not contain user personal data.
9. Cookies
MrcemUltra currently uses only strictly necessary cookies: those required to keep you logged in, keep the Service secure, and process payments safely (including cookies set by Stripe for fraud prevention during checkout). These do not require your consent and cannot be switched off without breaking the Service.
We do not currently use analytics or advertising cookies. If we introduce them in future, we will ask for your consent through a cookie banner before they are set, and this policy will be updated.
10. Your rights
You have the following rights over your personal data, exercisable free of charge by emailing info@mrcemultra.com from your registered email address:
- Access — a copy of the personal data we hold about you;
- Rectification — correction of inaccurate or incomplete data;
- Erasure — deletion of your data (subject to records we must legally keep);
- Restriction — limiting how we use your data in certain circumstances;
- Portability — a machine-readable copy of data you provided to us, where processed by consent or contract;
- Objection — to processing based on legitimate interests, including the product-improvement use in Section 4, and to any direct marketing (which we will always stop on request);
- Withdraw consent — at any time, where consent is our lawful basis, without affecting processing already carried out.
We respond to rights requests within one month. We may need to verify your identity before acting on a request.
11. Security
We take appropriate technical and organisational measures to protect your personal data, including encrypted connections (HTTPS), passwords stored in hashed form, payment processing handled by Stripe rather than on our servers, and access to personal data restricted to those who need it. No online service can guarantee absolute security, but if we become aware of a personal data breach that puts your rights at risk, we will notify the Information Commissioner's Office and, where required, affected users, in line with our legal obligations.
12. Children
MrcemUltra is a service for adults preparing for postgraduate medical examinations. It is not intended for, and must not be used by, anyone under 18, and we do not knowingly collect data from anyone under 18.
13. Complaints and contact
If you have any question, concern, or complaint about how we handle your personal data, contact us first at info@mrcemultra.com — we will do our best to resolve it.
You also have the right to complain to the UK supervisory authority: the Information Commissioner's Office (ICO) — ico.org.uk / 0303 123 1113.
14. Changes to this policy
We may update this policy from time to time. Material changes will be notified to registered users by email or by a prominent notice on the platform. The effective date at the top of this policy shows when it was last revised.
