MrcemUltra — Privacy Policy

Effective date: 15 October 2026

1. Who we are

MrcemUltra (mrcemultra.com) is operated by CogniLoop Ltd, a company registered in England and Wales under company number 17237168, with its registered office at 08 Greensforge Drive, Stockton-On-Tees, England, TS17 5LZ. MrcemUltra is a trading name of CogniLoop Ltd.

CogniLoop Ltd is the data controller of the personal data described in this policy. For anything relating to your personal data, contact us at info@mrcemultra.com.

CogniLoop Ltd is registered with the Information Commissioner's Office (ICO), registration number ZC228969.

This policy explains what personal data we collect when you use MrcemUltra, why we collect it, what we do with it, how long we keep it, and the rights you have over it. It applies to both free and paid accounts.

2. The data we collect

Account data. Your name, email address, password (stored in protected form), and any profile details you choose to provide.

Purchase data. Records of what you bought, when, for how much, and the status of any refund. Your payment itself is processed by Stripe — we never see or store your full card number. Stripe shares with us limited payment metadata (such as the card type, the last four digits, and the outcome of the payment) so we can manage your purchase and any refund.

Study and performance data. Your activity on the platform: questions attempted and your answers, scores, confidence ratings, time spent, topics opened, mock examination results, and progress statistics. This data powers your dashboards and progress tracking, operates the usage thresholds in our Money-Back Guarantee, and — in anonymised form — helps us build better learning tools.

Technical data. IP address, browser and device information, login timestamps, and server logs generated automatically when you use the Service. We use this to keep the platform secure and working properly.

Communications. Emails and messages you send us, including support requests and refund claims.

We do not intentionally collect any special category data (such as health data), and we ask that you do not include it in communications with us.

3. Why we use your data, and our lawful bases

Under UK data protection law, we need a lawful basis for each way we use your personal data:

4. How we use study data to improve the platform

We are building learning tools that adapt to how doctors actually study — for example, analysis that combines accuracy, time, and confidence to identify weak areas. To develop these tools we analyse study and performance data in anonymised and aggregated form, meaning it can no longer be linked to you. Your identifiable study history is used only to provide your dashboards, progress tracking, and (in future) personalised features within your own account.

We have carried out and documented a legitimate interests assessment for this use. You have the right to object — see Section 10.

5. Marketing

We only send marketing emails if you opt in — for example, by ticking the marketing preference box when you register. Every marketing email we send includes an unsubscribe link, and you can also opt out at any time by emailing info@mrcemultra.com. Opting out does not affect service emails we need to send you, such as purchase confirmations, refund correspondence, and important notices about your account or changes to our terms.

Advertising audiences. We may in future use contact details (such as email addresses) to create custom or matched audiences with advertising platforms such as Meta, so that we can show relevant advertising to people who have expressed interest in MrcemUltra, or exclude existing customers from advertising. Where we do this, it will be limited to people who have consented to marketing, the data will be shared in hashed form, and you can object or withdraw at any time via info@mrcemultra.com.

6. Who we share your data with

We do not sell your personal data. We share it only with service providers who process it on our behalf under contracts that protect it, and only to the extent needed:

• Stripe — payment processing and fraud prevention;
• Site4Now — hosting of the platform and its database;
• Email providers — routing and management of our email correspondence;
• Google — website analytics (Google Analytics), only if you click "Accept" on the cookie choice (Section 9);
• Meta Platforms — the Meta Pixel, which helps us show and measure our ads and loads only if you click "Accept" on the cookie choice (Section 9); and the advertising audiences described in Section 5, as and when they are activated;
• Professional advisers (such as our accountant) and authorities — where necessary for our legal obligations, or to establish, exercise, or defend legal claims.

The Meta Pixel works differently. Meta also uses the data it receives through the Meta Pixel for its own purposes. For collecting this data on our site and sending it to Meta, we and Meta are joint controllers, under Meta's Business Tools Terms. Meta is responsible for what it does with the data once it receives it, as described in Meta's Privacy Policy.

If CogniLoop Ltd is ever party to a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction; this policy would continue to apply to it and you would be notified of any material change.

7. How long we keep your data

• While your account is open: we keep your account, purchase, and study data so we can provide the Service — including restoring your full study history if you buy a further Access Pass for a later examination sitting.
• After your paid access expires, your account stays open (with free-tier access) and your data is retained as above.
• If your account is closed — by you or by us — we delete or anonymise your identifiable personal data within 24 months of closure. We keep this window so that returning users can ask us to reinstate their study history. Purchase records are kept for up to 6 years after the transaction, as required for tax and accounting purposes.
• Anonymised data — study data from which you can no longer be identified — may be retained indefinitely for the product-improvement purposes in Section 4.
• If you ask us to delete your data (Section 10), we act within 30 days, subject only to records we are legally required to keep.

8. Where your data is stored and international transfers

Your data is stored on servers located in the UK / European Economic Area. Where any of our service providers processes personal data outside the UK, we ensure an appropriate safeguard recognised by UK data protection law is in place — such as a UK adequacy decision covering the destination country, or the UK International Data Transfer Agreement or Addendum — so that your data receives an equivalent standard of protection.

Our development work is carried out in a separate test environment that does not contain user personal data.

9. Cookies

Cookies are small files a website saves in your browser. Some websites also save small pieces of information in your browser's own storage, which works in a similar way. This section covers both.

Cookies and storage the Service needs to work. These do not require your consent, because the Service cannot work properly without them:

• Logging in and security: cookies that keep you logged in and keep the Service secure;
• Payments: cookies set by Stripe for fraud prevention during checkout;
• Your settings: your choice of light or dark mode, whether you have already seen the guided tour, and your cookie choice itself (so we do not ask you again on every page);
• The free mock exam: a random code that lets you take the free mock exam without an account and then see your results.

Analytics and advertising (only if you click "Accept"). When you first visit MrcemUltra, we ask whether you accept these cookies. If you click "Accept", we use:

• Google Analytics (provided by Google), to see which parts of MrcemUltra help you most. It tells us which pages are visited and how the Service is used, so we can improve it.
• The Meta Pixel (provided by Meta Platforms), to show our ads to doctors preparing for MRCEM and to measure how well those ads work. It tells Meta when certain things happen on our site: a page is visited, the Last-Week High-Yield Notes are downloaded, the free mock exam is started, an email address is verified for the free mock, or a payment is completed. We do not send Meta your name, your email address, or the amount you paid.

These tools collect information such as the pages you visit, the time of your visit, your device and browser type, and your IP address. Google and Meta may combine this with other information they hold, under their own privacy policies.

Neither Google Analytics nor the Meta Pixel loads until you click "Accept". If you click "Reject", neither is used, and the Service works exactly the same.

Changing your choice. You can change your mind at any time using the "Cookie settings" link at the bottom of any page. This shows the cookie choice again. If you change from "Accept" to "Reject", we stop collecting this information from the next page you visit, and remove the Google Analytics and Meta cookies that our site set in your browser.

Where this data goes. Google and Meta may process this data outside the UK, including in the United States. Where they do, the transfer is protected by safeguards recognised by UK data protection law, as described in Section 8.

How long it is kept. Google Analytics keeps event data for 14 months. Its cookies can stay in your browser for up to 2 years, and the Meta Pixel cookie for up to 90 days, unless you clear them or click "Reject". Meta keeps the data it receives from the Meta Pixel under its own policy: see Meta's Privacy Policy.

10. Your rights

You have the following rights over your personal data, exercisable free of charge by emailing info@mrcemultra.com from your registered email address:

• Access — a copy of the personal data we hold about you;
• Rectification — correction of inaccurate or incomplete data;
• Erasure — deletion of your data (subject to records we must legally keep);
• Restriction — limiting how we use your data in certain circumstances;
• Portability — a machine-readable copy of data you provided to us, where processed by consent or contract;
• Objection — to processing based on legitimate interests, including the product-improvement use in Section 4, and to any direct marketing (which we will always stop on request);
• Withdraw consent — at any time, where consent is our lawful basis, without affecting processing already carried out.

We respond to rights requests within one month. We may need to verify your identity before acting on a request.

11. Security

We take appropriate technical and organisational measures to protect your personal data, including encrypted connections (HTTPS), passwords stored in hashed form, payment processing handled by Stripe rather than on our servers, and access to personal data restricted to those who need it. No online service can guarantee absolute security, but if we become aware of a personal data breach that puts your rights at risk, we will notify the Information Commissioner's Office and, where required, affected users, in line with our legal obligations.

12. Children

MrcemUltra is a service for adults preparing for postgraduate medical examinations. It is not intended for, and must not be used by, anyone under 18, and we do not knowingly collect data from anyone under 18.

13. Complaints and contact

If you have any question, concern, or complaint about how we handle your personal data, contact us first at info@mrcemultra.com — we will do our best to resolve it.

You also have the right to complain to the UK supervisory authority: the Information Commissioner's Office (ICO) — ico.org.uk / 0303 123 1113.

14. Changes to this policy

We may update this policy from time to time. Material changes will be notified to registered users by email or by a prominent notice on the platform. The effective date at the top of this policy shows when it was last revised.

Last updated: 15 October 2026