1. Data Controller & Scope
Welcome to GP PRO (incorporating AKTivate, SCAce, and the AI Medical Tutor). This Privacy Policy explains how GP PRO collects, processes, stores, and protects personal data when you access or use our mobile applications (iOS and Android via Capacitor) and web platform at https://gppro.co.uk.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the Data Controller is:
Website: trackingpro.co.uk • https://gppro.co.uk
Privacy & Data Inquiries: [email protected]
2. Information We Collect
We only collect data necessary to deliver your personalized medical revision experience and synchronize your learning across your devices.
| Category | Data Collected | Source & Purpose |
|---|---|---|
| Identity & Account | Full name, email address, password (stored as a one-way cryptographic bcrypt hash), optional phone number, optional profile picture (avatar). | Provided by you upon registration or profile update. Required to establish and authenticate your GP PRO account. |
| Federated Sign-In (Google) | If you choose to sign in with Google: your Google user ID, name, email address, and profile picture provided via OAuth 2.0. | Provided by Google upon your authorization. We do not receive or store your Google password. |
| Study Progress & Activity | Flashcards reviewed, star ratings (1–5 stars), completed status, review counters, bookmark flags, active streaks, last studied flashcard ID, chapter completion percentages. | Generated automatically as you study. Synchronizes your spaced repetition progress across mobile and desktop. |
| User-Generated Content | Custom flashcard decks created in "My Cards", questions, answers, and study notes. | Created voluntarily by you. Stored privately unless you choose to share a chapter with the Community. |
| AI Tutor Conversations | Text prompts, clinical scenario queries, and follow-up study questions submitted to the AI Medical Tutor. | Submitted by you during study sessions to generate tailored explanations and exam tips. |
| Feedback & Surveys | Responses to user satisfaction questions, suggestions, and feedback. Can be submitted with your name or anonymously. | Submitted voluntarily to help us improve the GP PRO study platform for GP trainees. |
| Technical & Device Data | IP address, browser type and version, device platform (iOS, Android, Web), operating system, and access timestamps. | Collected automatically for server security, crash prevention, and rate-limiting. |
3. How We Use Your Information & Legal Basis
We process your personal data in accordance with the UK GDPR on the following legal bases:
- Contractual Necessity (Article 6(1)(b) UK GDPR): To create and manage your account, provide access to AKTivate and SCAce revision content, save your flashcard progress, and synchronize your learning across devices.
- Legitimate Interests (Article 6(1)(f) UK GDPR): To secure the platform against fraud, abuse, and unauthorized access; analyze aggregated usage patterns to enhance educational content; and ensure platform stability.
- Consent (Article 6(1)(a) UK GDPR): For optional preferences such as non-essential cookie storage and voluntary survey participation. You may withdraw consent at any time.
4. AI Medical Tutor & Automated Assistance
GP PRO includes an interactive AI Medical Tutor designed to assist GP trainees with MRCGP AKT and SCA preparation, clinical guidelines, and consultation techniques.
- When you submit a prompt to the AI Tutor, your query is securely processed via encrypted API communication with our AI infrastructure.
- Zero Training on Personal Data: Your queries and account information are not used to train public or foundational third-party artificial intelligence models.
- Educational Use Only: The AI Medical Tutor provides educational revision guidance based on published UK clinical guidelines (such as NICE CKS and RCGP curriculum guidelines). It does not provide real patient clinical advice or establish a patient-doctor relationship.
6. Data Retention & Self-Serve Account Deletion
We retain your personal data for as long as your GP PRO account remains active. If you discontinue using the platform, you have the right to request deletion at any time.
You can permanently delete your GP PRO account and all associated data at any time directly within the application:
- Open the GP PRO app or web portal and sign in.
- Navigate to Profile (tap your avatar or the profile icon).
- Scroll to the Delete Account panel.
- Click Delete my account, type
DELETE, and confirm with your password or linked Google account.
Alternatively, you may email us at [email protected] from your registered email address with the subject "Account Deletion Request", and our support team will process your request within 7 business days.
7. Data Security
We implement robust technical and organizational security measures to protect your information against unauthorized access, loss, or alteration:
- Transport Layer Security (TLS/HTTPS): All communications between your device, the mobile app, and our servers are encrypted using modern TLS 1.3 encryption.
- Cryptographic Password Hashing: Passwords are protected using salted bcrypt hashes and are never stored in plaintext.
- Secure Session Management: Authenticated sessions use cryptographic API tokens (Laravel Sanctum) with automatic session expiry.
- Access Restrictions: Access to production databases is strictly limited to authorized administrative personnel through encrypted keys.
8. Your Rights (UK GDPR & DPA 2018)
Under UK and EU data protection laws, you hold the following statutory rights regarding your personal data:
- Right of Access: Request a copy of the personal data we hold about you (Subject Access Request).
- Right to Rectification: Request correction of inaccurate or incomplete personal data (you can also edit your name, phone, and password directly in your Profile).
- Right to Erasure ("Right to be Forgotten"): Request the permanent deletion of your personal data as outlined in Section 6.
- Right to Data Portability: Request that we provide your data in a structured, commonly used, and machine-readable format.
- Right to Restrict or Object to Processing: Object to processing based on legitimate interests or request restrictions during ongoing disputes.
- Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, please contact our Data Protection Team at [email protected]. We respond to all verified requests within one calendar month.
If you have unresolved concerns, you also have the right to lodge a complaint with the UK supervisory authority: the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
10. Children's Privacy
GP PRO is a professional medical educational platform designed for adult medical students, GP trainees, general practitioners, and healthcare professionals. Our services are not intended for or directed towards individuals under the age of 18. We do not knowingly collect personal information from children.
11. Changes to this Privacy Policy
We may periodically update this Privacy Policy to reflect enhancements to GP PRO, regulatory requirements, or changes in data protection legislation. When changes occur, we will update the "Last Updated" date at the top of this policy and provide prominent notice within the app or via email when material updates take effect.
12. Contact Us
If you have any questions, comments, or requests regarding this Privacy Policy or how your data is handled, please reach out to us:
Email: [email protected]
Web: https://gppro.co.uk/portal
Parent Organisation: TrackingPro • United Kingdom