Privacy Policy
Last updated: 8 October 2026
This policy explains what personal data we collect, why, who we share it with and what rights you have. It applies to formulary.uk and the Formulary service. It follows the UK GDPR and the Data Protection Act 2018.
1. Who we are
Formulary Education Ltd ("Formulary", "we", "us") is the controller of your personal data. Contact us at support@formulary.uk.
2. What we collect
- Account data: your name, email address, a password (stored only as a hash by our sign-in provider), your training status, your medical school or institution, your assessment date if you enter one, and the date and version of the terms you accepted.
- Purchase data: the plan you bought, the amount, the date, your Stripe customer reference. Stripe collects your card details. We never see or store them.
- Sign-in data: a sign-in token kept in a cookie in your browser while you are logged in. See the Cookie Policy.
- Usage data: your practice sessions, answers, scores, time taken, questions you mark for review or report, and your settings.
- Messages: your email address and message when you email us, and our replies.
- Technical data: your IP address and device details in the logs of our hosting provider, and page-view and speed measurements from Vercel Web Analytics and Speed Insights, which use no cookies and do not identify you. For the public demo we keep a one-way scrambled (hashed) form of your IP address for a short time, to stop abuse.
- Error reports: if error reporting is switched on, technical details of a fault. Names, email addresses, answers and the contents of requests are removed before a report is sent.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Create your account, give you access, mark your answers and show your results | Contract (Article 6(1)(b)) |
| Take payment and send order and service emails | Contract |
| Keep accounting and tax records | Legal obligation (Article 6(1)(c)) |
| Answer your messages and fix problems | Legitimate interests (Article 6(1)(f)): running and supporting the service |
| Keep the service secure, prevent abuse and fraud, and find and fix errors | Legitimate interests |
| Measure page views and speed to keep the site fast | Legitimate interests |
| Improve questions, using results that are combined across many candidates | Legitimate interests |
| Deal with a payment query or a request under your legal rights | Contract and legitimate interests |
4. Automated marking
Your answers are marked by software against the answers each question accepts. This is how the service works. It does not make decisions that have a legal or similarly significant effect on you. We use no artificial intelligence services to process your personal data.
5. Marketing
We do not send marketing emails. If that changes, we will ask for your consent first, as the Privacy and Electronic Communications Regulations (PECR) require, and you will be able to withdraw it at any time. We only send emails about your account, your purchase and the service.
6. How long we keep it
- Account and practice data: for as long as your account exists. When you delete your account, this data is deleted, together with our own record of your plan. Copies in our providers' backups are overwritten on their normal schedule.
- Payment records: Stripe keeps these as the law requires, and we keep our accounting records for six years from the end of the financial year, as tax law requires.
- Contact messages and replies: until your query is resolved, then for up to 12 months.
- Scrambled IP addresses used to limit abuse: a short time, then cleared automatically.
- If you do not use your account, we keep it until you delete it or ask us to.
8. International transfers
Our database is hosted in Paris, France, and moving personal data from the UK to the European Economic Area is covered by UK adequacy regulations. Some of our other providers process data outside the UK, including in the United States. Where they do, the transfer is protected by a UK adequacy regulation, the UK International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses.
9. Your rights
You have the right to be told how we use your data, to see it, to have it corrected, to have it deleted, to limit or object to our use of it, and to take a copy of it in a portable form. Where we rely on legitimate interests you can object. You can withdraw any consent at any time.
You can do most of this yourself. On your account page you can correct your details, download a copy of your data and delete your account. For anything else, email support@formulary.uk. We will deal with your request without undue delay and within the time the law allows. There is normally no charge.
10. Complaints
If you are unhappy with how we use your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
12. Security
Data is sent over encrypted connections. Access to our systems is restricted, and our database is set so that one user cannot read another user's data. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the regulator as the law requires.
13. Children
Formulary is for adults. You must be 18 or over to have an account.
14. Changes
We will post changes on this page and change the date at the top. If a change is significant we will tell account holders by email.
Company details. Formulary Education Ltd, registered in England and Wales, company number 17507865. Registered office: Suite A, 82 James Carter Road, Mildenhall, United Kingdom, IP28 7DE.