Privacy Policy

This policy explains what personal data MedAmp collects, why we use it, who we share it with, and the rights you have under UK data protection law. It is written in plain English. If anything is unclear, email us.

1. Who we are

MedAmp is a founder-run product based in the United Kingdom. For the purposes of UK GDPR, MedAmp is the data controller for the personal data described in this policy. MedAmp is registered with the UK Information Commissioner's Office (ICO) under registration number ZC195313. You can contact us about privacy at privacy@medamp.co.uk.

2. What we collect

• Account details: your name, email address, chosen career stage, and target specialty.
• Portfolio self-assessment selections: the domain indicators, evidence checks, and notes you record.
• Activity log entries: items you add to your training activity log, such as courses, presentations, and audits.
• Uploaded evidence documents: files you upload for AI feedback on a specific domain.
• Basic usage data: log data such as IP address, browser type, and timestamps, used to keep the service secure and working.

3. How we use it

We use your data to:

• Provide scoring against the published portfolio frameworks.
• Save your progress so you can track it over time.
• Generate AI feedback on evidence documents you choose to upload.
• Keep your account secure and prevent abuse.
• Contact you about important changes to the service.

We do not sell your data. We do not use your portfolio content for advertising and we do not share it with recruiters, deaneries, or employers.

4. AI processing of uploaded documents

When you request feedback on an uploaded document, the document is sent to Anthropic's Claude API for analysis. Anthropic returns structured feedback which we save against your account. You must remove all patient-identifiable data (names, NHS or hospital numbers, dates of birth, addresses, and any other identifiers) before you upload anything. We scan uploads and block anything that appears to contain patient-identifiable data.

5. Third-party processors

We share your data only with the processors we need to run the service. Each is bound by its own data protection terms.

• Lovable Cloud / Supabase: hosting, database, file storage, and authentication.
• Anthropic: AI feedback on documents you upload.
• Resend: transactional and account emails.
• Cloudflare: DNS and email routing for the medamp.co.uk domain.
• Google: optional sign-in with a Google account, if you choose to use it.

6. Retention and deletion

Uploaded evidence files are automatically deleted from storage 30 days after upload. The written feedback and action items generated from them are kept so your progress and history remain intact.

You can permanently delete your account at any time from Settings. This removes your profile, portfolio selections, requirement checks, portfolio reviews, action items, roadmap progress, activity log, and any remaining uploaded files. You can also export your data as JSON from Settings before deleting.

7. Your UK GDPR rights

You have the right to access your data, to have it corrected, to have it deleted, to receive it in a portable format, to restrict processing, and to object to processing. To exercise any of these rights, email privacy@medamp.co.uk. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

8. Cookies and analytics

We use only the essential cookies needed to sign you in and keep your session active. We do not use advertising cookies and we do not use third-party tracking cookies.

For usage analytics we use Plausible Analytics, a privacy-friendly, cookieless analytics tool hosted in the EU. Plausible does not set cookies, does not collect personal data, and does not track users across sites. It records aggregated page views and product events (for example, a new signup or joining the founding list) without any identifiers we could tie back to you.

9. Children

MedAmp is intended for medical students and doctors and is not directed at anyone under 16.

10. Changes to this policy

We may update this policy from time to time. Material changes will be notified in the service. The "Last updated" date at the top reflects the current version.

11. Contact

Privacy questions and requests: privacy@medamp.co.uk.