1.Summary
MedAscend processes personal and performance data on behalf of educational institutions for the purpose of delivering clinical communication training.
- Institutions act as Data Controllers. MedAscend acts as a Data Processor.
- We do not sell, trade, or misuse personal data.
- We do not store raw passwords.
- We do not use personal or performance data for AI model training.
- We do not share identifiable data with third parties unless legally required or authorised by the institution.
- All data is stored exclusively within UK and EU regions.
2.Data We Collect Automatically
When you access the platform, we automatically collect certain technical and usage data, including:
- IP address
- Browser type and device information
- Session activity (timestamps, navigation events)
- System performance data
- Essential cookies required for authentication and security
We do not use tracking cookies, advertising cookies, or third-party marketing cookies.
3.Data You Provide to Us
When you create or access an account via your institution, we collect:
- Name
- Email address
- Year group or cohort
- Consultation transcripts
- Performance metrics and feedback
- User-submitted text within the platform
We do not collect:
- Real patient data
- Health records
- Special category data unless explicitly required by the institution
4.Data Controller and Data Processor
Data Controller: Your university or educational institution.
Data Processor: Medical Ascend Limited.
5.Categories of Personal Data Processed
Essential Account Data
- Name
- Email address
- Institution affiliation
- Year group
Performance Data
- Consultation transcripts
- AI-generated feedback
- Scores and analytics
- Scenario interaction history
Technical and Security Data
- IP address
- Device metadata
- Authentication logs (Microsoft Entra ID)
All data is processed under strict access controls and encryption.
6.How and Where Data Is Processed
Processing Methods
Data is processed using:
- Encrypted databases (Cloudflare D1 EU)
- Encrypted object storage (Cloudflare R2 EU)
- Secure serverless compute (Cloudflare Workers)
- Microsoft Entra ID authentication
- Google Vertex AI Gemini (EU inference region only)
- Langfuse EU for pseudonymised debugging and observability
Student identifiers are pseudonymised before being sent to Vertex AI.
Data Residency
All personal and performance data is stored exclusively within UK and EU regions:
- Cloudflare R2 (WEUR)
- Cloudflare D1 (WEUR)
- Langfuse (EU)
- Google Vertex AI (EU inference region)
No identifiable data is transferred outside the UK or EU.
7.Retention Time
Retention periods are determined by the institution.
By default:
- Data is retained for the duration of the course or institutional contract.
- Upon contract termination, data is securely deleted or anonymised unless otherwise instructed.
8.Purposes of Processing
We process data strictly for:
- Providing educational services
- Delivering personalised feedback
- Supporting academic evaluation
- Platform security and performance
- Debugging and quality assurance
- Contractual obligations
- Conducting educational and pedagogical research using anonymised or pseudonymised performance data, where authorised by the Data Controller.
We do not use personal data for advertising or unrelated commercial purposes.
9.Legal Basis for Processing
We process data under the following legal bases:
- Performance of a contract
- Legitimate interests
- Compliance with legal obligations
- Institutional consent where applicable
Where pseudonymised data is used for research purposes, processing is based on the Data Controller’s lawful basis under Article 6(1)(e) or 6(1)(f), as applicable, and carried out by MedAscend under Article 28 instructions.
11.Use of Anonymised and Pseudonymised Data
MedAscend may, where expressly authorised by the relevant Data Controller, use pseudonymised performance data for the purposes of:
- Platform analytics
- Educational research
- Pedagogical validation
- Assessment methodology evaluation
- Product improvement
- Marketing materials
- Grant applications
Such data:
- Shall not include direct identifiers (name, email, student ID)
- Shall not be used to make decisions about individual users
- Shall not be re-identified
- Shall be processed only under documented controller instructions
MedAscend shall remain a Data Processor for all such processing.
12.Demo Accounts and Trial Access
MedAscend may create temporary demo accounts for evaluation purposes.
Demo accounts:
- Require minimal personal data
- Operate in a controlled environment
- Do not contain real student data
- Are automatically disabled after evaluation
- Have all data deleted within 30 days unless extended
Demo data is not used for AI training, marketing, or reporting unless fully anonymised.
13.International Data Transfers
We do not transfer identifiable data outside the UK or EU.
If required, appropriate safeguards such as SCCs, UK Addendum, and encryption will be applied.
14.Security Measures
We implement industry-standard security controls, including:
- TLS 1.2+ encryption
- AES-256 encrypted storage
- Role-based access control
- Microsoft SSO
- Multi-factor authentication
- Encrypted audit logs
- Regular security reviews
15.Your Rights Under UK GDPR
You have the right to:
- Access your data
- Correct inaccuracies
- Request deletion
- Restrict processing
- Object to processing
- Request data portability
Requests are handled via your institution.
16.How to Exercise Your Rights
To exercise your rights, contact your institution or email hello@medascend.ai.
18.Changes to This Privacy Policy
We may update this policy periodically. Significant changes will be communicated via email or platform notifications.
19.Contact Information
Medical Ascend Limited
7E Abbotsford Street
Dundee
DD2 1DE
Email: hello@medascend.ai
You may lodge a complaint with the UK Information Commissioner’s Office (ICO) if you believe your rights have been violated.