Privacy Policy of MedAscend

MedAscend is operated by Medical Ascend Limited, a company registered in Scotland under company number SC815878. MedAscend provides AI-supported clinical communication training and simulated EPR activities to educational institutions.

Where MedAscend provides the Platform to an institution, the institution usually acts as Data Controller and Medical Ascend Limited acts as Data Processor. For website enquiries, demo requests, sales communications, support communications and business administration, Medical Ascend Limited may act as Data Controller.

We do not sell personal data. We do not store raw passwords. We do not use personal or performance data to train third-party AI foundation models. We do not use identifiable student data in public marketing materials.

We do not use institution data, student data, consultation transcripts, EPR entries, assessment outputs, performance analytics or institution-owned content to train, fine-tune or improve AI models. Our relevant sub-processors are contractually required not to use MedAscend customer data to train or improve their models.

When you access the platform, we automatically collect certain technical and usage data, including:

• IP address
• Browser type and device information
• Session activity (timestamps, navigation events)
• System performance data
• Essential cookies required for authentication and security

We do not use advertising cookies or third-party marketing cookies. Any analytics cookies will only be used where consent is obtained where required.

When you create or access an account via your institution, we collect:

• Name
• Email address
• Year group or cohort
• Consultation transcripts
• Performance metrics and feedback
• User-submitted text within the platform

The EPR module is a simulated educational tool. Users must not upload, enter or store identifiable real patient data, real clinical records, or personal health information relating to real individuals. Any clinical information within the EPR module should relate only to simulated patients and educational scenarios.

Consultation transcripts and user-submitted text may be linked to a user account for educational feedback and institutional evaluation. Users should not include personal information about themselves or others during simulated consultations unless required for the educational activity.

We do not collect:

• Real patient data
• Health records
• Identifiable real patient data or real special category data relating to real individuals.

For institutional platform use, the relevant university, NHS organisation, training provider or educational institution usually acts as the Data Controller. Medical Ascend Limited acts as the Data Processor and processes personal data under the institution’s documented instructions.

For website enquiries, demo requests, sales communications, support communications and business administration, Medical Ascend Limited may act as Data Controller.

Essential Account Data

• Name
• Email address
• Institution affiliation
• Year group

Performance Data

• Consultation transcripts
• AI-generated feedback
• Scores and analytics
• Scenario interaction history

Technical and Security Data

• IP address
• Device metadata
• Authentication logs (Microsoft Entra ID)

All data is processed under strict access controls and encryption.

Processing Methods

Data is processed using:

• Encrypted databases (Cloudflare D1 EU)
• Encrypted object storage (Cloudflare R2 EU)
• Secure serverless compute (Cloudflare Workers)
• Microsoft Entra ID authentication
• Google Vertex AI Gemini (EU inference region only)
• Langfuse EU for pseudonymised debugging and observability

Student identifiers are pseudonymised before being sent to Vertex AI.

Data Residency

MedAscend’s core platform data is currently configured to be stored and processed in UK and EU regions where supported by our infrastructure providers. Cloudflare services are configured for UK/EU or Western Europe regional storage where applicable. Cloudflare’s edge network may route traffic through the nearest appropriate point of presence for performance and security, but this is distinct from the configured storage location of persistent platform data.

MedAscend uses AI services to deliver simulated consultations, feedback, assessment functionality and simulated EPR activities.

MedAscend does not use institution data, student data, consultation transcripts, EPR entries, assessment outputs, performance analytics or institution-owned content to train, fine-tune or improve AI models.

MedAscend has contractual arrangements with its relevant AI and infrastructure sub-processors requiring that MedAscend customer data is processed only to provide the contracted service and is not used to train, fine-tune or improve their general-purpose AI models.

Data processed through AI services is used only to deliver the MedAscend platform, provide educational feedback, support assessment functionality, maintain platform security, debug technical issues and improve service reliability, in accordance with institutional instructions and applicable data protection law.

MedAscend does not rely on proximity-based routing alone for data residency. Persistent platform data is stored using provider-supported UK/EU regional or jurisdictional controls where available.

Our current platform configuration uses UK/EU or Western Europe regional storage and processing for core platform data, including database storage, object storage, AI processing, authentication and observability tools where supported.

Where a provider uses global infrastructure for routing, resilience or security, this does not change the configured storage location of persistent platform data.

Retention periods are determined by the institution.

By default:

• Data is retained for the duration of the course or institutional contract.
• Upon contract termination, data is securely deleted or anonymised unless otherwise instructed.

We process data strictly for:

• Providing educational services
• Delivering personalised feedback
• Supporting academic evaluation
• Platform security and performance
• Debugging and quality assurance
• Contractual obligations
• Conducting educational and pedagogical research using anonymised or pseudonymised performance data, where authorised by the Data Controller.

We do not use personal data for advertising or unrelated commercial purposes.

For institutional platform use, the relevant institution determines the lawful basis for processing personal data. MedAscend processes personal data under the institution’s documented instructions.

Where Medical Ascend Limited acts as Data Controller, we may rely on lawful bases including performance of a contract, legitimate interests, compliance with legal obligations, and consent where applicable.

Where pseudonymised data is used for research, validation or evaluation, this will be carried out under the institution’s documented instructions or with appropriate authorisation.

Sharing with Institutions

As a Data Processor, MedAscend shares:

• Student performance data
• Consultation transcripts
• Engagement analytics

Only with the relevant institution.

Sub-Processors

We use vetted sub-processors, including:

• Cloudflare (EU infrastructure)
• Google Vertex AI (EU inference only)
• Microsoft Entra ID
• Langfuse (EU)

All sub-processors are UK GDPR compliant and reviewed regularly.

MedAscend maintains a sub-processor list for institutional customers, setting out the purpose of each sub-processor, the type of data processed, the processing location and any applicable transfer safeguards.

Legal Requirements

Data may be disclosed if required by law or regulatory authority.

MedAscend may, where expressly authorised by the relevant Data Controller, use pseudonymised performance data for the purposes of:

• Platform analytics
• Educational research
• Pedagogical validation
• Assessment methodology evaluation
• Product improvement
• Aggregated, anonymised outcome reporting for institutional reporting, grant applications and marketing, where authorised by the institution.
• Grant applications

Such data:

• Shall not include direct identifiers (name, email, student ID)
• Shall not be used to make decisions about individual users
• Shall not be re-identified
• Shall be processed only under documented controller instructions

MedAscend shall remain a Data Processor for all such processing.

MedAscend will not use identifiable or pseudonymised individual-level student data in public marketing materials.

MedAscend may create temporary demo accounts for evaluation purposes.

Demo accounts:

• Require minimal personal data
• Operate in a controlled environment
• Do not contain real student data
• Are automatically disabled after evaluation
• Have all data deleted within 30 days unless extended

Demo data is not used for AI training, marketing, or reporting unless fully anonymised.

MedAscend’s core platform data is currently configured for UK/EU storage and processing where supported. We do not intentionally transfer identifiable institutional platform data outside the UK or EU unless necessary for service delivery and appropriate safeguards are in place.

Where international transfers are required, MedAscend will use appropriate safeguards, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, contractual protections, encryption and access controls, as applicable.

We implement industry-standard security controls, including:

• TLS 1.2+ encryption
• AES-256 encrypted storage
• Role-based access control
• Microsoft SSO
• Multi-factor authentication
• Encrypted audit logs
• Regular security reviews

For institutional accounts, data protection rights requests should normally be made to the relevant institution as Data Controller. If you contact MedAscend directly, we may refer or forward your request to the relevant institution so it can be handled appropriately.

Rights available under UK GDPR include the right to:

• Access your data
• Correct inaccuracies
• Request deletion
• Restrict processing
• Object to processing
• Request data portability

To exercise your rights, contact your institution or email hello@medascend.ai.

MedAscend uses essential and security-related cookies required for authentication, session management and platform security.

Any analytics cookies will only be used where consent is obtained where required, in line with our cookie banner and Cookie Policy.

We do not use advertising or behavioural tracking cookies. Blocking essential cookies may limit platform functionality.

We may update this policy periodically. Significant changes will be communicated via email or platform notifications.

Email: hello@medascend.ai

You may lodge a complaint with the UK Information Commissioner’s Office (ICO) if you believe your rights have been violated.