Privacy Policy

ScrubbedIn ("we", "us") operates scrubbedin.app, an educational platform for surgical trainees. ScrubbedIn is the data controller for the personal data described in this policy.

Contact for privacy matters: adminscrubbedinapp@gmail.com

We collect only what is needed to run the service:

• Account data — your name, email address and a hashed password when you register.
• Subscription data — your subscription plan and status. Card details are collected and processed by Stripe; we never see or store your full card number.
• Usage data — quiz sessions, answers and scores, so we can show your progress.
• Technical data — authentication cookies required to keep you signed in.

We do not collect special-category data, we do not process patient data, and all clinical images on the platform are AI-generated illustrations that do not depict real patients.

• Performance of a contract — creating your account, providing the content you have subscribed to, processing payments and showing your progress.
• Legitimate interests — securing the platform, preventing abuse, and understanding aggregate usage so we can improve the service.
• Legal obligation — keeping transaction records for tax and accounting purposes.

We use a small number of processors to run the service, each bound by data-processing agreements:

• Supabase — database and authentication hosting.
• Stripe — payment processing (Stripe is an independent controller for payment data; see the Stripe Privacy Policy).
• Our hosting provider — serving the website.

We do not sell your personal data and we do not share it with advertisers. Where a processor stores data outside the UK, transfers are protected by UK-approved safeguards such as the International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses.

We use only strictly necessary cookies — the authentication cookies that keep you signed in. We do not use advertising or third-party analytics cookies, which is why we do not show a cookie consent banner. If we introduce analytics in future, this policy and the site will be updated first.

• Account and usage data — for as long as your account is active, then deleted within 30 days of a verified deletion request.
• Payment records — 6 years, as required by UK tax law.

Under the UK GDPR you have the right to:

• access a copy of your personal data;
• correct inaccurate data;
• request deletion of your data ("right to be forgotten");
• receive your data in a portable format;
• object to or restrict certain processing;
• withdraw consent where processing is based on consent.

To exercise any right, email adminscrubbedinapp@gmail.com. We will respond within one month. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Data is encrypted in transit (TLS) and at rest. Passwords are stored only as salted hashes. Access to production data is restricted to the operator. In the unlikely event of a personal data breach that risks your rights, we will notify the ICO within 72 hours and affected users without undue delay, as required by law.

We will post any changes on this page and update the date above. Material changes will be notified to registered users by email.