Privacy Policy

Last updated: 16 September 2026

This policy explains what personal information MedRounds collects, why, who we share it with, how long we keep it, and the choices and rights you have. We've tried to write it in plain language. If anything is unclear, email privacy@medrounds.co.uk.

1. Who we are

MedRounds is operated by Spark Inc LLC, a limited liability company registered in Georgia (identification number 416391149), with its legal address at Shartava avenue N 19, (XX m/d N 5), semi-basement, Rustavi, Georgia.

In this policy, "we", "us" and "our" mean Spark Inc LLC. "MedRounds" means the MedRounds mobile app and the website at medrounds.co.uk.

We are the controller of your personal information, which means we decide how and why it is used.

Privacy contact: privacy@medrounds.co.uk

2. The short version

  • MedRounds is for adults aged 18 and over.

  • We collect what we need to run your account, track your learning, and operate Community and Events.

  • Analytics and session replays only run if you say yes, and you can change your mind at any time in Settings.

  • Marketing emails only go to people who opt in.

  • We never sell your personal information, and we don't show advertising.

  • Our main database is hosted in the European Union (Ireland).

  • You can delete your account in the app or by emailing us.

The rest of this policy gives the detail.

3. Information we collect

3.1 Information you give us

Account details

  • Your email address and password. Your password is stored in encrypted (hashed) form, so we cannot see it.

  • If you sign in with Google: your name, email address and profile photo, as provided by Google.

  • Your confirmation that you are 18 or over.

  • Your marketing email choice.

Profile details

  • Your username, display name and profile photo, if you add them.

Onboarding answers

  • Your training stage, goal, preparation phase, daily study time, the systems you find hardest, what you struggle with, your motivation, and the study resources you use. Section 5 explains what each answer is used for.

Community

  • The posts and comments you publish.

  • Reports you make about other users' content, and users you block.

Events

  • Your bookings for events. When you book, your name and email address are shared with the event's host (see section 6).

Messages to us

  • Anything you send us by email, such as support questions or privacy requests.

3.2 Information collected as you use MedRounds

Learning activity

  • Your answers, progress through topics, XP, grade, streaks, hearts, flashcard review schedule, quest progress, and which Rounds Digest articles you read.

Technical and crash information

  • Your device type, operating system and app version.

  • If the app crashes or hits an error, a crash report describing what went wrong.

Analytics and session replays (only with your consent)

  • Which screens you visit, what you tap, and replays of your sessions with personal details hidden. See section 7.

3.3 Information about event hosts

Doctors who apply to host events on MedRounds give us:

  • Their name and professional credentials, which are shown to students.

  • Their email address and, optionally, phone number, which are not shown to students.

  • Their professional registration number and licensing body, used to verify that they are a registered doctor. These are not shown to students.

  • Details of the event: title, description, type, subject, date, time, time zone, duration, whether it is virtual or in person, the venue or joining link, and capacity.

Joining links for virtual events are only given to users with a confirmed booking.

3.4 What we don't collect

  • We don't collect your date of birth.

  • We don't collect your precise location, contacts or photos from your device.

  • We don't take payments during the beta, so we hold no payment information.

  • We don't use artificial intelligence services to process your personal information.

4. How we use your information, and our legal basis

Data protection law requires a legal reason ("legal basis") for each use of personal information. Ours are below.

To provide MedRounds to you — legal basis: performing our agreement with you

  • Creating and running your account.

  • Saving your progress, XP, grade and streaks.

  • Showing your leaderboard entry, posts and comments to other users.

  • Managing event bookings, sharing your name and email address with the host of an event you book, and giving booked attendees the joining link.

  • Sending essential service emails, such as password resets and booking confirmations.

To personalise your learning — legal basis: performing our agreement with you

  • Using your onboarding answers as described in section 5.

Analytics and session replays — legal basis: your consent

  • Understanding how MedRounds is used, and finding what is confusing or broken.

Marketing emails — legal basis: your consent

  • News, feature updates, Rounds Digest highlights and event announcements.

Keeping MedRounds working and secure — legal basis: our legitimate interests

  • Diagnosing crashes and errors.

  • Preventing abuse, fraud and misuse, including manipulation of XP or leaderboards.

  • Moderating Community content and acting on reports.

  • Verifying that event hosts are registered doctors.

Improving MedRounds — legal basis: our legitimate interests

  • Using combined, de-identified onboarding answers and learning activity to decide what to build next.

Meeting legal obligations — legal basis: legal obligation

  • Responding to lawful requests from authorities and keeping records the law requires.

Where we rely on legitimate interests, we have weighed them against your rights. You can object at any time (see section 13).

5. What your onboarding answers are for

Onboarding questions are there to shape MedRounds around you.

  • Training stage: to set your starting point, for example whether to begin with Foundations or skip ahead.

  • Goal: to tailor your path to the exam you're preparing for, as courses beyond USMLE Step 1 are added.

  • Preparation phase: to pace recommendations to how far into your preparation you are.

  • Daily study time: to set daily study targets and reminders.

  • Hardest systems: to prioritise the systems you find hardest in recommendations and practice.

  • What you struggle with: to suggest study formats and features that address what you find difficult.

  • Motivation: to tailor encouragement and in-app messages.

  • Study resources: to relate MedRounds to the resources you already use.

We also use these answers in combined, de-identified form to decide what to build next. If we ever want to use them for anything else, we will update this policy and tell you first.

6. What other users can see

  • Leaderboard: once you pass the leaderboard entry threshold, other users can see your display name, profile photo, XP, grade and position.

  • Community: your posts and comments, with your display name and profile photo, are visible to other MedRounds users.

  • Event hosts: when you book an event, the doctor hosting it can see your name and email address. Hosts may only use these details to run that event.

  • Virtual events take place on third-party video platforms, such as Google Meet or Zoom. Your name, and depending on the platform your profile photo and email address, may be visible to the host and other attendees. Those platforms' own privacy policies apply.

  • If you delete your account, your posts and comments stay visible but are shown as "Deleted user". You can ask us to remove them (see section 12).

Think carefully before posting anything personal. Never post information that could identify a patient. Our Community Guidelines explain what you can and can't share.

7. Analytics and session replays

When you first open the app, we ask whether you allow analytics. Nothing is collected for analytics until you choose.

If you tap Allow, we collect:

  • Which screens you visit and what you tap.

  • Replays of your sessions, which show how you move through the app.

Personal details are hidden in replays. This includes text you type, passwords, images, Community posts and comments, the leaderboard, profile screens, and event booking details.

We use this only to improve MedRounds. We never sell it or use it for advertising.

You can change your choice at any time in the app's Settings. If you withdraw consent, we stop collecting from that point.

How long we keep it: analytics data for up to 1 year and session replays for 30 days (see section 11).

Crash reports are separate from analytics. They contain technical details of the error and are used only to fix problems.

8. Emails

  • Service emails such as password resets and booking confirmations are part of running your account. You can't opt out of these while you have an account.

  • Marketing emails are only sent if you tick the box to receive them. Every marketing email has an unsubscribe link, and you can also email us to stop them.

  • If you joined our waitlist, we will only email you about the MedRounds launch, unless you opt in to receive more.

9. Who we share your information with

We never sell your personal information.

We use trusted service providers to run MedRounds. They process personal information only on our instructions and are not allowed to use it for their own purposes.

  • Supabase: database, sign-in and file storage. Location: European Union (Ireland).

  • PostHog: analytics and session replays, only with your consent. Location: European Union.

  • Sentry: crash and error reporting. Location: European Union.

  • Loops: marketing and launch emails. Location: United States.

  • [Account email provider — to be confirmed]: password resets and other account emails. Location: [to be confirmed].

  • Expo: app delivery and updates. Location: United States.

  • Google: "Sign in with Google", if you use it. Location: United States.

  • Hostinger: hosting our website and its forms. Location: European Union.

We may also share information:

  • With other users and event hosts, as described in section 6.

  • With authorities, where the law requires it or to protect the safety of users or others.

  • In a business transfer. If Spark Inc LLC is involved in a merger, acquisition or sale of assets, your information may transfer to the new owner, who must continue to protect it in line with this policy.

We will update this list before adding a new service provider that processes your personal information.

10. Where your information is stored

Our main database is hosted in the European Union (Ireland). Some service providers listed in section 9 are based in the United States. Where your information is transferred to a country that does not have an equivalent level of data protection, we use appropriate safeguards, such as standard contractual clauses, to protect it.

11. How long we keep your information

  • Account and learning data: until you delete your account, then erased after a 30-day grace period.

  • Database backups: deleted data may remain in backups for up to 30 days before being overwritten.

  • Community posts and comments: remain visible as "Deleted user" after account deletion, until you ask us to remove them.

  • Reports and blocks: 12 months after a report is resolved.

  • Analytics data: up to 1 year.

  • Session replays: 30 days.

  • Event host details: while the doctor hosts on MedRounds, then 12 months after their last event.

  • Unsuccessful host applications: 6 months.

  • Details shared with event hosts: hosts must delete attendee details once they are no longer needed for the event.

  • Emails you send us: as long as needed to deal with your request.

  • Inactive accounts: we don't currently delete inactive accounts automatically.

We may keep information longer where the law requires it, or where it is needed to resolve a dispute or enforce our terms.

12. Deleting your account

You can delete your account in two ways:

  • In the app, from Settings.

  • By email, by writing to privacy@medrounds.co.uk from the email address linked to your account.

What happens next:

  • Your account enters a 30-day grace period, during which you can change your mind.

  • After 30 days, your account and learning data are erased.

  • Your analytics data is deleted.

  • Your posts and comments remain, shown as "Deleted user", unless you ask us to remove them.

  • Deleted data may remain in backups for up to 30 days before being overwritten.

To remove your posts and comments, email privacy@medrounds.co.uk, either before or after deleting your account.

13. Your rights

Depending on where you live, you have the right to:

  • Access the personal information we hold about you and get a copy.

  • Correct information that is inaccurate or incomplete.

  • Delete your information.

  • Restrict how we use your information.

  • Object to our use of your information based on legitimate interests.

  • Receive your information in a portable format.

  • Withdraw consent at any time, for analytics in Settings or for marketing emails by unsubscribing. This doesn't affect what we collected before you withdrew.

To use any of these rights, email privacy@medrounds.co.uk. We may need to confirm your identity first, usually by asking you to write from the email address linked to your account. We will respond without undue delay and within the time limits set by applicable law.

You can complain to a data protection authority. In Georgia, this is the Personal Data Protection Service (personaldata.ge). You may also complain to the authority in the country where you live. We'd appreciate the chance to resolve your concern first, so please contact us.

14. Age requirement

MedRounds is only for people aged 18 or over, and you must confirm this when you create an account. If we learn that an account belongs to someone under 18, we will close it and delete their information. If you believe someone under 18 is using MedRounds, email privacy@medrounds.co.uk.

15. Patient information

MedRounds is an educational platform, and we don't ask for or want information about patients. Do not post information that could identify a patient, in Community or anywhere else in MedRounds. You are responsible for what you post. We may remove any content that breaks our Community Guidelines.

16. How we protect your information

We use measures appropriate to the information we hold, including encryption of data in transit, encrypted storage of passwords, and access controls that limit personal information to the team members who need it. No system is perfectly secure, but we work to protect your information and will notify you and the relevant authorities of a data breach where the law requires it.

17. Our website

Our website at medrounds.co.uk uses only the cookies needed for it to work. We don't use advertising cookies on our website. If we add analytics to the website, we will ask for your consent first and update this policy.

18. Changes to this policy

We will update this policy when MedRounds changes, for example when we add new features or service providers. The "Last updated" date at the top shows when it last changed. If we make a significant change, we will tell you in the app or by email before it takes effect.

19. Contact us

Email: privacy@medrounds.co.uk Post: Spark Inc LLC, Shartava avenue N 19, (XX m/d N 5), semi-basement, Rustavi, Georgia