Privacy Notice
This notice explains what personal data we collect when you use EchoMCQ, why we hold it, how long we keep it, and what you can ask us to do about it. If anything in it is unclear, email us and we will explain it in plain terms.
1. Who we are
EchoMCQ.com is operated by Sycamore Healthworks Ltd ("we", "us"), a company registered in Scotland under company number SC886987, with its registered office at 2/3, 48 Clyde Offices, West George Street, Glasgow, G2 1BP, United Kingdom.
We are the data controller for the personal data described in this notice, and we are registered with the Information Commissioner's Office (ICO), the UK data protection regulator.
Contact for anything in this notice: support@echomcq.com.
2. What we collect, and why
| What | Why we hold it | Lawful basis |
|---|---|---|
| Account details — your username, email address, and a securely hashed password. We never store your password in a readable form. | To create your account, sign you in, and contact you about the service. | Performance of a contract, UK GDPR Art. 6(1)(b) |
| Revision progress — the questions you have attempted, your answers, and your scores. | To show your performance and let you resume where you left off. This is the product. | Performance of a contract, Art. 6(1)(b) |
| Subscription and payment records — what you bought, when, the amount, your billing country, and the last four digits and expiry of your card. We never see or store your full card number. | To take payment, manage renewals and cancellations, handle refunds, and keep the accounting records we are legally required to keep. | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c), for tax and accounting records |
| Correspondence — emails you send us and our replies. | To answer you, and to keep a record of what was agreed. | Contract, Art. 6(1)(b); legitimate interests, Art. 6(1)(f) |
| Technical and advertising data — standard server log data, and where you reached us from an advertisement, a click identifier. | To keep the service secure and working, and to measure whether our advertising results in sign-ups. | Legitimate interests, Art. 6(1)(f) — running, securing and measuring the service |
We do not process health data about you. EchoMCQ is a revision tool. The clinical material in the question bank is teaching content, not information about you, and nothing you do on the site tells us anything about your own health. We do not ask for, and you should not send us, patient-identifiable information.
3. Cookies and measurement
We use essential cookies to keep you signed in and to keep the site secure. These cannot be switched off without breaking the service.
We also use measurement identifiers, including advertising click identifiers such as Google's GCLID, to work out whether an advertisement led to a sign-up. This tells us how many people converted. It is not used to build a profile of you, and it is not sold or shared for anyone else's advertising. You can block or delete cookies through your browser settings; blocking essential cookies will stop you being able to sign in.
4. Who we share it with
We do not sell your personal data, and we do not share it for anyone else's marketing. We use a small number of service providers who process data on our behalf under contract:
- Stripe — payment processing and subscription billing.
- MongoDB Atlas — the database holding your account and progress.
- Netlify — website and application hosting.
- Postmark — sending transactional email such as password resets.
- Google — advertising conversion measurement.
- Microsoft — our email, when you correspond with us.
We will also disclose personal data where we are legally required to, for example to a regulator, a court, or HM Revenue & Customs.
5. Transfers outside the UK
Some of the providers listed above process data outside the United Kingdom, including in the United States and the European Economic Area. Where that happens, the transfer is covered either by UK adequacy regulations or by the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, together with the provider's own technical safeguards. You can ask us which mechanism applies to a particular provider.
6. How long we keep it
- Account and progress data — while your account is open, and for up to 12 months after it is closed or your subscription ends, so that you can return without losing your history. After that it is deleted or anonymised. You can ask us to delete it sooner.
- Payment and accounting records — six years from the end of the relevant financial year, because UK tax law requires it. We cannot delete these on request within that period.
- Correspondence — up to two years from the last message, or longer where it relates to a complaint, a refund, or a legal claim.
7. Your rights
Under the UK GDPR and the Data Protection Act 2018 you have the right to:
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased, where we have no continuing legal reason to keep it;
- restrict how we use your data, or object to us using it on the basis of our legitimate interests;
- receive your data in a portable, machine-readable format;
- withdraw consent at any time, where we have relied on consent; and
- complain — see section 8 below.
To exercise any of these, email support@echomcq.com. We will respond within one month. There is no charge. We may ask you to confirm your identity first, so that we do not disclose your data to somebody else.
8. How to complain
You have a legal right to complain directly to us about how we have handled your personal data, under section 164A of the Data Protection Act 2018. You do not have to go to the regulator first.
Complaining to us
Email support@echomcq.com with "Data protection complaint" in the subject line, and tell us what happened. You do not need to use any particular form of words or cite any legislation.
What we will do:
- Acknowledge your complaint within 30 days of receiving it.
- Investigate it without undue delay, making whatever enquiries are appropriate.
- Keep you informed of progress if it is going to take a while.
- Tell you the outcome, and explain how we reached it.
Complaining to the regulator
You can complain to the Information Commissioner's Office at any point, whether or not you have raised it with us first, and whether or not you are satisfied with our answer. Complaining to us does not remove or delay that right.
Information Commissioner's OfficeWycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint
If you are in the European Economic Area, you may also complain to the supervisory authority in your own country.
9. Keeping your data secure
Passwords are stored hashed, never in readable form. The site is served over HTTPS. Card details are handled by Stripe and never reach our systems. Access to the database is restricted. No system is perfectly secure, but if a breach occurs that is likely to result in a risk to your rights, we will report it to the ICO within 72 hours and tell you directly where the law requires it.
10. Changes to this notice
We may update this notice. The date at the top shows when it last changed. Where a change materially affects how we use your data, we will tell active subscribers by email rather than relying on you noticing this page.
11. Contact
Sycamore Healthworks LtdRegistered in Scotland, company number SC886987
2/3, 48 Clyde Offices, West George Street
Glasgow, G2 1BP
United Kingdom
Email: support@echomcq.com