Privacy notice

SuperMed is operated by SuperMed LTD, a company registered in England and Wales under company number 17470153.

Registered office: 132 Church Road, Erdington, Birmingham, B24 9BD, United Kingdom.

SuperMed LTD is the data controller for the personal data described in this notice.

You can contact us about privacy or data protection at help@supermed.info.

SuperMed is a medical education study platform written by students for students at the Medical University of Sofia. It is not affiliated with, endorsed by, sponsored by or operated under the authority of the Medical University of Sofia or any of its departments, unless we expressly state otherwise.

SuperMed provides educational study support. It is not a healthcare service and is not a system for storing or managing clinical records.

We process personal data that is necessary to operate SuperMed, provide its study features, secure accounts and administer subscriptions.

Account information

When you create or use an account, we may process:

• your name;
• your email address;
• your profile picture, if you add one;
• information provided through Google sign-in, if you choose to use it; and
• your account role, where applicable.

Your name and email address are required for an ordinary SuperMed account.

Your profile picture is optional. You can remove it.

Course and study information

We process information about your course and study year and, where you provide it, your group number.

This information is used to determine the study material, syllabus, timetable and other course-specific features available to you.

Study activity and progress

SuperMed records activity generated while you use the platform, including:

• topics and material you have opened;
• answers you submit;
• whether answers are correct;
• flashcard schedules;
• SuperPrep activity and outputs;
• progress and proficiency information;
• study streaks; and
• the amount of time spent studying through the platform.

This information is central to the service. It allows SuperMed to record progress, schedule revision, operate flashcards and provide the adaptive features of SuperPrep.

Sign-in, device and security information

We process information associated with account access and platform security, including:

• device information;
• browser information;
• IP address;
• session and sign-in records; and
• information about account or session replacement where the account is used elsewhere.

We use this information to keep accounts secure, enforce the one-device-at-a-time rule, investigate suspected misuse and maintain the integrity of the platform.

We do not intentionally collect precise location information for account-sharing prevention.

Account changes

We maintain records of significant changes made to accounts, including changes to information such as your email address, name, password or account role and information about who made the change.

These records help us maintain account security and investigate disputes or unauthorised changes.

Subscription and payment information

Payments are processed using Stripe.

SuperMed receives and uses information necessary to administer your subscription, such as a Stripe customer reference, your plan and relevant subscription status and dates.

The information that reaches SuperMed depends on the way our Stripe integration is configured.

We do not ask you to enter your full payment-card details directly into SuperMed.

Stripe separately processes payment information under its own privacy arrangements and may act as an independent controller for some activities and in another capacity, such as a service provider or processor, for others, depending on the particular processing activity.

Communications

If you contact SuperMed, we process the information you provide in your communication and any information reasonably necessary to respond to or manage the matter.

We use your personal data for specific purposes and only where we have a lawful basis for doing so.

Creating and operating your account

We use your name, email address, account role and other necessary account information to create and operate your SuperMed account.

Our lawful basis is contract, because this processing is necessary to provide the SuperMed service you have requested.

Providing course-specific material and features

We use your course, study year and, where you provide it, your group number to determine which educational material, syllabus, timetable and related features are available to you.

Our lawful basis is contract, because this information is used to provide the course-specific service you have requested.

Recording progress and study activity

We use your answers, answer correctness, flashcard schedules, SuperPrep activity, progress, proficiency information, study streaks, study duration and related activity to provide the core educational features of SuperMed.

This allows us to record your progress, organise revision, operate flashcards and adapt your study experience.

Our lawful basis is contract, to the extent that this processing is necessary to provide the requested SuperMed service.

Running SuperPrep and adaptive study features

SuperPrep uses study activity, answers and performance information to estimate aspects of your proficiency and adapt elements of your learning experience.

This can affect how and when material is scheduled, your revision progression and what you are presented with next.

Our lawful basis is contract, to the extent that this processing is necessary to provide the adaptive learning features you have requested.

Account security and one-device enforcement

We use device, browser, IP, session and sign-in information to protect accounts, enforce the one-device-at-a-time rule and identify suspected account sharing or misuse.

Our lawful basis is legitimate interests. Those interests include protecting user accounts, preventing unauthorised sharing or misuse and maintaining the security and integrity of the platform.

Investigating suspected abuse or fraud

We may use relevant account, session and security information to investigate suspected fraud, account misuse or other activity that threatens the security or proper operation of SuperMed.

Our lawful basis is legitimate interests, where applicable, in protecting SuperMed, its users and its services.

Maintaining appropriate business and security records

We retain appropriate account-change and security records so that we can identify what happened to an account, investigate unauthorised changes, maintain security and protect our legal position.

Our lawful basis is legitimate interests and, where applicable, legal obligation.

Improving educational material

We may analyse aggregate patterns in study activity and answers, such as identifying questions or topics that users commonly find difficult, so that we can improve the educational material and the service.

Our lawful basis is legitimate interests, subject to appropriate safeguards and aggregation.

Processing subscriptions and payments

We use relevant subscription and payment information received through our payment arrangements to administer your subscription, confirm payment status and manage renewals, cancellations and related matters.

Our lawful basis is contract where processing is necessary to provide your subscription and, where applicable, legal obligation where we are required to retain or process particular financial records.

Responding to enquiries and complaints

When you contact us, we use the information you provide to respond to your enquiry, investigate complaints, provide support and manage any related matter.

Depending on the circumstances, our lawful basis may be contract, legitimate interests or legal obligation.

Marketing communications

Where SuperMed sends direct marketing communications, we will use your email address and marketing preference for that purpose.

Where consent is required and is the basis relied upon, our lawful basis is consent.

We do not treat your use of SuperMed as consent to marketing.

SuperPrep uses information about how you study to adapt your learning experience.

For example, your study activity, answers and performance can contribute to an estimate of your proficiency. That information can then influence the scheduling of revision, the progression of material and what you are presented with next.

This is a form of automated processing and profiling because the system uses information about your activity and performance to evaluate aspects of your study performance and personalise the service.

SuperPrep is designed to support learning. It is not used to make decisions about matters such as your legal rights, employment, creditworthiness, immigration status, access to public benefits or university admissions.

We do not publish the scoring formula, weighting, thresholds or proprietary logic used by SuperPrep because those mechanisms form part of SuperMed’s proprietary technology and publishing them could undermine the operation of the system.

We nevertheless provide information about the nature and consequences of the processing: your study activity can affect your proficiency estimate, your revision schedule and the learning experience presented to you.

Where a decision would fall within the statutory rules governing solely automated decisions with legal or similarly significant effects, we will apply the safeguards required by law, including appropriate information, the ability to make representations, obtain human intervention and contest the decision.

You may contact us where you believe information used in your study profile is inaccurate or where you believe an automated outcome affecting your account has been made incorrectly.

SuperMed is intended for individual accounts.

We use device, browser, IP address, session and related account-security information to enforce the one-device-at-a-time rule, identify suspected account sharing and protect the platform from misuse.

We may use automated security rules to identify unusual access patterns. These rules are intended to protect the service rather than to monitor your general online activity.

We do not use this system to collect precise location information.

If an account-security control produces an incorrect result or restricts your access, you can contact us and we will review the matter.

We do not publish the specific rules or thresholds used to detect account sharing or suspicious behaviour because doing so could make the controls easier to circumvent.

Your individual study activity is treated as account-specific information.

We do not ordinarily disclose your individual answers, progress, proficiency or study history to:

• other students;
• your group;
• the Medical University of Sofia; or
• other academic institutions.

We may use study patterns to identify questions or topics that users commonly find difficult and to improve educational material. Where possible, this is done using aggregate information rather than information intended to identify an individual student.

We do not sell your answers or study history.

Access to user data is restricted according to role and operational need. Individual answers are not routinely reviewed by ordinary staff. Authorised personnel may access information where reasonably necessary for purposes such as support, security, debugging, legal compliance or investigating a serious incident.

SuperMed does not ordinarily share individual student study activity, answers, progress or proficiency with the Medical University of Sofia.

This does not prevent disclosure where it is:

• required by law;
• necessary to comply with a lawful legal process;
• necessary to protect the rights, safety or security of SuperMed, its users or another person; or
• authorised by you.

SuperMed does not imply or create university endorsement by operating as a study platform for university students.

We do not sell your personal data and do not share it with advertisers for advertising purposes.

We share personal data only where necessary to operate SuperMed, comply with law, protect the platform or provide a service you have chosen.

Stripe

Stripe processes payment and subscription information in connection with SuperMed’s payment arrangements.

The exact information shared depends on the Stripe integration. This may include information necessary to identify your subscription and payment status.

Stripe may process personal data as an independent controller for some activities and in another capacity for others. Its own processing is governed by Stripe’s privacy information.

Google

If you choose Google sign-in, Google provides SuperMed with the information made available through the relevant authentication configuration.

This may include account information such as your name, email address and profile picture where those fields are available to us through the configuration you have authorised.

Google remains responsible for its own processing of personal data carried out for Google’s services.

We do not receive more information from Google merely because you have a Google account; we receive the information made available through our sign-in integration.

Other disclosures

We may disclose personal data where reasonably necessary to comply with a legal obligation, enforce legal rights, establish or defend a legal claim, investigate fraud or serious misuse, or protect the security of SuperMed or another person.

We do not disclose personal data to the university or to advertisers as part of our ordinary business operations.

Some service providers or organisations we use may process personal data outside the United Kingdom.

Where a transfer is subject to the UK GDPR rules on international transfers, we will only make the transfer where a lawful mechanism applies. Depending on the destination and circumstances, this may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK International Data Transfer Addendum; or
• another lawful transfer mechanism.

Where appropriate safeguards are required, we will maintain the documentation and risk assessment required by law.

You can contact us if you want further information about the safeguards applying to a particular international transfer.

SuperMed uses cookies and similar storage technologies needed to operate and secure the service.

The current service uses:

• a session cookie to keep you signed in;
• a random device-recognition value used to distinguish one browser or device session from another for the one-device-at-a-time rule; and
• a small cookie used to remember when the session was last checked.

We do not use advertising cookies.

We do not intentionally use third-party tracking cookies for advertising or cross-site tracking.

Cookies that are strictly necessary for a service requested by you can be exempt from the consent requirement under PECR. We rely on that exemption only where the particular cookie genuinely meets the legal test.

We will provide information about the cookies we use. If SuperMed introduces a cookie or similar technology that is not exempt from consent requirements, we will seek consent where the law requires it.

Cookie names and expiry periods are not listed here where those technical details may change independently of the purpose of the processing.

SuperMed is a medical education platform, but it is not designed to collect health information about you.

Health information and certain other categories of personal data receive additional protection under data-protection law.

Please do not submit:

• identifiable patient records;
• confidential patient information;
• identifiable clinical correspondence;
• photographs or documents containing identifiable patient information; or
• other personal data about patients or other people unless you are specifically authorised and legally permitted to do so.

You should use anonymised or appropriately de-identified educational material instead where this is sufficient for your study purpose.

If you nevertheless submit special-category or other sensitive personal data, we may receive and process it because it has been submitted to us. That does not make an otherwise unlawful disclosure lawful, and we may take steps to restrict or delete information that we do not need.

We do not operate SuperMed as a clinical record system.

You should not unnecessarily provide us with personal data belonging to another person.

In particular, do not include identifiable patient information merely to explain an academic question.

Where a question can be answered using anonymised or fictional information, use that instead.

We keep personal data for no longer than necessary for the purpose for which it is processed, subject to legal, security and business requirements.

Active account and study data

We generally keep your account and study data while your account exists.

Sign-in, device and session records

We retain relevant sign-in, device and related session records for 12 months.

Account-change records

We retain account-change audit records for 24 months.

Marketing information

Where relevant, we retain information necessary to record and respect your marketing preferences for as long as reasonably necessary to manage those preferences and demonstrate compliance.

Communications and complaints

We retain communications and complaints for as long as reasonably necessary to deal with the matter and for any relevant legal, security or record-keeping purpose.

Legally required records

Where we are legally required to retain particular records, we keep them for the applicable statutory period.

For example, HMRC guidance states that company tax records generally need to be kept until at least the sixth anniversary of the end of the relevant accounting period, with longer periods possible in some circumstances.

Private companies also have a Companies Act accounting-record retention requirement of three years, but tax requirements can require records to be retained for longer.

Records held directly by Stripe are subject to Stripe’s own retention obligations and policies.

Backups

Deleting data from our active systems does not necessarily mean that every copy disappears at the same moment.

Where deleted information remains temporarily in secure backups, it is retained only until the relevant backup is routinely overwritten or otherwise deleted, subject to applicable legal or security requirements.

You can delete your SuperMed account through Settings.

When you delete your account, we will initiate the account-deletion process and, where applicable, cancel the associated subscription so that it does not renew.

Your active SuperMed account and study data, including progress, streaks, flashcard schedules and answers, will be deleted from active systems as part of that process, subject to information that we are legally or legitimately required to retain.

A limited amount of information may remain where necessary for reasons such as:

• demonstrating that an account was deleted;
• maintaining security records;
• preventing repeated abuse or fraud; or
• complying with a legal obligation.

This may include a limited account-deletion record containing information such as the email address associated with the account and the date of deletion.

Payment and invoice information retained by Stripe is subject to Stripe’s own systems and legal obligations.

Data retained in backups may remain until the relevant backup is routinely overwritten.

Subject to legal conditions and exemptions, you may have the following rights.

Right to be informed

You have the right to clear information about how your personal data is used. This privacy notice provides that information.

Right of access

You can ask for a copy of the personal data we hold about you and information about how it is used.

This is commonly called a subject access request.

Right to rectification

You can ask us to correct inaccurate personal data or complete incomplete data where appropriate.

Right to erasure

You can ask us to delete your personal data.

This right is not absolute. For example, we may need to retain information because the law requires us to do so, because it is needed for legal claims, or because another lawful exemption applies.

Right to restrict processing

You can ask us to restrict processing in circumstances provided by law.

Right to object

You may object to processing based on our legitimate interests where the statutory conditions for objection apply.

You have an absolute right to object to processing for direct marketing purposes, including related profiling.

Right to data portability

Where the legal conditions are satisfied, you may have the right to receive certain personal data in a structured, commonly used and machine-readable format or ask us to transfer it to another controller.

This right does not apply to all personal data or all forms of processing.

Right to withdraw consent

Where we rely on your consent, you can withdraw it at any time.

Withdrawing consent does not affect processing that was lawfully carried out before consent was withdrawn.

Rights relating to automated decision-making

Where applicable, you have rights concerning solely automated decisions with legal or similarly significant effects.

SuperPrep is designed to personalise your study experience rather than make decisions about matters of that kind. If that changes, we will provide the information and safeguards required by law.

Send your request to help@supermed.info.

We may need reasonable information to confirm your identity before responding.

We will respond without undue delay and normally within one calendar month.

Where permitted by law, we may extend the response period by up to a further two months because of the complexity of the request or the number of requests you have made. Where an extension applies, we will tell you within the initial period and explain why.

For a subject access request, we may ask for clarification where this is reasonably necessary to identify the information or processing activities you are asking about. The statutory time period may be paused while we wait for that information, where the law permits this.

If a request is manifestly unfounded or excessive, the law may permit us to refuse it or charge a reasonable fee.

If you are unhappy with how we have handled your personal data, please contact us first at help@supermed.info.

We will take appropriate steps to investigate and respond to a data-protection complaint.

Under section 164A of the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, organisations must facilitate data-protection complaints, acknowledge them within 30 days and respond without undue delay.

You may also complain to the UK’s statutory data-protection regulator, the Information Commission, through its public website at ico.org.uk.

You may also have rights to complain to a data-protection supervisory authority in another country where the relevant law gives you that right.

We maintain procedures for identifying, investigating and responding to personal-data breaches.

Not every personal-data breach must be reported to the regulator.

Where a breach is likely to result in a risk to individuals’ rights and freedoms, we will notify the Information Commission without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

Where a breach is likely to result in a high risk to affected individuals, we will inform those individuals without undue delay unless a lawful exception applies.

We will also keep the records required by law concerning personal-data breaches.

SuperMed is designed for university students and is not directed at children.

SuperMed is not intended for anyone under 16.

Because an online service can sometimes be accessed by younger users even where it is not designed for them, we consider children’s privacy requirements where they are relevant to our actual audience and processing.

If we become aware that a person under 16 has created an account, we will take appropriate steps to address the account and delete information where appropriate and legally permitted.

We use technical and organisational measures appropriate to the risks associated with processing personal data.

These measures include access controls, authentication safeguards and restrictions on access according to role and operational need.

Administrative activity and security events are logged where appropriate so that we can investigate unauthorised access, misuse and other incidents.

No online service can guarantee absolute security. We therefore continually assess and improve our security measures as the service develops.

We may update this privacy notice when our processing, technology, legal obligations or service changes.

The Last updated date at the top of this page shows when the notice was most recently changed.

Where a change materially affects how we use personal data, we will take reasonable steps to bring the change to your attention before the new processing begins where required by law or appropriate in the circumstances.

We will not rely on a privacy-notice update to turn an incompatible new use of personal data into a lawful one. Where a new purpose requires a different lawful basis, consent or another legal step, we will take that step.

SuperMed LTD, company number 17470153
132 Church Road, Erdington, Birmingham, B24 9BD, United Kingdom
Email: help@supermed.info

At present, this notice does not designate a Data Protection Officer or an EU representative. Whether either is legally required depends on SuperMed’s actual scale, processing activities and territorial exposure.

For privacy questions, rights requests and data-protection complaints, use the email address above.