Privacy Policy
Last updated: September 2026
Who we are. Thames Uro is a trading name of Findlay MacAskill Medical Services Limited, a company registered in England & Wales (Company No. 09909734), registered office 31 The Green, Writtle, CM1 3DT. We are the data controller for personal data processed through this platform. We are registered with the Information Commissioner's Office (ICO). Contact: info@thamesuro.com.
Thames Uro is an exam-revision platform for the FRCS (Urology) examination, used by doctors and surgical trainees. This policy explains what personal data we collect, why, and your rights under UK GDPR and the Data Protection Act 2018.
1. What we collect
- Account & identity: the email address you sign in with (via our access provider), used to authenticate you and secure the content.
- Practice data: your viva transcripts, answers, scores, feedback and progress within the platform.
- Payment data: if you buy premium credits, your payment is processed by Stripe. We receive confirmation of payment and your email, but we never see or store your card details — Stripe handles those.
- Optional presence coach: if you switch it on, your camera is analysed on your own device to give eye-contact and posture metrics. This video is not uploaded, transmitted or stored by us.
- Optional session recordings: if you record a session to watch yourself back, the recording stays on your device only — it is never uploaded to us or anyone else.
- Optional shared sessions: if you explicitly opt in, an anonymised copy of a transcript and marks (no name, email or video) may be stored to help improve the examiner.
- Technical & security data: limited technical information needed to run and protect the service, and a per-user watermark tied to your login to deter unauthorised sharing of proprietary content.
2. Why we use it, and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Provide the examiner, marking, and your account | Performance of a contract |
| Process premium-credit payments | Contract / legal obligation |
| Protect our content, secure accounts, prevent misuse | Legitimate interests |
| Improve the examiner using shared, anonymised sessions | Consent (opt-in; withdraw anytime) |
3. AI processing & our sub-processors
To run the examiner, transcription and marking, your spoken answers and transcripts are processed by trusted third-party providers acting on our behalf. None of these providers use your data to train their own models.
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare | Hosting, login/authentication, speech-to-text, the standard examiner & database | UK / global edge |
| Anthropic | Premium examiner & marking (Claude) | USA |
| Microsoft Azure | Examiner voice (text-to-speech) | UK |
| Stripe | Payment processing | USA / UK |
Where a provider is outside the UK, we rely on appropriate safeguards (e.g. UK International Data Transfer Agreement / Addendum to EU Standard Contractual Clauses).
4. What we do not do
- We do not sell your personal data.
- We do not upload or keep your camera video or self-recordings.
- We do not use your identifiable sessions to train AI — only sessions you explicitly and anonymously choose to share.
5. Retention
We keep your practice data for as long as your account is active and for a reasonable period afterwards, then delete or anonymise it. Anonymised shared sessions are retained as an improvement dataset. Payment records are kept as long as required by law (typically 6 years for tax). You can ask us to delete your data at any time (see below).
6. Your rights
Under UK GDPR you have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent (for the shared-session feature) at any time. To exercise any right, email info@thamesuro.com. You also have the right to complain to the ICO (ico.org.uk), though we'd appreciate the chance to help first.
7. Security
Access to the platform is authenticated and encrypted in transit. Content is watermarked to your account and access is logged to deter unauthorised sharing. No online service can be guaranteed 100% secure, but we take reasonable measures to protect your data.
8. Cookies & local storage
We use a strictly necessary cookie for secure login, and your browser's local storage to remember preferences (such as theme and whether you've seen the intro). We do not use advertising or third-party tracking cookies.
9. Children
The platform is intended for qualified doctors and surgical trainees and is not directed at anyone under 18.
10. Changes
We may update this policy; we'll post the revised version here with a new "last updated" date.