Privacy Policy

Last updated: October 2026

Thames Uro is an exam-revision platform for the FRCS (Urology) examination, used by doctors and surgical trainees. This policy explains what personal data we collect, why, and your rights under UK GDPR and the Data Protection Act 2018.

1. What we collect

• Account & identity: the email address you sign in with (via our access provider), used to authenticate you and secure the content.
• Passkeys: if you choose to sign in with a passkey, the key itself never leaves your device. We store only its public half, which cannot be used to sign in as you anywhere, together with a counter that helps detect a cloned key. You can remove a passkey from your account page at any time.
• Practice data: your viva transcripts, answers, scores, feedback and progress within the platform, and, for Part 1, a record of the questions you answer (the question, your choice, whether it was right, and your mock exam results). We use this to show you your progress and to find questions that need improving.
• Payment data: if you buy premium credits, your payment is processed by Stripe. We receive confirmation of payment and your email, but we never see or store your card details. Stripe handles those.
• Optional presence coach: if you switch it on, your camera is analysed on your own device to give eye-contact and posture metrics. This video is not uploaded, transmitted or stored by us.
• Optional session recordings: if you record a session to watch yourself back, the recording stays on your device only. It is never uploaded to us or anyone else.
• Optional saved vivas: a viva is not kept under your name unless you choose to save it. If you tap Save this viva, that run (its transcript, your marks and feedback, and the model answers you were shown) is stored against your account, so it is identifiable to you, and you can reread it from Progress. You can make a saved viva anonymous, or delete it outright, at any time from the same place.
• Optional shared sessions: if you explicitly opt in, an anonymised copy of a transcript and marks (no name, email or video) may be stored to help improve the examiner.
• Optional revision emails: there are two places you can give us an email address: the sign-up box on our home page and the one on our podcast page. Both are optional, and neither is needed to use anything you have paid for. We keep your address, which exam part you chose, the sitting you told us you are taking if you told us, and when you signed up. The exam date is used only to send the weekly emails at the right point in your revision rather than the wrong one; without it you simply do not get the countdown series. You can also tick, separately and never by default, to hear about new content and occasional offers. The two are recorded separately and you can stop either without stopping the other. Every email has an unsubscribe link, your email client's own unsubscribe button works too, and you can email info@thamesuro.com. When you unsubscribe from everything we delete your record outright, keeping only a one-way cryptographic hash of your address, which cannot be read back into an email address and exists solely so that a later import cannot put you back on the list.
• Sign-up abuse prevention: the sign-up boxes are open to anyone, so we keep a short record of the IP address a sign-up came from and how many were made from it. It is used only to stop one person submitting thousands of addresses. It is not used to profile you and is not linked to your activity on the site.
• Technical & security data: limited technical information needed to run and protect the service, and a per-user watermark tied to your login to deter unauthorised sharing of proprietary content.

2. Why we use it, and our lawful bases

3. AI processing & our sub-processors

To run the examiner, transcription and marking, your spoken answers and transcripts are processed by trusted third-party providers acting on our behalf. Anthropic and Cloudflare, which handle your answers and transcripts, do not use them to train their own models. Speechify and Microsoft Azure receive only the examiner's lines to read aloud, not your recordings or your email address. Resend receives your email address only to send your sign-in codes and account emails.

Your spoken answers and transcripts are processed outside the UK. This is not occasional: for every paid viva, the examiner and the marking run on Anthropic's systems in the USA, and the examiner voice is normally generated by Speechify in the USA. Speechify receives only the examiner's own lines to read aloud, not your answers, your recordings or your email address. Microsoft Azure (UK) and Cloudflare are used only as fallbacks if those are unavailable. Stripe processes payments in the USA and the UK, and Resend stores the email addresses it sends to in the USA. Where we transfer personal data outside the UK we rely on appropriate safeguards, currently the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework.

4. What we do not do

• We do not sell your personal data.
• We do not upload or keep your camera video or self-recordings.
• We do not use your identifiable sessions to train AI. We use only the sessions you explicitly and anonymously choose to share. A viva saved under your name is your private record and is excluded from that material for as long as it carries your name; it can only form part of it if you have made it anonymous, or if you separately chose to share it anonymously at the time.

5. Retention

Vivas you have chosen to save are kept under your name until you remove them: there is no automatic expiry, because the point of saving one is to reread it in the months before your exam. Removing a saved viva offers two options, and making it anonymous is the default: your name is detached and the run remains only as anonymous material, or you can delete it entirely. Once a run has been made anonymous it is no longer linked to you, so it can no longer be retrieved or deleted from your account.

We keep your practice data for as long as your account is active and for a reasonable period afterwards, then delete or anonymise it. Anonymised shared sessions are retained as an improvement dataset. Payment records are kept as long as required by law (typically 6 years for tax). You can ask us to delete your data at any time (see below).

Email sign-ups. If you unsubscribe from everything, your record is deleted at that point rather than flagged, and all that remains is the one-way hash described in section 1. If you unsubscribe from only one kind of email we keep your record, because you still hold the other permission; it is deleted once nothing is left to keep.

6. Complaints

If you are unhappy with how we have handled your personal data, tell us first and we will try to put it right. Email info@thamesuro.com with "Complaint" in the subject line, and tell us what happened and what you would like us to do.

We will acknowledge your complaint within 30 days of receiving it, and tell you either what we have done or how long we expect to need. If something takes longer than we thought, we will say so rather than go quiet.

You can also complain to the Information Commissioner's Office at any point, and you do not have to come to us first: ico.org.uk/make-a-complaint or 0303 123 1113.

7. Your rights

Under UK GDPR you have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent (for the shared-session feature) at any time. To exercise any right, email info@thamesuro.com. You also have the right to complain to the ICO (ico.org.uk), though we'd appreciate the chance to help first.

8. Security

Access to the platform is authenticated and encrypted in transit. Content is watermarked to your account and access is logged to deter unauthorised sharing. No online service can be guaranteed 100% secure, but we take reasonable measures to protect your data.

9. Cookies & local storage

We use a strictly necessary cookie for secure login, and your browser's local storage to remember preferences (such as theme and whether you've seen the intro). We do not use advertising or third-party tracking cookies. To measure overall site traffic we count page views ourselves, on our own servers: we record only the date, the page address, the site that linked you to us (the website name only, never the full address or any search terms) and the country your request came from, with no cookie, no IP address and no identifier of any kind, so these counts cannot be linked to you or followed across other websites. We use no third-party analytics service. (The one place we do use an IP address is the sign-up abuse check described in section 1. It is not part of these traffic counts and the two are never joined up.)

10. Children

The platform is intended for qualified doctors and surgical trainees and is not directed at anyone under 18.

11. Changes

We may update this policy; we'll post the revised version here with a new "last updated" date.