Privacy Policy.

Last updated: 21 August 2026

If anything here is unclear, email us at support@playcebo.co.uk.

Who we are

Playcebo (“we”, “us”, “our”) is a gamified revision platform for medical students and exam candidates. This policy explains how we handle personal data under UK data protection law (UK GDPR and the Data Protection Act 2018). The data controller is Playcebo Ltd, a company registered in England and Wales (company number 17404203). Contact: support@playcebo.co.uk.

Who can use Playcebo

Playcebo is for users aged 16 and over. We don’t knowingly collect data from anyone under 16.

What we collect, and why

• A device identifier (a random ID generated on your device) — created when you play as a guest, so we can save your progress without an account. Lawful basis: our legitimate interest in running the service you asked for.
• Your email — only if you create an account, to sign you in, secure your account, send account emails, and let you play across devices. Lawful basis: performance of our contract with you.
• Your password — only if you create an account, stored only as a secure one-way hash. We never store or see your actual password.
• Study history (questions attempted, answers, scores, timings) and free text you type (typed answers, question reports) — to power the game and let you flag problems. Lawful basis: legitimate interests.
• Your IP address — when you sign in, sign up, reset a password, delete your account, or join the waitlist, so we can rate-limit those sensitive actions and protect against abuse. We don’t track you with it or build a profile from it. Lawful basis: legitimate interests (security).
• Your waitlist email — only if you join the pre-launch waitlist, to tell you when Playcebo is available and send launch updates. Lawful basis: consent (you can unsubscribe any time).

We do not collect your name, address, phone number, or health data about you.

Cookies and tracking

We use no analytics or advertising trackers. The only cookie is a strictly-necessary session cookie for our admin login. The player app keeps you signed in with secure tokens on your device, not tracking cookies. See our Cookie Notice.

Who we share data with

We never sell your data. We use a small number of service providers under contract: Resend to send account and waitlist emails, and Railway to host our servers and database. We may disclose data if required by law.

Where your data is stored

Your data is stored on our hosting provider’s (Railway’s) servers in the European Union (Netherlands). Because the UK treats the EU as providing an adequate level of data protection, your data stays within a jurisdiction with equivalent safeguards.

How long we keep it

• Study sessions and their attempts/reports are deleted automatically 24 months after the session started.
• Free text in a report is cleared 12 months after you sent it.
• Account details are kept while your account exists; deleting your account removes them.

Your rights

Under UK GDPR you can erase, access, correct, and object to the processing of your data. In the app: guests can “Reset my history”; account holders can Delete account (password-confirmed). If you’re on the waitlist, you can unsubscribe from those emails at any time. For a copy of your data, email us and we’ll provide it within one month. To exercise any right, email support@playcebo.co.uk. You can also complain to the ICO.

Not medical advice

Playcebo is an educational revision tool. Its content is for study only and must never be used for clinical decision-making. See our Medical Disclaimer.

Changes

If we make material changes, we’ll update the version in the app and ask you to review it.