Privacy
This notice explains what personal information PrepMed collects, why, who it is shared with, how long it is kept, and the rights you have over it under UK data protection law.
Last updated: 15 July 2026
Who we are
PrepMed is operated by Samyar Aminalsharieh Najafi and Ali Aminalsharieh Najafi as individuals. If PrepMed is later incorporated, this notice will be updated to name the company and its registered address. We are the data controller for the personal information described here. For any privacy question or to exercise your rights, contact us at samyarnajafi6@gmail.com.
What we collect
When you create an account we store your email address, your selected interview audience, acquisition source, and, if provided, your full name. We record the version and time of your Terms and Privacy acceptance. As you use the app we store the practice content you generate: answers, editable transcripts, custom and advanced scenarios, and your scoring history. We also keep trial/pass state, usage counts, payment references, service events, and reports you submit so we can provide access, prevent repeat trials, operate the beta, and respond to problems. Provider-cost records contain model name, token-category counts, transcription duration, calculated cost, and reservation/settlement state; cost tracking does not add copies of prompts, answers, audio, or raw provider responses. If you complete your profile we store the career details you enter. PrepMed does not currently accept CV uploads. Data retained from the former CV feature is no longer used for coaching and remains removable through the delete-my-data action or an erasure request.
How we use it and our legal basis
We use this information to provide the interview-practice service, enforce trials and passes, prevent abuse, measure signup-to-feedback and payment funnels by audience/source, monitor reliability and safety, and answer support or privacy requests. Our primary legal basis for providing the service is performance of our agreement with you; security, fraud prevention, and service improvement may also rely on our legitimate interests where appropriate. We do not sell personal information or use it for third-party advertising.
What we do not store
Raw voice audio is not stored by default. Voice recordings are sent for transcription and the resulting transcript may be added to your answer and saved as part of your attempt history, but the original audio file is not kept.
Third-party processing and transfers
We use a small number of processors to run the service. When OpenAI is the active provider, answer text and temporary audio uploads are sent to OpenAI to generate coaching feedback or transcripts; by default OpenAI's API does not use inputs or outputs to train its models. Product data, server-side product events, and email/password authentication are provided through Supabase. Authentication email is delivered through Resend using Supabase custom SMTP. Hosting, application logs, alerts, and aggregate cookieless traffic analytics are provided through Vercel. If paid passes are enabled, Stripe hosts checkout and processes payment; PrepMed stores provider identifiers and payment status rather than card details. A configured alert destination may receive minimised operational incident information, not answer text. Some providers may process data outside the UK and EEA; applicable safeguards must be reviewed before public launch.
Cookies and sessions
We use essential cookies set by our authentication provider to keep you signed in. We do not use third-party advertising or tracking cookies. Your light/dark theme preference is stored locally in your browser, not used to identify you.
Your rights
Under UK GDPR you have the right to access, correct, erase, restrict, or object to the processing of your personal information, and the right to receive a copy of it in a portable format. You can exercise these rights by emailing samyarnajafi6@gmail.com. You also have the right to complain to the UK Information Commissioner's Office (ICO), ico.org.uk if you believe your information has been handled unlawfully.
Retention and deletion
We keep product information while your account is active so the app can show history and tailor feedback. Trial-grant, payment, fraud-prevention, request, and security records may need a different limited retention period for accountability, disputes, tax, or legal obligations. You can download a portable JSON copy or submit a full account deletion request from Support & privacy. The delete-my-data action removes practice/profile content but is not full account deletion. See Data retention for the exact scope.
Your responsibilities
Do not enter patient-identifiable information, confidential employer information, or other sensitive real-world material. This product is intended for private interview practice, not live clinical or employment workflows.
Changes and contact
We may update this notice as the product develops; the date above reflects the latest version. For any question about your information, contact us at samyarnajafi6@gmail.com.