MMI / PRIVACY
Privacy
Effective 21 October 2026.
Yolleg Ltd, company 10455920, 71–75 Shelton Street, London, England WC2H 9JQ, United Kingdom. Contact [email protected].
Data and purposes
We process account email, one-use sign-in links, essential session identifiers, practice answers or station notes, attempts/deadlines, self-ratings/checklists/next steps where used, bookmarks, reading progress, preferences/optional target date, consent, trial eligibility and billing/support references. Private practice is restricted to its learner account. Do not enter patient information, confidential interview tasks or unnecessary personal data. Processing supports the requested service/contract, billing legal obligations and security legitimate interests.
Storage and access
Account email/key fields and study payloads are encrypted at rest on the server. HTTPS protects transfer. This is not end-to-end encryption: authorised support can decrypt data. Essential HttpOnly SameSite session cookies last up to seven days. Billing/declaration/email outbox records and necessary host logs may contain contact/contract details outside the encrypted study payload. No advertising trackers, analytics SDK, third-party fonts, microphone/camera capture or cloud AI marking.
Providers and retention
Stripe handles hosted payments; we retain scoped order/subscription/consent references, not full card details. SendGrid processes sign-in and transactional confirmation emails. The established Labs host stores data/security logs; backup geography and exact deletion timing are unconfirmed. Email/payment providers may process internationally under contractual safeguards. Practice persists until removed/erased/account deletion. Billing/contract records may remain up to six years for accounting/disputes/legal obligations; backups follow host schedules. Expired sign-in challenges and their outbox entries are cleaned up.
Your choices
Export records, remove completed attempts, erase practice, sign out all devices, cancel billing or request account deletion/access/correction/restriction/objection/portability at [email protected]. Erasure does not cancel billing. Cancellation does not erase practice. We do not sell data. You may complain to the UK Information Commissioner or local supervisory authority. Protect your email and one-use links. Official-resource links open external services under their privacy policies.