Ortho Exchange
Privacy Policy
This policy explains what personal information Ortho Exchange uses, why it is used and the choices available to you.
Last updated: 25 September 20261. Who is responsible for your information
Ortho Exchange is the controller of personal information used to operate the Ortho Exchange revision platform. The service is operated in England and Wales. Privacy enquiries can be sent to contact@orthoexchange.co.uk.
2. Information we collect
- Account information: your email address, display name, account identifier, approval status and account role.
- Optional profile information: profile image and examination sitting date if you choose to provide them.
- Learning information: tests created, answers selected, scores, timing information, bookmarks, notes and learning progress.
- Community and administrative activity: question-review flags, discussion comments, approval decisions, bank access and other actions needed to manage the service.
- Technical and security information: session, authentication, device, diagnostic and access-log information produced when you use the service.
- Information you send us: support requests, Home-page feedback and correspondence. Home-page feedback is linked to your account and is visible only to authorised administrators so they can review it and follow up where needed.
Question submissions are not stored with the identity of the submitting user. If you later discuss, flag or administer a question, those separate actions may be linked to your account so the discussion and moderation features work properly.
3. How we use your information
- to create, authenticate, approve and secure your account;
- to provide tests, save progress and show your learning history;
- to operate question review, access controls and community features;
- to investigate errors, misuse, security concerns and copyright complaints;
- to communicate about your account or material changes to the service; and
- to produce aggregated statistics that do not identify individual users.
We do not sell personal information and do not use it for third-party targeted advertising.
4. Our lawful bases
We process account and learning information because it is necessary to provide the service you request. We also rely on our legitimate interests in maintaining a secure, reliable and well-moderated educational platform. Where the law requires us to retain or disclose information, we process it to comply with that legal obligation. You may withdraw optional information, such as a profile image or examination date, through your settings where available.
5. Who receives your information
Authorised Ortho Exchange administrators can access information needed to manage accounts and the service. We use specialist service providers for hosting, authentication, database, storage and delivery, including Supabase and Vercel. Providers may process information only to deliver their services to us and under their own security and data-protection commitments.
We may disclose information where required by law, to protect users or the service, or in connection with a properly managed transfer of the service.
6. International processing
Some service providers may process information outside the United Kingdom. Where this occurs, we use an applicable adequacy decision or recognised contractual safeguards and supplementary measures as required.
7. How long we keep information
We retain account and learning information while your account remains active and for as long as reasonably required to operate, secure and document the service. If your account is closed or a valid deletion request is accepted, personal information is deleted or anonymised unless it must be retained for legal, security or dispute-resolution purposes. Limited information may remain temporarily in protected backups or provider logs until it is overwritten under normal retention schedules.
8. Cookies and local storage
Ortho Exchange uses essential browser storage and authentication tokens to keep you signed in, protect your session and remember service preferences. These technologies are required for the platform to function. We do not use advertising cookies.
9. Security
We use access controls, authenticated sessions, role-based permissions and managed hosting services to protect information. No online system is completely secure. Keep your password confidential and contact us promptly if you suspect unauthorised access.
10. Your rights
Depending on the circumstances, you may have rights to be informed, access your information, correct it, request erasure, restrict processing, object to processing and receive portable information. You can also complain to the UK Information Commissioner's Office.
You may object to processing based on our legitimate interests. Tell us what you object to and why; we will assess your request in accordance with data-protection law.
11. Clinical and special-category information
Do not upload patient-identifiable information, clinical records or confidential workplace material. Ortho Exchange is not designed to hold patient data. If such information is submitted accidentally, contact us immediately.
12. Changes to this policy
We may update this policy when the service or law changes. The latest version and update date will remain available on this page. Material changes may also be communicated through the platform.