Privacy Policy

Last updated: 30 July 2026 | Effective Date: 30 July 2026

This Privacy Policy describes how MISA LUNA LIMITED (trading as PaedVault, “we”, “us”, or “our”) collects, uses, stores, discloses, and protects your personal data when you visit our website at https://www.paedvault.com, or when you use our mobile application (PaedVault).

MISA LUNA LIMITED is the data controller responsible for your personal data under applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR), the UK Data Protection Act 2018, and the EU General Data Protection Regulation (EU GDPR 2016/679).

1. Information We Collect

We collect personal information necessary to deliver our paediatric medical examination preparation platform (MRCPCH question bank, analytics, and study services). The types of data we collect include:

A. Account & Identity Data

• Basic Identity Information: Your name and email address provided during account registration.
• Third-Party Authentication Data: If you sign in using Google Sign-In or Apple Sign-In, we receive your authentication token, name, and email address as permitted by your provider settings. We never store or receive your social account passwords.
• Professional & Training Profile: Training grade (e.g., ST1-ST8, FY2, Specialist Registrar), target exam sitting (FOP, TAS, AKP), and country of clinical practice.

B. Examination & Performance Analytics Data

• Quiz & Practice Records: Questions attempted, selected answers, correctness, completion duration, timestamps, and confidence ratings.
• User Contributions & Customization: Personal notes, flagged questions, bookmarked favourite questions, and customized revision plans.

C. Billing & Subscription Information

• All payments and recurring subscriptions are processed securely by our payment processor, Stripe Inc.
• We never store or touch full credit or debit card numbers on our servers. Stripe provides us with a secure customer identifier (Stripe Customer ID), active subscription status, expiration dates, and purchase transaction history required to manage your account access.

D. Technical, Device & Usage Telemetry

• Device & Connection Data: IP address, device type, operating system version, browser type, unique device identifiers, and network connection status.
• Service Logs & Security Monitoring: System access logs, timestamped API requests, error crash reports, and rate-limiting security metadata collected to prevent unauthorized content scraping and preserve system integrity.

2. How We Use Your Personal Data & Legal Bases

We process your personal data for specific purposes under the following legal bases:

3. Third-Party Service Providers (Data Processors)

We do not sell, rent, or trade your personal information to third parties. We share data only with trusted data sub-processors necessary to operate the service:

• Google Firebase & Google Cloud Platform: Cloud infrastructure, database storage (Cloud Firestore), and authentication servers hosted in secure data centers.
• Stripe Inc.: Payment processing, PCI-DSS compliant checkout billing, and subscription management.
• Apple Inc.: Mobile app distribution (App Store) and optional Sign in with Apple authentication.

Where data is processed outside the UK or European Economic Area (EEA), appropriate legal safeguards (such as International Data Transfer Agreements and standard contractual clauses) are enforced.

4. Data Retention & Account Deletion Policy

We retain your personal data for as long as your account remains active or as required to fulfill the purposes outlined in this policy.

Account Deletion Rights & Process

In accordance with Apple App Store Guidelines and GDPR requirements, you have the right to delete your account and all associated personal data at any time:

• In-App Deletion: You can initiate complete account deletion directly inside the app by navigating to Settings → Account → Delete Account.
• Email Deletion Request: You may also request account deletion by emailing us at privacy@paedvault.com using your registered email address.

Upon account deletion request, your profile, authentication data, quiz history, notes, and progress records are permanently deleted or anonymized within 30 days. Financial transaction receipts and invoice records are retained separately for up to 6 years solely to comply with statutory tax and accounting regulations.

5. Your Rights Under UK & EU GDPR

Depending on your jurisdiction, you possess the following statutory data rights:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure (“Right to be Forgotten”): Request deletion of your personal records.
• Right to Data Portability: Request export of your study data in a machine-readable format.
• Right to Restrict or Object: Object to processing based on legitimate interests or request restrictions.
• Right to Withdraw Consent: Withdraw consent for marketing emails at any time via unsubscribe links.

To exercise any of these rights, please contact us at privacy@paedvault.com. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

6. Cookies and Local Storage

PaedVault uses essential browser local storage and session tokens to maintain active sign-in sessions, remember exam preferences, and apply user interface themes. We do not use third-party advertising, tracking pixels, or cross-site profiling cookies.

7. Children's Privacy

PaedVault is a professional medical revision platform for postgraduate medical trainees and doctors. It is not directed at children under the age of 16, and we do not knowingly collect personal data from children.

8. Updates to This Privacy Policy

We may update this Privacy Policy periodically to reflect service updates or regulatory changes. Material updates will be notified via in-app banner announcements or direct email notification prior to taking effect.

9. Data Controller & Contact Details

If you have any questions, privacy concerns, or data protection requests, please contact our Data Protection lead: