Privacy Policy

1. Information We Collect

To provide, operate, and improve the Service, we may collect certain types of personal information.

Account and Profile Information: When you create or use a PharmaFly account, we may collect information such as your email address, name, exam date, authentication provider, and account identifiers. This information is used for login, account recovery, profile setup, subscription access, and important service notifications.

Technical Information: PharmaFly and its service providers may process limited technical information, such as app version, platform, operating system version, and configuration details, where needed to operate authentication, subscriptions, security, and Service functionality.

Local Quiz Progress: PharmaFly stores quiz attempts, answers, progress, accuracy, and revision history on your device so the mobile application can show your history, progress, and free-plan quota. This quiz activity is not uploaded to PharmaFly’s servers in the current version of the mobile application.

Payment and Subscription Information: If you purchase premium features or subscriptions, payments are processed by the Apple App Store, Google Play, RevenueCat Web Billing, or other authorised payment providers. PharmaFly does not store or process payment card details directly. We may receive subscription status, entitlement, renewal, cancellation, and transaction-related information from RevenueCat or the relevant payment provider so we can provide premium access and support subscription management.

2. Third-Party Services

PharmaFly uses trusted third-party service providers to operate the Service. These include Supabase for authentication, account and profile storage; RevenueCat for subscription entitlement management; Apple App Store, Google Play, and RevenueCat Web Billing for purchases and subscription management; Apple and Google for social sign-in where used; and Vercel for website hosting.

These providers may process limited account, technical, subscription, or transaction-related information as needed to provide their services. Where a provider processes personal information on our behalf, we require appropriate protections consistent with this Privacy Policy and applicable law. Some providers may also process information as independent controllers for their own platform, payment, account, security, or legal purposes, and that independent processing is governed by their own terms and privacy policies.

3. How We Use Your Information

The information collected through PharmaFly may be used for the following purposes:

• To provide and maintain the functionality of the Service
• To create, authenticate, and secure your account
• To store and update your profile information
• To manage subscription access and premium entitlements
• To provide account recovery, verification, and service notifications
• To process account deletion and data rights requests
• To maintain the security and reliability of PharmaFly
• To comply with legal obligations

4. Data Sharing

We do not sell or rent personal information to third parties.

Your information may be shared only in the following circumstances:

• Legal obligations: Where disclosure is required by law, regulation, or legal process.
• Service providers: Trusted third-party providers described in this Privacy Policy may process information as needed to provide authentication, hosting, subscription management, payment processing, account support, security, and related service functionality.
• Business transfers: If PharmaFly undergoes a merger, acquisition, restructuring, or sale of assets, user information may be transferred as part of that transaction.

5. Data Security

We implement appropriate technical and organisational measures designed to safeguard personal information against unauthorised access, disclosure, alteration, or destruction.

While we take reasonable precautions to protect personal data, no method of electronic storage or internet transmission can be guaranteed to be completely secure.

6. Your Rights Under UK GDPR

If you are located in the United Kingdom, you have certain rights regarding your personal data under the UK GDPR.

• The right to access the personal information we hold about you
• The right to correct inaccurate or incomplete data
• The right to request deletion of your data (“right to erasure”)
• The right to restrict certain forms of processing
• The right to request transfer of your data to another service provider
• The right to object to certain types of processing
• The right to withdraw consent where processing is based on consent
• Rights related to automated decision-making and profiling
• Requests relating to these rights can be made using the contact information provided below.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this Privacy Policy.

In some cases, information may be retained for longer periods where required by law, regulatory obligations, or legitimate operational purposes.

If you delete your PharmaFly account, we delete the account and profile data we control, subject to any limited records we are required or permitted to retain for security or legal reasons. Deleting your PharmaFly account does not cancel subscriptions or remove subscription records held by Apple, Google, RevenueCat, or other payment providers.

8. Children’s Privacy

PharmaFly is intended for individuals preparing for professional pharmacy examinations and is not designed for use by individuals under the age of 16.

We do not knowingly collect personal information from children under 16 years of age. If we become aware that personal data from a child has been collected without appropriate consent, we will take steps to remove the information.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or operational practices.

When updates occur, the revised Privacy Policy will be published within the Service or on the website and the “Last Updated” date will be updated accordingly. Users are encouraged to review the policy periodically.

10. Cookies and Similar Technologies

PharmaFly’s website may use cookies or similar technologies that are necessary to provide authentication, maintain secure sessions, and operate the website.

We do not use cookies in the current version of the website for advertising or cross-site tracking.

11. Contact Information

If you have any questions or requests regarding this Privacy Policy or your personal data, you can contact us at:

Email: support@pharmafly.co.uk

12. Lawful Basis for Processing

Under the UK GDPR and Data Protection Act 2018, PharmaFly processes personal data on the following lawful bases:

• Performance of a contract – to provide account access, profile features, subscription access, and core app functionality.
• Legitimate interests – to maintain, secure, troubleshoot, and improve PharmaFly, support users, prevent misuse, and protect the reliability of the Service, provided those interests are not overridden by your rights and freedoms.
• Legal obligations – where processing is required to comply with applicable laws or respond to valid legal requests.
• Consent – where we specifically ask for your consent for an optional feature, communication, or processing activity.

13. International Data Transfers

Some of the third-party providers described in this Privacy Policy may process personal information outside the United Kingdom. Where PharmaFly is responsible for a restricted transfer, we take steps required by applicable data protection law, such as relying on UK adequacy regulations, contractual safeguards, or another recognised transfer mechanism.

Some providers may also process information as independent controllers for their own platform, payment, account, security, or legal purposes. Their use of personal information is governed by their own terms and privacy policies, and we encourage you to review those policies where relevant.

14. Data Protection Contact

For enquiries relating specifically to data protection matters, you may contact our data protection contact:

Email: support@pharmafly.co.uk

15. Complaints

If you have concerns about how we handle your personal data, please contact us first using the details above so we can try to resolve the issue.

If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection.

ICO complaints: https://ico.org.uk/make-a-complaint/data-protection-complaints/

16. Third-Party Links

The Service may contain links to third-party websites or services, including app store, subscription management, sign-in, payment, or support pages that are not operated by PharmaFly.

When you use those external services, the relevant provider’s terms and privacy policy apply. PharmaFly does not control, and is not responsible for, how those third parties process personal information for their own independent purposes.

17. Automated Decision Making

PharmaFly does not use solely automated decision-making or profiling to make decisions about users that produce legal or similarly significant effects.

Automated checks may be used for ordinary service functions, such as account authentication, free-plan limits, and subscription entitlement access, but these do not involve profiling users for legal or similarly significant decisions.

18. Marketing Communications

PharmaFly does not send direct marketing communications in the current version.

We may send important service communications related to your account, verification, password resets, subscription access, policy updates, security, or support requests. These service communications are administrative and are not intended to market additional products or services.

If we introduce direct marketing communications later, we will only send them where permitted by applicable law, such as where you have consented or where a valid soft opt-in applies. Each marketing message will include a simple way to opt out.

19. Data Breach Procedures

If we become aware of a personal data breach, we will investigate it, take appropriate steps to contain and mitigate it, and document our assessment and response.

Where required by law, we will notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

If a breach is likely to result in a high risk to affected individuals, we will also inform those individuals without undue delay where required by law.

20. Special Category and Criminal Offence Data

PharmaFly does not ask for or intentionally collect special category personal data, such as information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health data, sex life, or sexual orientation.

PharmaFly also does not ask for or intentionally collect criminal offence data, such as information about criminal convictions, offences, allegations, or related proceedings. Please do not include this type of information when contacting us.

21. Accountability and Compliance

PharmaFly takes responsibility for the personal data it controls and maintains appropriate records, policies, and technical and organisational measures to support compliance with UK data protection law.

We review our data practices and this Privacy Policy when our services, providers, legal obligations, or processing activities change.

Where this Privacy Policy is updated materially, we will update the “Last Updated” date and provide additional notice where appropriate.