Last updated 25 July 2026
Privacy Policy
1. Who we are
MockOSCE is operated by Small Business Elevate LLC, a limited liability company formed in the United States (“we”, “us”). Small Business Elevate LLC is the data controller for personal data processed through MockOSCE. Contact for anything in this policy: support@mockosce.com.
2. What we collect
When you sign in with Google we receive basic account information (name, email address, profile image) via our authentication provider, Clerk. As you practise, we store: your attempt results (scores, performance bands, timings — not the conversation itself), which stations you have opened, your app preferences (timer, input mode, voice engine, theme), and usage metering needed to run the free beta fairly (counters of sessions and messages used, and per-call AI token counts for cost monitoring — token counts only, never the content). If you submit feedback, we store what you include in it, which may contain a dictated transcript and your score breakdown. We do not ask for, or store, payment card details.
3. AI processing — and no training on your data
To simulate the patient and to score your consultation, the text (and, in voice mode, the audio) of your consultation is sent to Google’s Gemini models for processing at the moment you practise. In voice mode the audio streams directly from your browser to Google and never touches our servers, and we do not save your consultation transcripts or audio. We do not train AI models on your data — MockOSCE never uses your conversations, audio, scores or account data to build or train any AI model. We use the paid tier of the Gemini API, under which Google does not use your prompts or responses to train or improve its models; Google may retain prompts briefly solely to detect abuse of its service. If you use the optional hands-free mode, your speech is transcribed by your browser’s built-in speech service rather than by us — depending on your browser and device, that audio may be processed on-device or sent to your browser vendor’s servers (Google, Apple or Microsoft) for transcription, and MockOSCE receives only the resulting text. Replies read aloud use your browser’s built-in voices; most run on your device, though some (for example Chrome’s “Google” voices) are generated on your browser vendor’s servers. We may use aggregated, de-identified usage statistics — never your conversation content — to improve stations, prompts and scoring. Consultations are role-play with fictional patients — never enter real patient-identifiable information.
4. How we use your data, and on what basis
We use your data to provide the Service (run consultations, calculate scores, show your progress), to keep it secure and fairly metered, and to improve content and accuracy. Where UK GDPR applies, our lawful bases are: performance of our contract with you (providing the Service you signed up for), our legitimate interests (keeping the Service secure, preventing abuse, and understanding how it is used — including the cookieless, aggregate visit statistics described in section 7), and your consent (for optional product analytics — which you can withdraw at any time in Settings). We do not sell your personal data, and we do not use it for advertising.
5. Service providers and international transfers
We rely on a small number of processors to run the Service: Clerk (authentication), Neon (PostgreSQL database hosting), Google (Gemini AI), Vercel (application hosting), Upstash (rate-limiting counters, keyed by your account id), PostHog (product analytics — only if you accept analytics when asked), Plausible (cookieless, aggregate visit statistics — see section 7), and GitHub (only if we escalate a feedback report you submitted into our private issue tracker). Each processes data only to provide their part of the Service. These providers store and process data in the United States (Plausible in the EU); where UK GDPR applies, transfers rely on the UK Extension to the EU-U.S. Data Privacy Framework or the UK International Data Transfer Agreement/Addendum, as set out in each provider’s data-processing agreement.
6. Retention, deletion and your rights
We keep your data while your account exists, and delete it when your account is deleted (residual copies may persist in encrypted backups for a short period before being overwritten). We may also delete accounts that have been inactive for more than 24 months. In Settings, “Clear all progress” permanently deletes your attempt history and scores (feedback you submitted and usage metering are removed only by full account deletion). To delete your account and all associated data, or to request a copy of your data, email support@mockosce.com from your sign-in address — we action deletion requests within one month. Where UK GDPR applies, you have rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time. You can raise any data-protection complaint with us first at support@mockosce.com, and you may also complain to the UK Information Commissioner’s Office (ico.org.uk).
7. Cookies and device storage
We use only strictly necessary storage to run the Service: Clerk’s session cookies keep you signed in, and your browser’s local storage holds your app preferences (theme, timer, input mode) and your analytics choice. Optional product-analytics storage is used only if you accept analytics when asked, and you can withdraw that at any time in Settings. Separately, we measure aggregate site traffic with Plausible, a privacy-first service that sets no cookies, stores nothing on your device, keeps no persistent identifier for you, and does no cross-site tracking — it tells us page and feature usage in aggregate only, which is why it does not need a consent prompt. We do not use advertising or cross-site tracking cookies.
8. Security
Access is restricted to authenticated users; answer-key material is served only to authenticated requests and is not shipped to the browser. No system is perfectly secure, but we take reasonable measures to protect your data.
9. Changes and contact
We may update this policy from time to time. Questions or data requests can be directed to support@mockosce.com.