Privacy Policy

StepLobe is operated by Opaline Clinique Limited, a company registered in England and Wales (company number 16660864), registered office Flat 6 Lancia House, 9 Oaklands Road, London NW2 6GS, United Kingdom. We are the controller of the personal data described in this policy.

Contact for any privacy question or request: aryan@clinicscheck.com.

• Account data: your email address and password when you register with email and password. Passwords are handled by our authentication provider (Supabase Auth) and stored only in hashed form; we never see them in plain text.
• Google sign-in: if you choose “Continue with Google”, we receive your email address, your name and your profile picture from Google, through Supabase Auth.
• Study progress: the questions you are served and your answers, scores, flashcard reviews, study plan, pack activity and display preferences (such as your chosen theme).
• Payment data: payments are processed by Stripe. We do not receive or store your card number. We store your Stripe customer and subscription identifiers, your plan and subscription status, and a card fingerprint (an identifier Stripe derives from a card, not the card number) so that each card can be used for only one free trial.
• Security and session data: a hashed session token, the time of sign-in, your browser's user-agent and, for sample exams, your IP address, used to keep your account secure, enforce account limits and prevent abuse.
• Messages: anything you send us by email.

• To create and run your account and provide the service you signed up for (performance of our contract with you).
• To take payments, manage your trial and subscription and enforce one trial per account and per card (contract, and our legitimate interest in preventing trial abuse).
• To protect our content and users: rate limits, session limits, watermarking and detection of copying or account sharing (legitimate interests).
• To send service emails such as email confirmation and password reset (contract).
• To meet legal, tax and accounting obligations (legal obligation).

We do not sell your personal data, and we do not use it for advertising.

We use the following service providers, who process data on our behalf:

• Supabase: database and authentication. Our database is hosted in the EU (Frankfurt, Germany).
• Vercel: website hosting and delivery.
• Stripe: payment processing, subscriptions and the customer portal. Stripe also acts as an independent controller for some payment data; see Stripe's own privacy policy.
• Google: only if you choose Google sign-in.

Some of these providers may process data outside the UK. Where they do, the transfer is covered by appropriate safeguards such as UK adequacy regulations or the UK International Data Transfer Addendum.

We use a single strictly necessary session cookie to keep you signed in. Stripe may set its own cookies on its checkout and portal pages.

Analytics. We count page visits and a few actions (email sign-up, starting a checkout, completing a purchase) with Plausible Analytics, which sets no cookies and does not collect personal data.

Advertising (only with your consent). If you click Accept on our cookie banner, the Meta Pixel sets cookies so we can measure which of our ads bring visitors and purchases. If you click No thanks, it never loads. It never runs inside the study panel. To change your choice, clear this site's data in your browser and choose again.

We keep account and study data while your account is active. If you ask us to delete your account, we delete or anonymise your personal data, except records we must keep for legal, tax or accounting reasons, or to enforce the one-trial rule and prevent fraud.

Under the UK GDPR you have the right to access your data, have it corrected, have it deleted, restrict or object to its use, and receive a copy in a portable format. Email aryan@clinicscheck.com to use any of these rights. We will answer within one month.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Data is encrypted in transit. Access to the question bank is controlled server-side, every database table is protected by row-level security, and we limit each account to two active sessions.

StepLobe is designed for medical students and graduates preparing for the USMLE and is not intended for children.

We may update this policy. We will change the date above and, for significant changes, tell you by email or in the app. See also our Terms of Service.