Privacy Policy
Last updated 11 October 2026
This policy explains what personal data Public Health ST1 Prep collects, what we do with it and what your rights are. We collect as little as we can: no advertising, no tracking cookies, and no selling of data.
1. Who is responsible
The data controller is Techne Ltd, company number 14170011, registered office 82a James Carter Road, Mildenhall, Bury St Edmunds, IP28 7DE, trading as Public Health Jobs. Questions about this policy or your data go to enquiries@publichealthjobs.co.uk.
2. What we collect and why
| Data | Why we use it | Lawful basis |
|---|---|---|
| Email address and a password you choose | To create your account, sign you in, and send you the set-up link and service emails such as password resets | Performance of our contract with you |
| Purchase record: the Stripe payment reference, the date and the amount | To grant access, handle refunds and disputes, and keep accounting records | Contract; legal obligation (tax records) |
| Your practice test results: module, test, score and date | To show your results and progress on the dashboard and History page | Contract |
| Interview module: the text transcript of each spoken answer and the feedback generated for it | To produce the feedback and your end-of-session summary | Contract. Audio is handled by your browser and is not received by us (see section 4) |
| Support emails you send us | To answer you | Legitimate interests (running the Service) |
| Anonymous page view counts (see section 3) | To understand which pages are used and whether the site works | Legitimate interests. Not personal data once hashed |
We do not ask for your name, address, date of birth or anything about your application, and we do not collect special category data. Stripe collects your card and billing details on its own payment page under its own privacy policy; we receive only the payment reference, the amount, and the email and name you give Stripe.
3. Cookies and tracking
We set no advertising or analytics cookies and use no third-party analytics such as Google Analytics.
When you sign in, a session token is stored in your browser's local storage so that you stay signed in. It is strictly necessary for the Service and is removed when you sign out. While you are in the middle of a checkout or an interview session, a small amount of state is kept in your browser's session storage and cleared when the tab closes.
We count page views ourselves. For each view, our server records the page, the date, the country and the type of device, plus a one-way hash made from the day, your IP address, your browser's identifying string and a secret. The hash lets us count one visitor once per day; it cannot be reversed to your IP address and cannot be linked across days. Your IP address itself is not stored. The hash is not personal data in our hands.
Two third-party services may set their own cookies on pages where they appear: Stripe on its checkout page, and Cloudflare's Turnstile verification widget on our sign-in and checkout forms, which checks that you are not an automated script. Each operates under its own privacy policy.
4. Who processes your data for us
We use these providers to run the Service. Each acts on our instructions under a written contract.
| Provider | What it does | Where |
|---|---|---|
| Supabase | Hosts our database and sign-in system: your account, purchase record and results | EU (Ireland) |
| Vercel | Serves the website. Its request logs include IP addresses for a short period for security | USA, with servers worldwide |
| Stripe | Takes payment and holds your card details | EU and USA |
| Resend | Delivers our emails to you | USA |
| Cloudflare | Domain services and the Turnstile verification widget | Worldwide |
| Anthropic | Generates interview feedback from the text of your spoken answers (interview module only) | USA |
| ElevenLabs | Turns the interview questions into speech. Receives only the question text, nothing about you | USA |
Speech recognition. The interview module uses your browser's built-in speech recognition to turn your spoken answer into text. Depending on your browser, the audio may be processed by the browser maker's service (for example Google for Chrome, Apple for Safari) under that company's privacy policy. We never receive the audio; we receive the text transcript, which we store with the feedback.
Where a provider is outside the UK, transfers are covered by the UK's adequacy regulations (for the EU), the UK International Data Transfer Addendum to the EU standard contractual clauses, or the UK Extension to the EU-US Data Privacy Framework, as applicable.
We do not sell your data or share it with anyone else, except if the law requires it, or to a buyer if the business is sold, in which case this policy continues to apply.
5. How long we keep it
- Account and results: for as long as your account exists. You can delete your results at any time from the History page, and you can ask us to delete the whole account.
- Interview transcripts and feedback: deleted with your account, or on request.
- Purchase records: six years after the purchase, because tax law requires it, even if the account is deleted. These records hold your email address and the payment reference only.
- Page view counts: indefinitely, as they contain no personal data.
- Support emails: up to two years.
6. Your rights
Under UK data protection law you can ask us to give you a copy of your data, correct it, delete it, restrict or object to its use, or send it to you in a portable form. You can also withdraw consent where we rely on it, though we do not currently rely on consent for anything. Email us and we will respond within one month. There is no charge.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to resolve it first.
7. Security
Connections to the Service are encrypted. Passwords are stored only as hashes. Access to the database is limited to the systems that need it. No system is perfectly secure, so if we discover a breach that affects you we will tell you and the ICO as the law requires.
8. Children
The Service is for people applying to a postgraduate training programme and is not aimed at anyone under 16. We do not knowingly collect data from children.
9. Changes
The date at the top shows when this policy was last changed. If we make a change that affects you materially, we will tell you by email or on the site before it takes effect.