Privacy Policy
Last updated: 24 September 2026
The Konceptuals ("we", "us", "our") operates the Medical QBanks website and services at https://thekonceptuals.com, including our question banks, mock exams, flashcards, Face2Face teaching sessions, and Telegram bot. This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR) and the UK GDPR.
1. Who we are
The controller of your personal data is The Konceptuals, Houston Texas, USA. You can contact us at any time at help@thekonceptuals.com.
2. Who this policy applies to
- Visitors browsing our public pages.
- Registered users (free trial, paid, teacher, and editor accounts).
- Users who interact with our Telegram bot.
- People who contact us by email or through our contact form.
3. What personal data we collect
- Account data: your name, username, email address, and a hashed password when you register.
- Purchase data: payments are processed by Stripe. We receive your payment status, the items and amounts paid, and a Stripe transaction reference so we can grant and support your access. Stripe handles your card details — full card numbers never reach our servers.
- Study data: your quiz and mock answers and results, scores, wrong-answer history, bookmarks, flashcard progress, and any comments or ratings you leave on questions or Face2Face sessions.
- Communications data: messages you send through our contact form or by email, and your email address if you subscribe to our newsletter.
- Telegram data: if you use our Telegram bot, your Telegram user identifier and the bot conversation state (for example your active topic, question, and daily usage quotas).
- Technical data: your IP address (used for site security, abuse prevention, and rate limiting), browser and device information, and server logs.
- Analytics and advertising data: with your consent only — see section 5 and our Cookie Policy.
4. Why we use your data (lawful bases)
- Performance of a contract: creating your account, giving you access to purchased question banks, storing your study progress, and providing the services you signed up for.
- Legitimate interests: keeping the service secure and preventing abuse (IP-based controls, rate limiting), maintaining business records, and improving the quality of our question banks.
- Consent: setting analytics and advertising cookies (Google Analytics and the Meta Pixel) and sending marketing emails. You can withdraw consent at any time without affecting prior processing.
- Legal obligation: keeping transaction and accounting records where the law requires it.
5. Cookies, analytics, and advertising
We use Google Consent Mode v2: analytics and advertising cookies are switched off (denied) by default and are only activated if you accept them in our cookie banner. The Meta Pixel is only loaded after you give advertising consent. You can change or withdraw your choices at any time using the "Cookie settings" link in our footer or through the options in our Cookie Policy.
6. Who we share your data with
We do not sell your personal data. We share it only with service providers who help us run the service, under contracts that protect your data:
- Stripe — payment processing.
- Google — website analytics and tag management (consent-gated).
- Meta — advertising measurement via the Meta Pixel (consent-gated).
- Cloudinary — hosting of images and media.
- Email delivery providers — sending transactional and account emails (for example activation and purchase confirmation emails).
- Telegram — if you choose to use our Telegram bot.
7. International transfers
Some of the providers listed above process data outside the UK and the European Economic Area (for example in the United States). Where that happens, we rely on the safeguards those providers make available, such as UK/EU Standard Contractual Clauses or adequacy regulations, together with the data-minimisation described in this policy.
8. How long we keep your data
- Account and study data: for as long as your account is open; deleted or anonymised when you close your account, except where we must keep records for legal reasons.
- Purchase records: retained for the period required by tax and accounting law.
- Consent records: your cookie consent choice is stored for up to 13 months and is refreshed whenever you update it.
- Technical logs: kept only as long as needed for security and abuse prevention.
9. Your rights
Under the GDPR and UK GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your personal data erased ("right to be forgotten");
- restrict or object to our processing;
- receive your data in a portable format;
- withdraw consent for analytics, advertising, and marketing at any time;
- lodge a complaint with your supervisory authority — in the UK the Information Commissioner's Office (ICO), in the EEA your national data protection authority.
To exercise any of these rights, email help@thekonceptuals.com. We will respond within the statutory period.
10. Security
We protect your data with HTTPS/TLS in transit, hashed passwords, role-based access controls for staff and editors, and rate limiting and IP controls against abuse. No system is perfectly secure, but we design ours to minimise what we hold and who can reach it.
11. Children
Our services are intended for medical students, trainees, and practising clinicians. They are not directed at children, and we do not knowingly collect personal data from children.
12. Changes to this policy
We may update this Privacy Policy as the service evolves. The "last updated" date above always shows the current version, and material changes will be highlighted on this page.