Privacy Policy
Last updated 2 October 2026
This policy explains what personal data Plabster collects when you use plabster.com, why, who we share it with, and the choices and rights you have. We've tried to keep it plain and specific.
1. Who we are
Plabster ("we", "us") runs plabster.com, an online platform for practising PLAB 2 and UKMLA clinical stations with AI-simulated patients. We are the controller of the personal data described in this policy. You can reach us about anything in it at info@plabster.com.
2. Information we collect
- Account details — when you sign in with Google we receive your name, email address and profile photo. We do not receive or store your Google password.
- Profile details you choose to add — first and last name, a leaderboard nickname, country, medical school and your PLAB 2 exam date.
- Practice content — the transcript of each practice or mock-exam station (what you said and the simulated patient's replies), any notes you write, and the scores and feedback generated for you.
- Voice — when you speak during a station your microphone audio is converted to text. We keep the text transcript; we do not store your audio recordings (see section 4).
- Feedback and reviews — ratings and comments you send us, and whether you agreed to have a review published.
- Bookmarks and preferences — scenarios you save and your email preferences.
- Payments — your plan, payment amounts and dates, and Stripe reference IDs. Card details are entered on Stripe's checkout and never reach us.
- Usage and device data — pages visited, clicks, browser and device type, approximate location from your IP address, and error reports when something breaks.
Please don't put real patient information into practice sessions. All Plabster scenarios are fictional, and the service is not designed to handle real patient data.
3. How we use your information and our legal bases
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Creating your account, running practice stations, scoring them and showing your progress | Contract — needed to provide the service you signed up for |
| Taking payments, managing subscriptions and credits | Contract; legal obligation for financial records |
| Service emails: welcome email, onboarding tips, receipts and account notices | Contract and legitimate interests (helping you get started with what you signed up for) |
| Marketing emails about new scenarios and offers | Consent — only if you opted in; you can withdraw anytime |
| Publishing your review with your first name and photo | Consent — only if you ticked the publish box |
| Analytics, error monitoring, preventing abuse and improving the service | Legitimate interests; consent where analytics cookies are used |
4. AI processing and voice
To simulate patients and mark your stations, the text of your conversation is sent from our servers to AI providers that generate the patient's replies and your feedback. Today these requests go through fal.ai and OpenRouter to Google's Gemini models. The patient's voice is produced by Google Cloud Text-to-Speech.
When you speak, your audio is sent to Deepgram to be transcribed, and your browser's built-in speech recognition may also process it (in Chrome, this is handled by Google). We store the resulting text, not the audio.
AI feedback is automated and can be wrong. It is a study aid only and does not make decisions with legal or similarly significant effects on you. We do not use your conversations to train our own AI models.
6. What other people can see
- Reviews — only if you agree to publish one, and only after we approve it. It shows your first name, profile photo, rating and comment.
- Nickname — your leaderboard nickname (for example "Surgical_Fox524") is shown instead of your name on leaderboards. You can change it in Settings.
- Counts — we show the total number of doctors using Plabster, never who they are.
7. International transfers
Some of our providers process data outside the UK, including in the United States. Where they do, we rely on the safeguards UK law allows, such as the UK–US data bridge or the International Data Transfer Agreement / Addendum built into those providers' terms.
8. How long we keep it
- Account, profile and practice history — for as long as your account is open.
- Practice sessions you start but never speak in — deleted automatically within a few hours.
- Payment records — up to 6 years, to meet UK tax and accounting rules.
- Marketing preferences — until you withdraw consent or close your account.
- Analytics and error data — according to each provider's retention settings, typically up to 13 months.
10. Your rights
Under UK data protection law you can ask us to:
- give you a copy of your personal data;
- correct anything inaccurate (most profile details you can edit yourself in Settings);
- delete your account and data;
- restrict or object to how we use it, including stopping marketing at any time;
- move your data to another service.
To use any of these, email info@plabster.com from the address on your account. We will reply within one month, and delete accounts within 30 days of a confirmed request. You can unsubscribe from marketing using the link in any email or the switch in Settings.
If you're unhappy with how we handle your data, please tell us first. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
11. Security
Data is encrypted in transit, access to your records is restricted to your own account by database rules, and payment details are handled entirely by Stripe. No system is perfectly secure, so we keep what we collect to what the service needs.
12. Who Plabster is for
Plabster is for doctors and medical graduates preparing for UK licensing exams. It is not intended for anyone under 18, and we don't knowingly collect data from children.
13. Changes to this policy
We'll update this page when our practices change and revise the date at the top. For significant changes we'll also let you know by email or in the app.