Home

Privacy Policy

Last updated: June 2026

This policy explains what personal data Sparkmed collects, how we use it, who we share it with, and the rights you have. We process your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who is responsible for your data

Sparkmed is a trading name of Citrine & Sage Limited, a company registered in England and Wales (company number 16038867). Citrine & Sage Limited is the data controller for the personal data described in this policy. For any data protection query, contact our data protection team at medics@sparkmed.co.uk.

2. What we collect

  • Account data you provide when you register, such as your name, email address and password.
  • Subscription and payment data, such as the products you buy and your billing history. Card details are handled by Stripe and are not stored on our servers.
  • Learning activity, such as questions answered, scores, time spent, study patterns and performance analytics, which power your progress tracking and SparkCoach.
  • Support data, such as the messages and information you send us when you contact support.
  • Device and usage data, such as your device type, browser, IP address and session telemetry, used for security, reliability and to detect prohibited account sharing.

3. How we use your data, and our legal bases

  • To provide and personalise the Service, including the question bank and SparkCoach (performance of our contract with you).
  • To manage your account, process payments and provide your subscription (performance of our contract).
  • To respond to support requests and service issues (performance of our contract and our legitimate interests).
  • To keep the Service secure, prevent fraud and enforce our Terms, including detecting account sharing (our legitimate interests).
  • To improve the Service and develop new features, using aggregated and anonymised insights (our legitimate interests).
  • To send you service communications, and, where you have opted in, marketing communications you can unsubscribe from at any time (consent).
  • To comply with our legal obligations.

4. Who we share data with

We do not sell your personal data, and we do not show advertising. We share data only with the service providers that help us run Sparkmed, under contracts that require them to protect it, including:

  • Stripe, our payment processor, which handles your payment details directly.
  • Hosting, infrastructure and analytics providers that operate the platform.

We may share aggregated, anonymised data that does not identify you for research, benchmarking or statistical purposes. We may also disclose data where required by law or to protect our rights.

5. How long we keep your data

We keep your personal data for as long as you have an account, and for as long afterwards as we need it to meet legal, accounting or reporting obligations or to resolve disputes. When data is no longer needed, we delete or anonymise it.

6. Your rights

Under UK GDPR you have the right to:

  • access the personal data we hold about you;
  • ask us to correct inaccurate or incomplete data;
  • ask us to erase your data in certain circumstances;
  • restrict or object to our processing of your data;
  • request a copy of your data in a portable format; and
  • withdraw consent at any time where we rely on it.

To exercise any of these rights, email medics@sparkmed.co.uk. We will respond within one month. If you are unhappy with how we handle your data, you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

7. How we protect your data

We use appropriate technical and organisational measures to protect your data against unauthorised access, loss or misuse. No online service can be guaranteed completely secure, so we encourage you to use a strong, unique password and to keep your account credentials confidential.

8. Cookies

We use cookies and similar technologies to run the Service and understand how it is used. For details and how to manage your preferences, see our Cookie Policy.

9. Children

Sparkmed is intended for users aged 18 and over and is not directed at children. We do not knowingly collect personal data from anyone under 18.

10. Changes to this policy

We may update this policy from time to time. When we make material changes we will update the date at the top of this page and, where appropriate, notify you by email or through the Service.

11. Contact us

For any privacy or data protection question, or to exercise your rights, contact our data protection team at medics@sparkmed.co.uk. Sparkmed is a trading name of Citrine & Sage Limited, registered in England and Wales (company number 16038867).