Privacy Policy

Who we are

MedPortfolio is run by Edward Phillips, who is the data controller for the personal data described here under UK GDPR and the Data Protection Act 2018. You can contact me at hello@medportfolio.co.uk.

What we collect

• Account details: your email address and password (stored only as a hash). If you sign in with Google, we receive your name and email from Google.
• Your portfolio: the entries, files, dates and notes you add, and the profile details you choose to fill in (such as your name, contact details, links, medical school dates and a short bio).
• Feedback you send us: the message, any attachments, and my replies.
• Referral and usage records: the referral code you used or share, who signed up through it, how many pieces of evidence you have uploaded and when, and whether you have had feedback resolved. This is used to work out the rewards described on the Plan page.

How we use it, and why

To provide MedPortfolio to you: to create your account, store and display your portfolio, and let you export it. This is the contract between you and us (UK GDPR Article 6(1)(b)).

To keep the service secure, to respond to feedback, and to run the referral and free-year scheme. This is a legitimate interest of running the service, and we consider it proportionate because it is described openly here and on the Plan page (Article 6(1)(f)).

We do not sell personal data, show advertising, or use your portfolio content to profile you.

Who can see your data

As the operator, I (and any administrator I appoint) can see account-level information such as your email address, display name, referral and usage counts, and the feedback you send. I do not routinely look at the content of anyone's portfolio. I may need to if you ask for help, to investigate misuse, or where the law requires it.

Other users cannot see your data. Each account is isolated using row-level security.

Who we share it with

We use the following service providers to run MedPortfolio. They process data on our behalf and only for that purpose:

• Supabase for authentication, the database and file storage.
• Vercel for hosting the website.
• Resend for sending emails, such as replies to your feedback and account emails.
• Google if you choose to sign in with Google.

These providers may process data outside the UK. Where they do, the transfer relies on the safeguards set out in their own data protection terms. We will also disclose data if the law requires it.

Data storage and security

Connections are encrypted in transit and access to the database is restricted by row-level security. No online service is completely secure, so keep your own copies of important documents.

What you must not upload

Do not upload patient-identifiable information. MedPortfolio is for professional portfolio evidence only — certificates, feedback forms, audit reports, teaching records and similar professional documents. Uploading patient records or any patient-identifiable data is a violation of these terms and potentially of data protection law.

How long we keep it

We keep your data for as long as you have an account. If you ask us to delete your account, your portfolio data and profile are removed from our live systems. We may keep a minimal record that you referred someone or received a reward where needed to avoid disputes. Feedback may be kept for as long as it is useful to improve the service.

Your rights

You have the right to access your data, correct it, have it deleted, restrict or object to how it is used, and receive a copy in a portable format. To use any of these, email hello@medportfolio.co.uk. We will respond within one month.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

Cookies

MedPortfolio uses a small number of cookies that are needed for the site to work: your sign-in session, the access-gate cookie, and a preference cookie that remembers the evidence tab you last opened. No advertising or tracking cookies are used.

Changes

If this policy changes in a way that matters to you, we will update the date above and, where appropriate, tell you by email or in the app.

Contact

Questions about this policy: hello@medportfolio.co.uk