Privacy Notice

BELMAR RADIOLOGY LIMITED, company number 17047911, trading as The 2A Bank, is the controller of personal information processed through the platform.

Registered office: 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.

Contact: belmar.radiology@gmail.com.

• Account email
• Required full name
• Authentication and account-security records
• Email-verification status
• Access and approval status
• Access source and expiry
• Practice sessions
• Question-delivery and session-access records, including question identifiers, delivery times, session identifiers and rate-limit events used to protect the question bank
• Mock attempts
• Answers and scores
• Timings and progress
• Skipped and flagged questions
• Bookmarks
• Spaced-repetition schedules
• Performance summaries
• Private tutor feedback and feedback status
• Feedback reports
• Support correspondence
• Legal-document acceptance records
• Marketing preferences
• Administrative and security audit records
• Account-deletion requests
• MCP OAuth connections
• MCP permissions and revocations
• Limited MCP tool-call audit information (see AI features below)
• Payment references, PaymentIntent or charge identifiers, plan, subtotal, tax and total, currency, payment or refund status, declared residence, billing and card-issuer country, checkout acknowledgements, purchase dates and access entitlements
• Technical information reasonably required to secure and operate the service

The 2A Bank does not have access to raw passwords. Passwords are handled by our authentication provider using industry-standard hashing.

The 2A Bank does not receive or store your full card number or security code. Stripe processes card details and the full billing address. We retain only the limited purchase, country, acknowledgement, entitlement and security information described above; we do not retain Stripe's expanded transaction object or the full billing address.

Candidates are not asked why they select Custom or Untimed mock timing. Candidates should not enter health or other sensitive personal information into free-text feedback.

Contract — registering and operating candidate accounts; supplying approved beta, complimentary or paid access; saving progress and results; providing practice and mock functions; providing Account Settings; responding to support and account requests; administering purchases and supplying paid access.

Legitimate interests — protecting the platform and question bank; preventing account sharing; detecting scraping, extraction, fraud and misuse; investigating errors, irregularities and security incidents; maintaining administrative audit records; improving question quality; analysing individual, cohort and product performance; preparing and delivering proportionate personalised tutor feedback, including AI-assisted drafting with human review; administering, evaluating and improving Academy-facilitated programmes; measuring participation, completion, engagement, performance and longitudinal trends; designing and evaluating teaching and educational support; and sharing proportionate identifiable educational information with authorised staff of a sponsoring training organisation for these purposes. We may use existing and future records where the use is compatible with the purpose for which the information was collected. We consider necessity, proportionality and candidates' rights. Each receiving organisation must identify its own lawful basis.

Legal obligation — complying with tax, accounting, consumer, court, regulatory and other legal requirements.

Consent — optional marketing communications, and any future non-essential analytics or tracking. We do not rely on consent where contract, legitimate interests or legal obligation is the actual basis.

We use limited first-party event records to understand whether public guides and the free mock lead to account creation, checkout and purchase. This helps us improve the candidate journey and assess which educational pages are useful.

• Recorded events are restricted to defined funnel stages such as guide CTA, free mock, checkout and purchase.
• We may record the page path, destination path, referring hostname and campaign parameters supplied in the URL.
• We do not store IP addresses, full referrer URLs, browser fingerprints, user agents, email addresses or free-text candidate content in this feature.
• Anonymous public events are reported separately from authenticated conversions.
• When URL attribution reaches account creation or checkout, it may be associated with that account so first-touch source and landing page can be assessed.
• Raw funnel-event records are retained for up to 13 months. Account attribution is deleted with the account.
• We do not use third-party advertising pixels for this measurement.

The lawful basis is our legitimate interest in operating, measuring and improving the service proportionately. The measurement is purpose-limited and is not used to build a cross-site behavioural profile.

AI is used in several separate, controlled ways. These include the candidate-requested Explain my answer feature, AI-assisted drafting of private tutor feedback, and an optional connection that lets a candidate-authorised external AI service read permitted revision information. These workflows have different data flows and controls.

Explain my answer (integrated)

• Processing occurs only when you request an explanation for a specific question.
• Each request may include the question stem and lead-in; answer options; your selected answer; the approved correct answer; the approved explanation; the associated learning point, key discriminator and common pitfall; and the question's category or topic metadata.
• Model usage, token counts, response time and failure information are recorded for reliability, security and cost control.
• The AI request is designed not to include your name, email address, unrelated account information, or another candidate's information.
• Requests are sent through the Lovable AI Gateway and a selected third-party model provider. The current provider may change where the platform configuration changes.
• Only the minimum information required for the requested explanation is sent.
• Generated explanations may be cached for reliability and cost control in accordance with the platform's configured retention arrangements.
• The feature is optional. Candidates may continue using the approved editorial explanation when AI is disabled or unavailable.

AI-assisted individual tutor feedback

• Individual mock or practice performance may be analysed with AI-assisted tools to help an authorised tutor or administrator prepare personalised educational feedback.
• The AI-facing packet is data-minimised and may contain aggregate scores and percentages, completion and pacing information, longitudinal trends, and sufficiently supported module or recurring-topic patterns.
• Unnecessary direct identifiers are excluded from the AI-facing packet. In particular, the drafting context is designed not to include the candidate's name, email address, account UUID, Academy participant reference, cohort name or other stable account identifier. Short-lived random workflow handles may be used only to return a draft to the correct account.
• This remains pseudonymised personal data from the controller's perspective; it is not described as anonymous data.
• An administrator-authorised external AI provider, currently including OpenAI ChatGPT where that workflow is used, may process the data-minimised packet to prepare a draft. Provider terms, privacy arrangements and account settings apply to that processing.
• AI output is saved only as an unpublished draft. A human tutor or administrator must review it and explicitly choose to publish it before the candidate can see it.
• AI does not determine examination results, platform access, formal training progression, ARCP or remediation decisions, employment decisions, fitness to practise, or any other similarly significant decision.
• Deterministic analytics and manual drafting remain available; AI assistance is not required in order to provide tutor feedback.

Optional external AI assistant (candidate MCP connector)

• Connecting an external AI assistant is optional and not required to use Explain my answer.
• The 2A Bank does not run or pay for the candidate's external AI model.
• Data is shared only when you connect and authorise a compatible external client.
• MCP tools are read-only and scoped to your signed-in account.
• Tools may return performance summaries, revision context and approved feedback relating to questions already answered or revealed.
• Active-mock answers and explanations are not available.
• The full question bank cannot be browsed, searched or exported.
• External AI services operate under their own terms and privacy notices — please review those documents before connecting.
• Connections can be revoked through Account Settings. Revocation blocks future access but cannot remove information already received by an external provider.
• MCP audit records contain limited operational information and are not intended to contain full question text, answer histories or AI conversations.

We do not claim that information processed by an external provider is never retained, never processed internationally or never used for provider-side purposes unless that has been verified for the relevant provider, service and configuration.

Candidate participation may be facilitated through an Academy, deanery, NHS organisation or other training body. Reporting may be aggregate, pseudonymised or identifiable, depending on what is reasonably necessary for the relevant purpose.

For its own processing, BELMAR RADIOLOGY LIMITED generally relies on legitimate interests to administer and evaluate Academy-facilitated activity and to share proportionate educational information with specifically authorised staff of a sponsoring organisation. The recipient must identify its own lawful basis. Written terms, contracts or data-sharing arrangements will be used where appropriate or legally required, taking account of the parties' respective roles and the nature and regularity of the sharing.

Purposes may include:

• administering, operating and evaluating Academy-facilitated programmes;
• verifying attendance, participation, completion and engagement;
• measuring individual, longitudinal and cohort-level performance;
• planning, targeting and evaluating teaching, feedback and educational support;
• identifying non-engagement, unusual patterns or potential support needs;
• educational quality assurance, service evaluation and programme improvement; and
• protecting assessment integrity and investigating suspected misuse or irregularity.

Information may include, where reasonably necessary:

• name, email address, account identifier or Academy reference used for matching;
• access, attendance, participation, start, submission and completion information;
• scores, percentages, answered or unanswered counts and cohort-relative comparisons;
• selected-answer, correctness, question or topic identifier and item-level performance;
• response timing, pacing, confidence, flags and other assessment interactions;
• module, topic, strength, weakness and longitudinal performance summaries;
• tutor feedback, support or engagement indicators; and
• limited administrative, audit or security information relevant to integrity or misuse.

We choose a proportionate level of detail for the purpose. Answer-level information may be shared where it materially assists educational support, quality assurance or assessment integrity. Protected question text, answer options and explanations are normally withheld and remain subject to the platform's intellectual-property and access controls.

This processing may include existing as well as future Academy-facilitated learning records, including records created before this version of the notice, where the use remains compatible with the original educational context. The processing or disclosure occurs under the applicable current lawful basis; no consent or acceptance is backdated.

This Privacy Notice and the authenticated in-app Academy update are used to bring this processing to candidates' attention. We may provide additional communication where required because a proposed use is materially different, unexpected or otherwise requires further transparency. A separate consent request is not required where another lawful basis applies.

Candidates may object to processing based on legitimate interests by contacting belmar.radiology@gmail.com. We will consider the purpose, necessity, impact and the candidate's circumstances. The law may permit processing to continue where there are compelling legitimate grounds.

The 2A Bank does not itself make formal training-progression, ARCP, employment, disciplinary or fitness-to-practise decisions. A recipient is responsible for identifying the lawful basis, governance and transparency required for any use it makes beyond the educational and administrative purposes described here.

Any written terms or data-sharing arrangements will be proportionate to the relationship and legal roles. Academy participation does not give an institution ownership of candidate accounts, platform data or protected question-bank content.

• Supabase — database and authentication (data processor).
• Cloudflare Workers — application hosting (via our TanStack Start deployment).
• Lovable AI Gateway and its configured underlying model provider — for integrated Explain my answer requests.
• Administrator-authorised AI providers, currently including OpenAI ChatGPT where used for data-minimised AI-assisted tutor-feedback drafting.
• Candidate-authorised external AI providers, only where the candidate has explicitly connected an MCP client.
• Authorised staff of a sponsoring Academy or training organisation, for proportionate existing or future identifiable educational information where the transparency, lawful-basis, purpose-limitation, security and data-minimisation requirements described above are met, together with any arrangement legally required by the parties' roles.
• Professional advisers.
• Insurers.
• Courts, regulators and public authorities where legally required.
• Stripe — payment processor for paid access. Stripe processes the transaction, calculates and collects applicable taxes where relevant, and sends receipts or invoices. The 2A Bank does not receive or store your full card number or security code. We record the limited payment, country, checkout-acknowledgement, refund and entitlement information listed under “Information we collect” so we can confirm the transaction, meet legal and accounting obligations, prevent misuse, and activate and manage access.

• Some processors or authorised AI services may process information outside the United Kingdom.
• Appropriate contractual or legal safeguards will be used where required.
• Candidates can request further information through belmar.radiology@gmail.com.
• International users may have additional local rights.

• Active account and learning information — while the account remains open and reasonably required to provide access.
• Closed account — ordinary account and learning data deleted or anonymised within 30 days.
• Residual encrypted backups — removed through normal rotation within 90 days.
• Security and administrative logs — up to 12 months unless required for an investigation or claim.
• Support enquiries and complaints — up to 2 years after resolution.
• Approval, suspension, reset, deletion and AI/MCP security audit records — up to 2 years.
• Marketing-consent and withdrawal records — while relevant and for a reasonable period afterwards to demonstrate compliance.
• Properly anonymised aggregate statistics — may be retained indefinitely.
• Payment, contract-confirmation, invoice, tax and accounting records — retained for the period required by applicable law.

Records may be retained longer where reasonably required for fraud prevention, disputes, legal claims or legal obligations.

• Right of access
• Right to correction
• Right to erasure
• Right to restriction
• Right to object to processing based on legitimate interests
• Right to portability where applicable
• Right to withdraw consent (including marketing) at any time
• Right to complain to the Information Commissioner's Office

Rights vary according to the lawful basis and may be subject to legal exceptions. Requests: belmar.radiology@gmail.com.

• We use reasonable technical and organisational protections.
• Row-Level Security, authenticated access and audit controls are used.
• No online service can guarantee absolute security.
• Material changes to this Privacy Notice will be communicated appropriately, including a proportionate read acknowledgement on an authenticated visit where appropriate.