Privacy policy

Last updated 11 November 2026.

This policy explains what personal data DocFolio collects when you use docfolio.co.uk and the CoverTest browser extension, why we collect it, who else handles it for us and what rights you have. We've tried to keep it short and plain. If anything is unclear, email us.

Who we are

DocFolio is run by Dr Cameron Dent, a UK doctor, as a sole trader. For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), Dr Cameron Dent is the controller of your personal data. In this policy, "we" and "us" mean Dr Cameron Dent trading as DocFolio.

• Who we are: Dr Cameron Dent, trading as DocFolio.
• Email: [email protected]
• Post: DocFolio, 27 Old Gloucester Street, London, WC1N 3AX
• ICO registration number: C2084301

What we collect

When you create an account

• Your email address and a password. Passwords are stored by our authentication provider as a one-way hash; we can't see them.
• If you sign in with Google: your name, email address and Google account ID, which Google shares with us when you choose to sign in that way.
• How you found us, if your sign-up link carried that information (for example a referral code or a campaign tag), and the page you first landed on.

Your profile

Your name, grade, current specialty, the specialties and application year you're aiming for, your deanery or country, and your exam progress. Some fields are optional, such as your phone number and GMC number. Only fill them in if you want to.

Your portfolio and planning

• The portfolio entries you record, your self-assessment answers and the evidence files you upload.
• Tasks on your application timeline, and your interview preparation: practice ratings, how long you practised, checklists and your interview date.

Please don't upload anything that identifies a patient. Evidence files often name supervisors or colleagues. That's fine, but only upload documents you're entitled to share.

Leagues and friends

If you join a League: your League display name, your friend code, who you're friends with, your daily revision totals, and whether you've chosen to show your accuracy to friends. The CoverTest section below explains what the extension sends. Invite links you share carry your friend code and referral code, so whoever opens one can send you a friend request, and we can credit you if they sign up.

Practising interviews together

If you start or join a live practice session, everyone in it sees your first name and what happens in the session: the question, the timer, who is answering and any mark the interviewer gives. This passes through Supabase's realtime service while the session is open and isn't stored. Anyone with the session link can join while it's open. A rating you give yourself is saved to your account, as it is when you practise alone.

Things you send us

• Feedback you submit through the site.
• Applications to join the DocFolio team: your name, email, grade, the role you're applying for, and what you tell us about your experience, qualifications and availability.
• Emails you send us.
• Your email address, if you join a waiting list.

Emails and referrals

• Whether you've agreed to receive our newsletter, and when. Whether our welcome email has been sent to you. Delivery and unsubscribe records from our email provider.
• If someone referred you, a record linking your account to theirs so we can credit them. They don't see your portfolio or profile.

Technical data

Like every website, our hosting and security providers process your IP address and browser details to deliver pages and block abuse. If you accept analytics cookies, Google Analytics also records which pages you visit and how you use them. See our cookie policy.

We don't ask for health information or any other special category data, and we don't use your data to make automated decisions that have legal or similarly significant effects on you.

Why we use it, and our lawful basis

Where we rely on legitimate interests, you have the right to object. See your rights.

Who else handles your data

We don't sell your data or share it with advertisers. These companies process it for us, under contracts that limit them to following our instructions:

• Supabase stores our database and your uploaded files, and runs sign-in. Your data is stored in the EU (Ireland, eu-west-1).
• Cloudflare hosts the website, protects it from attacks, and runs Turnstile, the check that you're human when you sign up.
• Postmark (ActiveCampaign) sends our emails and records whether they were delivered or opened, and who unsubscribed.
• Google provides Google Analytics, only if you accept analytics cookies, and Google sign-in, only if you choose it.

Some of these providers process data outside the UK, including in the United States. Where they do, the transfer is covered by UK adequacy regulations (including the UK–US data bridge for certified companies) or by the ICO's International Data Transfer Agreement or Addendum.

We may also disclose data if the law requires it, or to protect someone's safety.

How long we keep it

• Your account, profile, portfolio, files, tasks, interview practice and League totals: until you delete your account. We then delete them within one month.
• CoverTest answer records: 7 days, then only your daily totals remain. See CoverTest.
• Team applications: 12 months after we make a decision, or for as long as you're on the team.
• Feedback: until you delete your account, unless we've removed anything that identifies you.
• Waiting-list emails: until the waiting list closes or you ask us to remove you.
• Email delivery records at Postmark: up to 45 days. We keep unsubscribe records for as long as we send newsletters, so we never email you again by mistake.
• Google Analytics: no longer than 14 months.
• Backups: deleted data can stay in a backup copy until that copy is deleted, within 90 days.

CoverTest (browser extension)

CoverTest runs only on passmedicine.com pages. It reads the question page in your browser so it can cover and uncover the answer options. It doesn't send the question, the options, your answer or any other page content anywhere.

• Stored in your browser: your settings, your running score and today's totals. Removing the extension deletes them.
• Sent to DocFolio, only if you link your account: one record for each question you answer after linking. It says whether you were right, how many seconds you took, when you answered, and how much the question counts (multi-part questions count half). It also carries a random ID that tells us when two parts belong to the same question. Nothing you answered before linking is sent. You link with a code you create on DocFolio, never with your password.
• What we do with it: work out your League points and weekly totals. Friends you accept see your League name and weekly totals: points, questions answered and days revised. They see your accuracy only if you turn that on. Nobody else sees them.
• How long we keep it: each answer record for 7 days, which is as long as our checks against cheating need it. After that we keep only your daily totals of points, questions and correct answers, for as long as you have an account.
• Stopping: unlink in the extension or on the League page and nothing more is sent. Deleting your DocFolio account deletes your League data.

CoverTest is independent and isn't affiliated with or endorsed by Passmedicine.

Your rights

Under UK data protection law you can ask us to:

• give you a copy of your personal data;
• correct data that's wrong (you can edit most of it yourself in your profile);
• delete your data, including your whole account;
• restrict how we use it, or object to our using it on the basis of legitimate interests;
• give you your data in a portable format, or send it to someone else.

Where we rely on consent, you can withdraw it at any time. That doesn't affect anything we did before you withdrew it. To use any of these rights, including deleting your account, email [email protected] from the address on your account. We'll reply within one month and won't charge you.

Keeping it safe

Data travels over encrypted connections and is stored with providers that encrypt it at rest. Database rules mean each account can reach only its own data, apart from what you choose to share with League friends. If a breach is likely to put you at high risk, we'll tell you without undue delay.

Who DocFolio is for

DocFolio is for doctors and medical students aged 18 or over. We don't knowingly collect data from children.

Complaints

Please contact us first so we can try to put things right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

Changes to this policy

If we change this policy, we'll update the date at the top. If the change matters to how we use your data, we'll tell you by email or on the site before it takes effect.