Privacy Notice

1. Who we are

DrugClass is run by Joel Kumar, trading as DrugClass. We are the data controller for your personal data, which means we decide how and why it is used.

2. Data we collect

Account details: your name and email address, and your login details (password or Google sign-in).
Plan details: which plan you have and its status. We do not see or store your full card details.
Usage data: pages you visit, tests you take, your language choice, device and browser type, and IP address.
Messages: anything you send us through the contact form or newsletter sign-up.

3. Why we use it, and our legal basis

To create your account and give you the study content you paid for (contract). To keep the site safe and stop fraud (legitimate interests). To improve DrugClass (legitimate interests). To answer your questions (legitimate interests). To send newsletters, only if you sign up (consent — you can unsubscribe at any time). To meet legal duties (legal obligation).

4. Who we share it with

Service providers who host our website, database and sign-in, and who provide AI and analytics tools.
Paddle, our Merchant of Record, which handles the sale of our plans, subscription management, payments, tax and invoicing. Paddle uses your data under its own privacy notice.
Professional advisers such as lawyers and accountants.
Authorities where the law requires it. We never sell your personal data.

5. International transfers

Some of our providers may process data outside your country. Where this happens, we rely on proper safeguards such as standard contractual clauses or adequacy decisions.

6. How long we keep it

We keep account data while your account is open, and delete or anonymise it within 12 months after you close it, unless the law requires us to keep it longer (for example, tax records).

7. Your rights

Depending on where you live, you can ask to see, correct, delete, restrict or move your data; object to how we use it; or withdraw your consent at any time. You can also complain to your local data protection authority (in the UK, the ICO). We reply within one month. Contact us through our contact page.

8. Security

We use appropriate technical and organisational measures to protect your data, including encrypted connections, access controls and secure hosting.

9. Cookies and local storage

We use essential storage to keep you signed in and remember your language. We do not use advertising cookies. You can clear this storage in your browser settings, but you may then be signed out.

10. Changes

We may update this notice and will show the new date at the top.