1. Information we handle
- Account information, including your name, email, login details, learning level and expected graduation year.
- Learning activity, including topics viewed, quiz attempts and results, progress, cases, OSCE activity, streaks and badges.
- AI Mentor prompts, responses, conversation history, selected mode and timestamps.
- ResearchLens usage records: for every paper you upload we keep the date and time, the original file name, file size, a digital fingerprint (hash) of the file and the full breakdown generated. The PDF itself is not kept. You can also save breakdowns to your own list in your account.
- Subscription information received from Stripe, including customer and subscription references, status, trial and renewal dates and cancellation status. We do not store full card details.
- Contact messages, including the name, email, subject and message you provide.
- Security and technical data needed to operate and protect the service, which may include IP address, browser, device, login and error information.
2. Why we use it
We use information to create and manage accounts, provide lessons and the AI Mentor, remember progress, administer subscriptions, respond to support requests, protect the service, prevent fraud, meet legal obligations and establish or defend legal claims. We may use suitably aggregated or anonymised information to understand and improve the service.
3. Lawful bases
We generally rely on contract to provide your account and membership; legitimate interests to secure, administer and improve the service; legal obligation where the law requires processing; and consent where required, such as for non-essential technologies or marketing. You can withdraw consent where it applies.
4. AI processing
AI Mentor prompts and relevant syllabus context are sent through Lovable’s AI service to an underlying AI model provider to generate a response. Do not include identifiable patient information, confidential placement information or unnecessary sensitive personal information. NextGEN Student does not sell AI conversations.
ResearchLens works the same way: the PDF you upload and a short instruction are sent through Lovable’s AI service to an underlying model provider to generate the breakdown. The PDF itself is not stored by us afterwards. However, every breakdown generated is recorded, with the upload time, file name, file size and file fingerprint, so that we can investigate suspected misuse in academic assignments under our Terms & Conditions. We rely on our legitimate interests in protecting academic integrity and enforcing our terms. These records are visible only to authorised NextGEN Student administrators, cannot be edited or deleted by you, and may be shared with the relevant university or professional body where misuse is confirmed. Deleting a breakdown from your saved list does not remove this record.
AI technology and providers may change. We will update this policy when a material change affects how personal information is processed.
5. Service providers
We use service providers only where needed to operate the platform. These currently include Lovable Cloud for account, database and application infrastructure; Stripe for checkout, recurring billing and payment management; Lovable’s AI service and its underlying model provider for AI Mentor responses; and Resend for study tip emails. A provider may act as our processor or as an independent controller for parts of its service.
Study tips and trial guidance emails are sent only if you opt in, either at sign-up or on your Membership page. We use your name, email address, study level and sign-up date to send a short series during your free trial and a weekly tips email afterwards. We record when you consented and which emails we sent. You can unsubscribe at any time using the link in every email or on your Membership page, and we stop straight away. Emails also stop if you cancel your membership or an email to you bounces.
6. International transfers
Some providers may process information outside the United Kingdom. Where UK data protection law requires it, we use an applicable adequacy regulation or contractual safeguards and supplementary measures. You may request information about material safeguards through the Contact us form.
7. Retention
We keep personal information only while reasonably needed for the purpose collected and for legal, accounting, fraud-prevention, security and dispute requirements. Account and learning information may be kept while your account is active; AI conversations until you delete them, close your account or they are no longer needed; ResearchLens breakdowns you save to your list until you delete them or close your account; ResearchLens usage records for the duration of your account and 24 months after it closes, to allow academic-integrity concerns raised after an assessment to be investigated; contact messages until resolved and no longer required; and payment records for applicable legal and accounting periods. We then delete or anonymise information where reasonably practicable.
8. Your rights
Depending on the circumstances, UK data protection law may give you rights to access, correct, erase, restrict or object to processing, receive portable data, withdraw consent and challenge certain automated decisions. Use the Contact us form to make a request. We may need to verify your identity.
The AI Mentor does not make decisions intended to have legal or similarly significant effects, and does not determine admission, employment, registration, grades, clinical competence or access to healthcare.
Fraud prevention for refer a friend
To stop the refer-a-friend scheme being misused, we record a one-way scrambled (hashed) version of your email address and the IP address you signed up from, and the card fingerprint Stripe provides for your payment card (not your card number). We use these only to check whether an account, card or network has been used before, on the basis of our legitimate interest in preventing fraud. The email record is kept after an account is deleted so the same address cannot claim a new free trial or reward.
9. Security and children
We use reasonable technical and organisational safeguards, but no online service can guarantee absolute security. Protect your password and report suspected account misuse. The service is intended for people aged 16 or over. If you believe someone under 16 has created an account, please contact us.
10. Complaints
Please use the Contact us form first so we can investigate. You may also complain to the UK Information Commissioner’s Office at ico.org.uk.
11. Cookies and similar technologies
NextGEN Student uses strictly necessary cookies and browser storage for sign-in, account security, session management, payment flow and essential settings. These are required for the service and do not require consent where a legal exemption applies.
We do not currently activate non-essential analytics, advertising or marketing cookies. There is therefore no non-essential cookie preference control. If this changes, we will update this notice and provide consent choices before those technologies are activated where required.
12. Changes
We may update this policy when our service, providers or legal duties change. The latest version and date will appear here, and we will provide appropriate notice of material changes where required.