Privacy policy

Clodia is a study platform for healthcare professionals preparing for the Occupational English Test (OET). The service is operated by Robins Adventures, a trading name of Robin Jose, a sole trader established in the United Kingdom at 5 Fern Street, Keighley, West Yorkshire, BD21 3AZ. Contact: hello@clodia.app.

We are the data controller for personal data you provide to us. Some processing is performed by third parties acting as data processors on our behalf, listed below.

Account data

• Your email address and display name (via Clerk, our authentication provider)
• If you choose "Continue with Google": Google tells Clerk your name, email address and profile picture so you can sign in without a password. We don't get your Google password or anything else from your Google account.
• Your chosen profession (e.g. nursing, medicine), region, and OET test date
• Self-reported current OET scores, and how many times you've sat OET before
• Where you came from when you signed up: the ad, campaign, partner or website whose link brought you to Clodia, and the first page you opened. If you accepted cookies this comes from a cookie; if you chose “Essential only”, nothing is stored on your device and it travels in the link to the sign-up form instead. Whichever you chose, it is also saved with your sign-up details. We use it only to see which ads and links bring people to Clodia, never to show you ads, and we don't pass it to ad platforms. It is deleted with your account.
• Google Ads measurement, only if you accept cookies: Google's tag sets _gcl_* cookies (such as _gcl_au, plus _gcl_aw holding the ad click if you came from one of our Google ads; kept up to 90 days), reports which Clodia page you are on (the page address without anything after the “?” except Google's own ad-click id) and, when you finish creating your account, tells Google that a sign-up happened so it can match it to the ad click; when you buy a plan, it likewise tells Google a purchase happened, with the payment page's reference number and the amount paid only (no card or personal details). Google may also set its own cookies on its domains. We send no name, email, answers, scores or campaign tags, we turn off ad personalisation, and it is never used to show you ads elsewhere. Lawful basis: consent; choose “Essential only”, or “Analytics only” under Details in the cookie banner, or change it under Cookie settings, and the tag stops and its cookies are removed.
• How you found Clodia, if you choose to answer that optional question when you sign up (for example ChatGPT, Google or a friend). We use it only to see which places bring people to Clodia. It is deleted with your account.
• Your first language, if you choose to answer that optional question (we ask once, after your first test; you can tap “Prefer not to say”). We use it to understand which language groups use Clodia, so we can shape the course and decide where to reach new students, and so Ask Clodia can explain mistakes that are common for speakers of your language. For that, Ask Clodia's AI service (Anthropic, listed below) sees it along with your scores, as it already does for the rest of your practice. We never ask your nationality or ethnic origin, and we don't share your answer with anyone else. It is included in your data download and deleted with your account.
• Which free guides you downloaded and when, so we can see which guides are useful. It is deleted with your account.
• If you activate a Clodia practice book: which book, when you activated it and when its online extras end, so its tasks and free markings open for you. We don't store the code or the word you typed. It is deleted with your account.

Practice data

• Answers you submit to Reading, Listening, Writing, and Speaking tests
• Transcripts of Speaking role-plays (text or voice-derived). In voice mode your microphone audio is streamed live to OpenAI to produce the patient's voice and the transcript; we store the transcript. We keep a recording of your voice only if you tick the recording option before a role-play. It is stored privately in Vercel's file storage (see below), only you can play it, it is kept for 90 days after the role-play and then removed automatically (your transcript and marking are kept), you can download it to keep your own copy, and you can delete any recording from its attempt page sooner.
• If you switch on “Video call” for a role-play, your camera is shown back to you in a small box on your own screen. The picture stays on your device: it is never recorded, stored or sent to us or anyone else, and the camera turns off when the role-play ends. The face in that view is an AI-made video, not a real person (the patient in practice, the interlocutor in exam mode).
• Letter text you write in the Writing sub-test, including the text read from photographs of handwritten letters you choose to upload (the photographs themselves are read and then discarded, not stored)
• Messages you send in the Ask Clodia chat
• Your computed scores and predicted bands
• Which celebration messages you have already been shown (for example your first Grade B), so they are not shown twice. Deleted with your account.
• Real OET results you choose to add: exam date, grades and scores, whether you passed, roughly how much you practised, any comments and your OET exam reference. We use them to make Clodia's score predictions more accurate. If our prediction was far off, our AI supplier may be asked, without your name, to suggest why; only Clodia's own team sees that note. We may use a result anonymously in marketing (pass rates, never your name or photo) unless you untick the box for that when you add it, and you can change it.

Free checks before you sign up

You can take a free sample test or the score check without giving us anything. We keep a record of your check only if you accepted cookies or enter your email: then we record how far you got and your score, the campaign or site that brought you here (only if you accepted cookies), and the IP address of your connection, which we use to limit how many checks one connection can start in an hour and delete after 30 days. In that case a cookie (clodia_lead, set by Clodia only, kept for 90 days) keeps your check together and, if you then sign up, links it to your new account. It is not used for analytics or advertising. If you enter your email, we email you your result once. We send occasional OET study tips (via Brevo) only if you also tick the box for them; every tips email has an unsubscribe link. Deleting your account deletes these records. If you never make an account, we remove your email address from the record 12 months after the check (if you asked for study tips, 12 months after the check or when you unsubscribe, whichever is later), or within a day of you unsubscribing, and keep only the anonymous score and campaign for our counts. Records of the emails we sent you go 12 months after they were sent. Study tips you asked for keep coming until you unsubscribe.

The Clodia chat on our public pages

Questions you type into the chat on our public pages are sent to our AI supplier (Anthropic, listed below) to write the answer, with the quick answers you tapped (exam, profession, the part you want help with, when your exam is, and the quick check-up: whether you sat the exam before, your last grade per part and the grade you need). We don't store the conversation or your check-up grades. Please don't type personal or patient details. If you ask the chat to email you free practice tests, we keep your email address, those tapped answers, the campaign that brought you here (only if you accepted cookies) and your connection's IP address (to limit requests, deleted after 30 days), and email you the tests once. Exam updates, study tips and offers follow only if you also tick that box; every such email has an unsubscribe link. These records are kept and removed exactly as for the free checks above. The chat remembers what you told it, and that you closed it, only for your visit (in your browser's session storage, gone when you close the tab). If you tap the chat's button to create an account, your profession, whether you sat the exam before, the part you found weakest and whether your test is booked are passed to the sign-up questions in that same tab, already filled in, so you can check or change them before you save. If you use "Message the team" in the chat, your question and email address are sent to our support inbox so we can reply. Like messages sent through our contact form or by email, we keep them with our replies so we can see the conversation if you write again, and delete them when you delete your account or ask us to (email hello@clodia.app). We also count, without any cookie and without knowing who you are, how often the chat is shown, opened and used, which of two versions of the chat you saw, and the general topic of each typed question (for example "price" or "writing"), never the words.

Free guides by email

If you ask for a free guide by email on a guide page, we keep your email address, which guide you asked for, the campaign that brought you here (only if you accepted cookies) and your connection's IP address (to limit requests, deleted after 30 days), and email you a download link once. The link works for 7 days. Exam updates, study tips and offers follow only if you also tick that box; every such email has an unsubscribe link. These records are kept and removed exactly as for the free checks above.

Your free sample test result is also kept in your own browser for 3 days (see "Your free test result" below), so we can show it to you again if you start a free trial on the same device. If you typed your email to see the answers, that browser tab keeps it until you sign up, to fill in the sign-up form for you. Neither is sent to us by this.

Technical data

• Approximate location: the country worked out from your IP address. We keep the country with your account to show prices in your currency and to understand where students come from.
• Browser type, operating system, device class
• Which Reading and Listening tests you open each day, and how many you hand in almost blank, so we can keep the daily fair-use limit and spot an account being used to copy our tests (lawful basis: legitimate interests in protecting our material). Reading passages carry an invisible mark made from your account id, so copied text can be traced back to the account that opened it.
• Device limits: a student login can be used on one phone or tablet and one computer at a time, and an institute staff login on one device. To check this we read the list of your active sign-ins that Clerk already keeps (whether each is on a phone, and when it started). Because many tablets look like computers to that list, each device sets a small essential cookie (clodia_touch) saying whether it is a touch device, and we keep the ids of those sign-ins on your account while they are active. Nothing else is stored about your devices. To spot a login being shared, we also note which countries (worked out from the IP address of each active sign-in, no city or IP address kept) your login is used from each day, and the Clodia team is told if one login is used from two countries on the same day. These notes are deleted after 30 days.
• A count of visits that arrive from an ad or campaign link, and of the steps those visits take next (opened inside the Facebook or Instagram app, started or finished a free test, opened or sent the sign-up form, moved to their phone's own browser, came back to the code step after the page reloaded): just the page, the step, the campaign tags in the link and the day, added to a running total. Nothing about you or your device is stored with it, so it is not personal data and needs no cookie. To skip repeat visits, your connection's address is held in server memory for up to 30 minutes and is never saved.
• Your free test result, kept only in your own browser: if you take a free Reading or Listening test, your score and the questions with their answers and reasons stay on your device for 3 days, so you can see them again after you sign up. They are not sent to us. The one exception: if you tap "Open in Chrome" or "Copy link" on the sign-up form inside the Facebook or Instagram app, your score (not the questions or your answers) goes in that link so your other browser can show it. The page removes it from the address as soon as it opens, and it is never saved with your account or linked to you.
• Pages visited and features used (via PostHog analytics, see below). When you are signed in, your account email and name are attached so your visits are linked to your account rather than counted as a new visitor.
• Error reports if something crashes (via Sentry).
• Screen recordings, only if you accept analytics cookies (via PostHog): on the home, pricing, free plan, sign-up, welcome (onboarding and first step), study plan and dashboard pages, the blog and the lists of practice tests, we record the layout of the page, where you tap and how far you scroll, so we can see where people get stuck. Everything you type and all the text on the screen is hidden before it leaves your device, so a recording never shows what you wrote or read. Tests, role-plays, your letters, Ask Clodia, your account and payment pages are never recorded. Recordings are deleted after 30 days.
• If you turn on notifications: the delivery address your browser gives us for that device (it points at your browser maker's push service: Google, Apple, Mozilla or Microsoft), your time zone and your reminder choices. We use it only for study reminders, your test countdown, "feedback ready" notes and a weekly summary, never for offers. Turning notifications off removes that device's address.
• Group mocks (a test everyone sits on the same day): if you tap “Count me in”, we keep that choice and send the reminders you asked for, by email and, if you turned them on, notifications, until you tap “I can't make it”. The group results show only totals: how many took part, the average score, how many each person beat and which questions were missed most. No one sees another person's name or score, and the group results stay hidden when fewer than 3 people took part.
• Practice reminder emails: if you haven't turned on notifications, we may email you a weekly summary of your own practice and one reminder after a few quiet days; with “Email me my plan each day” (on for accounts made from 6 November 2026, and you can untick it), a daily email with your plan and your estimated scores instead. If you haven't booked your test yet, we also email a short check-in 2 weeks and 1 week before the date in your study plan, and one the day after it. They are about your own study, never offers, and each has a one-click link to stop them (also in Account settings). We keep only your on/off choices. The morning Clodia Coach email and these reminders can show charts of your own scores and practice days; the pictures are drawn by clodia.app from numbers in the picture link only, never your name, email or account id. On a day you practise, the evening Clodia Coach email (about 7pm your time, at most one a day) sums up what you did and suggests tomorrow's step; it is written from your results only, never your name or email, and the same one-click link stops it. We keep each Clodia Coach note written for you with your account, so the coach can follow up on its own advice and we can see which advice helps; they are deleted with your account. If you tap “Add Clodia to my contacts” we note the time, only so we stop showing that box; the contact card you get holds only Clodia's own details. About half an hour after you finish practising we email your result, at most twice a day. When you open a Reading or Listening test or a letter (not inside a mock) we note which one and when, so we can send one reminder about 2 hours later if you didn't finish; we keep that note for 14 days, it is in your data download and deleted with your account. On evenings with no Clodia Coach email we may send the Question of the day, the same one as in Clodia Circle; if you can use Circle it links there, and the Clodia Coach email may show the same question in a small box. If you agreed to offer emails, after your free practice day we may also send an evening email with your progress and the plans: daily for the first week, then twice a week to day 30 and weekly to day 90, from a separate sending address, each with a one-click unsubscribe. One student in ten never gets that email, so we can check it really helps. If you haven't clicked any Clodia email or practised for 30 days, we send at most one email a week.
• Which help and offers suit you: each night, while you are on a free trial or a plan, Clodia sorts your account into a group (for example “likely to pay”, “needs a nudge” or “close to using up a plan”) from your own practice, scores, test date, free day, whether you left a payment page and whether you agreed to offer emails. Our AI supplier sees those facts, never your name or email. Only Clodia's team sees the group; it helps us choose which practice tips and which single offer to show or send, and it never changes your price, your access or what you can do. Offers still go by email only if you agreed to them. We keep each night's group with your account so we can check the groups were right; they are in your data download and deleted with your account (lawful basis: legitimate interests in helping students who practise with us and in running Clodia; you can object by emailing us, and we will stop sorting your account).
• Your answers to our feedback questions: if you answer a feedback email, tap an answer to “What's stopping you from starting a plan?” on screen, or rate a test or practice item after you finish it (the stars, any reasons you tap, the questions you say look wrong), and anything you type in those boxes, we keep it with your account so we can improve Clodia and plans (lawful basis: legitimate interests). Answering is always optional, and a new tap replaces your earlier one.
• Clodia Circle, the students' community inside Clodia, if you join it: what you post and reply, your likes, reports and blocks, your Circle settings (including “Alert me when someone wants a roleplay”, when you chose it, and when we last sent one; the alert is a phone notification at most once a day, never 22:00 to 08:00 your time and never while you have a test open in the last hour), the roleplay times you offer, when you switch on “Free now”, and any backup Google Meet or WhatsApp link you paste for a roleplay. While you show as free, Clodia notes when you were last active in the app and whether you are in a test or AI role-play, so nobody rings you mid-test and you stop showing as free after 10 minutes away; we keep only the latest time, never which page you were on. Other students see your first name, your profession, your posts and your practice streak; your exam date and best grades show only if you switch them on. A pasted link is shown only to the one student you practise with, after they say yes, and is deleted a day after the call. Roleplay calls: the call runs between your phone and the other student's, always passed through Cloudflare's relay, so the other student never sees your internet address. The sound and video are encrypted between the two phones; Clodia never sees, hears or records a call, and Cloudflare only passes it on. To connect the call, your phone sends connection details (which include internet addresses) through Clodia; we delete them 3 hours after the call. We keep a short record of each call (who, when, whether it connected, and the round timer) to run Circle and count it in our own figures. If you play the patient, the check card you fill in (Yes / Partly / No and one tip) is shown to your partner and kept with their roleplay. Your private call notes stay on your own phone. If a call partner reports you, we keep the report; reports from two different call partners pause Circle for you, and that pause, the call reports and whether you have used the free live-call taster are kept against a one-way code made from your email (not your email itself), even after you delete your account, so they apply again if you sign up again (lawful basis: our legitimate interest in keeping Circle safe and fair). If you answer one of Clodia's polls, we keep your answer so you can change it until the poll closes; other students only see the share of votes for each answer (from 3 votes), never who picked what, and your answer is in your data download and deleted with your account. If you add a test to a post, other students see the test's name and the question number you picked, never your answers or your score, and students who took the same test see your post near the top of their feed. Our AI supplier reads your post to write Clodia's reply (for a test question, also that question and the answer you gave) and, now and then, to check a post has no patient details; it never sees your name or email, and it never sees calls. If Circle sees a post that might hold patient details or test material, it is hidden until Clodia's team looks at it. We email you at most once a day about unread replies, with a one-click link to stop. If you delete your account, your posts stay as “Former Clodia student” with nothing that names you, unless you tick “Delete my Circle posts too”; everything else in Circle is deleted except the safety record above (lawful basis: performing our contract with you; checking posts and keeping the safety record are our legitimate interest in keeping Circle safe).
• Roleplay Night, if you save a place: the night, when you saved or cancelled your place, whether you were on the waiting list, when you opened the night room and tapped “I'm here”, which page sent you, your partner that night (a call like any other Circle roleplay above, never recorded), and any free AI role-play you took that night with its mark (kept with your other Speaking results). Saving a place records that you are 18 or over and agree to the call rules, saves your phone's time zone if we don't have it (so times show in your own time and we never book you between midnight and 6am), and switches on “Alert me when someone wants a roleplay” unless you chose before; you can switch it off in Circle. We email you when you save a place, the day before and an hour before, with a phone notification 15 minutes before if notifications are on; these are about the night only, never offers. If you keep a place and don't come twice in 4 weeks, you can't book for 2 weeks: we keep that count for 4 weeks. The free AI role-play is limited to one a week per email address, so we keep it against a one-way code made from your email (not your email itself) for 8 weeks. Roleplay Night records are deleted 8 weeks after the night, or with your account (lawful basis: performing our contract with you; the limits are our legitimate interest in keeping the night fair).

We do not collect: your full name beyond your sign-up details, payment card data (entered on Stripe's checkout page; we never see your card number), or any clinical data about real patients. Practice content uses fictional cases only.

Under UK and EU GDPR, we process your data on the following bases:

• Contract: account data, practice data, and computed scores are necessary to provide the service you signed up for.
• Legitimate interests: analytics, error monitoring, and product improvement, balanced against your reasonable expectations.
• Legitimate interests (“soft opt-in”): when you create an account for a free trial or a plan, we may email you occasional OET study tips and offers about Clodia's own courses, unless you tick “Don't email me study tips and offers” when you sign up. Every one of these emails has a one-click unsubscribe, and you can switch them off in Account settings.
• Consent: other marketing emails (for example study tips after a free check without an account) and non-essential cookies. You can withdraw consent at any time; for cookies, use Cookie settings.
• Legal obligation: retention of financial records for tax purposes once you make a purchase.

We use the following third-party processors. Each has been chosen for their security and GDPR posture.

• Clerk : authentication and account management (United States)
• Google : only if you choose "Continue with Google" to sign in (United States)
• Cloudflare : the relay that carries Clodia Circle roleplay calls between two students' phones. It sees both phones' internet addresses and passes on the encrypted call; it cannot see or hear the call and nothing is recorded (global network)
• Neon : database hosting in AWS eu-west-2 (London)
• Vercel : application hosting. Pages are served from Vercel's global edge network; our server code runs in Vercel's London region (AWS eu-west-2), alongside the database. Voice recordings you choose to keep are stored in Vercel's private file storage (Vercel Blob) for our project.
• Anthropic : Claude AI scoring, the text-mode patient, the Ask Clodia chat, the “Your next step” note on your Home page (written each night from your practice counts, estimated scores and test date) and the Clodia chat on our public pages (United States; we do not include your name or email in prompts). Questions typed into the public-page chat are sent to Anthropic to write the answer and are not stored by Clodia
• OpenAI : voice mode for Speaking, and speaking a question to Ask Clodia or listening to her answers (United States). Your microphone audio is streamed to OpenAI in real time and transcribed; when you listen to an answer, its text is sent to OpenAI to be read aloud. Ask Clodia recordings and the spoken answers are not stored. Under the API terms none of this is used to train OpenAI's models.
• Stripe : payments and invoicing (United States, with EU/UK entities)
• Brevo : transactional + marketing emails (EU-based)
• Zoho Mail : our mailbox for hello@clodia.app: emails you send us and our replies are stored there (EU data centre)
• Cloudflare : receives emails sent to our @clodia.app addresses and passes them to our mailbox and our support inbox (global network)
• PostHog : product analytics and session replay, EU Cloud instance. Masked session replays may be reviewed by PostHog's automated analysis tools to find where people get stuck.
• Google : Google Ads conversion measurement, only if you accept cookies (United States; see “What we collect”)
• Sentry : error monitoring

Where a processor is outside the UK, transfers rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses in that processor's data processing agreement. We do not sell your personal data. Apart from the Google Ads measurement you can accept or refuse in the cookie banner, we do not share it with advertisers.

Your institute or tutor. If you link your account to a coaching centre or tutor (by ticking the box when you sign up from their link, or in Account settings → My institute), and only after you agree, their staff can see your name, email, profession, exam date, how many times you've sat OET, estimated scores, the practice you do, your marked work and any real OET results you add, plus short summaries Clodia writes from these (including Clodia Coach's latest review). Your name is not sent to our AI supplier for those summaries. You can leave at any time from Account settings, and they stop seeing anything straight away. We keep the date an institute first approved you, also after you leave, so that if you join it again its commission period doesn't start again (lawful basis: legitimate interests in paying institutes correctly). It is deleted with your account.

Feedback from your tutors. Your institute's managers and tutors can write their own feedback on your marked letters, role-plays and mocks. We keep it with the name of the person who wrote it, show it to you on that piece of work, and email you when there's new feedback (at most once a day for each piece of work). It stays yours if you leave the institute, is in your data download, and is deleted with your account (lawful basis: legitimate interests in the coaching you joined the institute for).

Course plans and mock days. Your institute can set weekly homework from a course plan and ask your batch to sit a full mock on a date. Its staff then see that mock's four scores and a "ready to book" verdict, and can print a report of it, which is part of the practice you agreed to share.

If your institute pays for your plan. We note on your account that your plan comes from your institute, and when you were added to and taken off its bill. Its managers see whether you are on their bill or pay for your own plan, and the number of students on it (not what you practise beyond what you agreed to share above). We email you when your plan starts, if it pauses because the institute's payment failed, when it comes back, and if the institute removes you. Its managers also see your name, and the dates you were on it, on the statement of each bill you were on, also after you leave. We don't send your details to Stripe for the institute's bill: Stripe sees only the number of students (lawful basis: contract with the institute, and legitimate interests in giving you the plan it pays for).

A referral partner who recommended Clodia. If you sign up through a referral partner's link or enter their code, we note that they referred you, and we tell you so when you sign up. That partner can see your first name and last initial, when you joined, whether you are on a paid plan or bought a one-off practice pack (paying, cancelled, stopped, refunded or bought a pack), when you last paid or are paid up until, and when their referral period for you ends. They never see your email, scores or practice. We do this to pay them their share and so they can see who took up their recommendation (lawful basis: legitimate interests). It only applies to people who sign up through a partner. You can object at any time by emailing hello@clodia.app, and they will then see you only as “A student”.

A friend who invited you. If you sign up through another student's invite link or enter their code, we note that they invited you, and we tell you so when you sign up. That student can see your first name and last initial, when you joined, and whether you are on a free trial or a paid plan. They never see your email, scores or practice. We do this so they know their invitation was taken up and to add their thank-you (lawful basis: legitimate interests). It only applies to people who sign up through a friend's invite. You can object at any time by emailing hello@clodia.app, and they will then see you only as “A friend”. Their invite link carries no cookie; the code is kept in your browser's tab storage only until you finish signing up.

If you are a referral partner, we keep your name, email, address, country, company details, VAT number and Wise email if you give them, how you would like to be paid, the payments we make to you, when you accepted the partner rules, when we invited you and last saw you on your partner page, and our own notes about the partnership. We use this to run our agreement with you and pay you (lawful basis: contract), and keep payment records for 6 years for HMRC. We do not store your bank account numbers in Clodia. The partner rules require you to keep the student details you see confidential and use them only to follow up your recommendation. We also record how often your link is opened (a count only; so that someone opening it again the same day counts once, we keep a one-way code made from their IP address with a secret key, which changes every day, can't be turned back into the address and is deleted after two days; no IP address is stored. Institute join links are counted the same way. Lawful basis: legitimate interests in counting opens fairly) and which share buttons you use on your partner page, with the time, to see which ways of sharing work. If you told us you were happy to hear from us, we may send a few reminder emails about your link after we invite you, and we record when they were sent. Once you accept the partner rules we also send a weekly and a monthly summary of your sign-ups and earnings, a short note the morning after someone signs up with your link or pays (never more than one of these emails a day), and, once a month, we count how many of your students pay to see whether you get free Pro, and email you when it starts or is about to end. The reminders stop when you reply, and every email has a “Stop these emails” link that stops them (the free Pro notices still come, as they are about your own account); we record when you use it.

If you are a manager or tutor at an institute that uses Clodia, we keep your name, email and role, when you were invited, joined or removed, when you last opened the institute dashboard, and whether you want the Monday email about your students (you can turn it off yourself). For the institute we also keep its contact email, the monthly commission statements we email to its managers and the payments we make to it. If the institute pays for its students' plans, Stripe (our payment provider) keeps its card or Direct Debit details, the institute's name, the billing address its managers add for its bills, and the email of the manager who set up payment, as its billing contact; we keep only Stripe's reference (and show the type and last four digits from Stripe), the agreed price, the bill's status and dates, the name, email and time of the manager who accepts the institute's agreement (with the text they accepted, kept as a record for as long as the money records below), a record of which students were on each bill and when (shown to its managers on each bill's statement), and we email its managers receipts, reminders and payment problems. We use this to run the institute's account, bill it and pay it (lawful basis: contract). Feedback you write on a student's work is shown to that student with your name; if your account is deleted, your name is taken off it. Staff must keep the student details they see confidential.

If we email you to ask for a chat about working together, we keep your email address, the first name we used, whether you are a tutor or an institute, why we could email you (you said we could get in touch, or it is your organisation's contact address), and a copy of each email we send you with when it went. We use this to send that email, at most two short follow-ups and at most three emails we write to you ourselves (all of which stop as soon as you reply or sign up, and never more than one a day), never to invite the same address twice by mistake, to see whether our emails were opened and how often you open the page linked from them, and to follow up if you reply (lawful basis: legitimate interests in finding tutors and institutes to work with). If you set up your partner link or institute from that page, we use the details you enter to do that. Every invitation has a “Don't contact me again” link. If you use it, or ask us at hello@clodia.app, we keep only your email address on a do-not-contact list so we never email you again. You can ask us to delete the rest at any time.

Account data is retained while your account is active. If you delete your account via the Account settings page, your personal data (profile, attempts, letters, speaking transcripts, Clodia chat messages) is removed immediately. Financial records (subscription history, Stripe customer references) are retained for 6 years from the last transaction as required by UK HMRC, but contain no personal identifiers after deletion.

The free trial is once per person. To make sure of that, when a trial starts we keep a one-way code made from your email address (the address itself cannot be read back from it) and a random code stored in a cookie on the browser you signed up with. We keep these after you delete your account, only to stop the trial being claimed again, under our legitimate interest in preventing misuse of the free trial. When you finish signing up we also make two more one-way codes: one from how your phone or computer is set up (screen size, graphics chip, time zone, number of processors and similar; nothing is stored on your device for this) and one from your internet address. A trial is refused only when both match an earlier trial, and both codes are deleted after 90 days. If you are refused a trial you never had, write to hello@clodia.app and we will sort it out. This check is skipped when you join through an institute or a referral partner.

Practice data (your scores, transcripts, letters) is retained for as long as your account exists, so you can track progress over months and years. You can export or delete this data via the Account settings page at any time. Both are self-serve.

Free checks taken without making an account: the IP address is deleted after 30 days, and the email address after 12 months (or within a day of unsubscribing; if you asked for study tips, we keep it while you still get them). Records of emails sent to an address with no account go after 12 months. What is left is anonymous.

Under UK and EU GDPR, you have the right to:

• Access the data we hold about you
• Correct inaccurate data
• Delete your account and associated data (right to be forgotten)
• Receive an export of your data in a portable format
• Object to processing based on legitimate interests
• Withdraw consent for marketing emails at any time (one-click unsubscribe)
• Complain to the UK Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, email hello@clodia.app or visit the Account page. We respond within 30 days.

We use a small number of essential cookies for authentication (set by Clerk), session management, making sure the free trial is used once per person, and telling a tablet from a computer for the device limit (clodia_touch). If you use Clodia's Android app from Google Play, an essential cookie (clodia_play_app, kept up to 30 days) tells our pages they are shown inside the app, so the app does not show plans or prices; it holds no personal data and is removed when you use Clodia in a normal browser. A referral partner's link also sets a cookie that remembers who referred you, only if you accept cookies. An institute's join link sets an essential cookie (clodia_institute_code) that carries its join code to your sign-up, so you can join the institute you chose. If you don't, and you then press to sign up, their code is carried to the sign-up form in that browser tab only, where you can see it and remove it. Analytics cookies (PostHog) and the Google Ads measurement cookies (_gcl_au, _gcl_aw) require your consent. See the cookie banner on your first visit. Emails we send through Brevo record whether they were delivered, opened and which link was clicked, so we can tell an email reached you and fix ones that don't work. The free checks set the clodia_lead cookie described above only if you accept cookies or enter your email. To change your choice at any time, use Cookie settings; if you then choose essential only, analytics and Google Ads measurement stop straight away.

The service is intended for adult healthcare professionals. We do not knowingly collect data from anyone under 16. If you believe we have, contact us and we will delete it.

We will email registered users about material changes. Minor wording changes will be reflected by the "last updated" date above.