ZYS Training Solutions · Terms of use

Privacy and your data

Last updated 3 November 2026. This notice explains what information ZYS uses, why, who helps us process it, how long we keep it and your rights. Some features described here are still being introduced; what is available is shown in the app.

Who manages your information?

ZYS Training Solutions is the trading name of Dr Rashid Suleman, a sole trader based in England. He decides how your information is used, so he is the "controller" under UK data protection law (the UK GDPR and the Data Protection Act 2018). There is no separate data protection officer. Contact support@zysacademy.com about your information, access, corrections or deletion; our postal address is available on request.

ZYS is for adults aged 18 or over. We do not knowingly collect information from anyone younger.

Why we use your information (lawful bases)

Your dashboard is personalised automatically, but this never makes decisions with legal or similarly significant effects on you. We do not sell your information or use it for advertising.

What we use and why

We use your verified email, account identifier and name to sign you in, review your access request and keep your practice record separate from other candidates. We store your attempts, self or partner ratings, viva ratings and reflections to provide the practice service you request. Administrators can see requests and make access and content-review decisions. These activities support delivery of the service; security controls and administrative audit records protect the service and its users.

Improving the learning experience

We record structured activity such as learning-area visits, PACES case starts, completions and departures, and the success or failure of selected learning services. Case activity includes the case identifier and content version so we can investigate the right material. We use this to find usability problems, prioritise content review and check improvements. Activity records do not contain your email, IP address, typed notes, search terms, prompts, conversation text or audio. A daily account pseudonym supports daily counts and recording limits; it is not a persistent learning profile. Raw activity is deleted after 30 days; aggregate daily quality summaries are kept for up to 400 days. Authorised reviewers can record actions against these summaries. Browser recording is best-effort, so counts may be incomplete and are not assessments of clinical competence. Existing progress records, help reports and consented transcripts have their own purposes and retention rules below. Raw reports and conversations never become AI instructions automatically.

Free question sample

You can try a small sample of questions at zysacademy.com/try without an account. The sample is intended for adults, and it does not ask for your name, email or payment details. Your answers stay in the page in your browser. They are not sent to ZYS or saved, and they are lost when you reload or close the page. ZYS sets no cookies, uses no browser storage and adds no analytics on the sample. If you are already signed in to ZYS in the same browser, your browser may send your sign-in cookie with these requests; the sample does not use it.

Requests for the sample go through Cloudflare, which hosts the website. A request can show which question was opened, because the question’s reference is part of the web address used to fetch its answer. Technical logs are held by Cloudflare under its settings. Links to outside sources open those sites, which handle your visit under their own policies. If you go on to other ZYS pages, the rest of this notice applies.

Who processes your information for us

These providers handle information only on our instructions, under their data processing terms. The AI providers' business terms do not allow them to train their models on the information we send.

Several of these providers are based in the United States or process information there. Where information leaves the UK, it is protected by the UK–US data bridge for certified providers, or by the UK International Data Transfer Addendum to standard contractual clauses. Ask us for the safeguard that applies to any provider.

Help and support messages

If you send a message from the help button, our email delivery provider sends it to support@zysacademy.com with your verified sign-in email so the team can reply. General messages do not include a question reference or require a problem category. Problem reports include your selected category and bounded page, question and version references. The website does not store message bodies. It stores one-way rate-limit keys and hashed delivery receipts to prevent duplicate sends; receipts are scheduled for deletion after 30 days. Do not include identifiable patient information.

Private notes and question comments

Personal notes and their tags, originals and revision history are private to your account. If you request AI organisation, your note paragraphs are sent to the AI provider to suggest a title, tags and paragraph order. No clinical correction is added automatically, and accepting a suggestion stores a new revision while retaining the original. Question comments are private to their author and the authorised review team. They record the exam part, question identifier and content version, comment, review status, replies and dated review history. Resolving a comment does not edit or approve teaching content.

Plan enquiries and payments

If you submit a group, student, supported-access or upcoming-pathway enquiry, we store your account email, enquiry type, pathway, group size, message and submission time so the team can review and respond. Do not include sensitive personal information. Enquiries remain until manually deleted under the pilot retention arrangements below; submitting one does not subscribe you to marketing.

Payment testing is restricted to administrators, and sandbox purchases do not grant learning memberships. Where membership checkout is enabled, Stripe receives your verified email, an opaque account identifier and selected exam, tier and product information, and handles payment details on its hosted pages. ZYS stores purchase and provider identifiers, discount details and their end dates, verified membership periods, renewal and cancellation dates, the date you asked for access to start straight away (with the version of the wording you agreed to), a record of which billing emails were sent, and limited payment-event records. No card details are stored by ZYS. Learning access is granted only after provider verification of the selected paid or fully discounted membership. Voice credit controls are separate; pack purchases remain disabled until prices are approved.

Dictation

Text boxes for notes, comments, feedback and messages have a Dictate button. When you use it, your browser records what you say and sends the recording to ZYS, which passes it to OpenAI to turn into text and returns the text to the box. ZYS does not store the recording or keep a copy of the text it returns; what you then save is handled like anything else you type. To apply the daily allowance (30 minutes for learners, shared by dictation and the Listen guide), we record how many seconds you dictate each day using a one-way account code, not your email; these counts are deleted after 35 days. Please do not dictate anything that could identify a patient.

Listening and hands-free answers

Questions, explanations and chapters can be read aloud by your device’s built-in voice; nothing is sent to ZYS to do this. In a hands-free session you can choose to answer by speaking. Your browser’s own speech service turns what you say into text (in Chrome and Edge this is a Google service; in Safari, Apple’s). ZYS receives only the recognised words, uses them to choose your answer option and does not record or store your voice or the words. Your answers are then saved exactly as if you had tapped them. You can answer by tapping instead. Listening settings are kept only on your device.

Voice practice and moderation

When you start voice practice, microphone audio and the fictional case context are sent directly to Google’s AI service. ZYS does not store raw audio. Before starting, you agree to save the conversation transcript and AI feedback privately for moderation and service improvement. Authorised moderators can review these records, record issues and create generic, deidentified improvements for future AI responses. Transcripts may be incomplete or inaccurate; interrupted captures are flagged.

Your saved conversations include the case, role, selected UK nation, dates and prompt/source/guidance versions. They are kept for up to 90 days and removed by daily cleanup. You can view, report or delete them in Voice history. Deletion also removes associated moderation records; a short usage reservation remains for 24 hours to enforce limits. Your separately saved personal reflection remains in Progress. Do not include real patient details. Voice uses a billing-enabled project.

Optional learning chat

Your questions, selected UK nation, follow-up links and source-backed answers form a private history for your account. When dual checking is enabled, Google drafts your answer and Anthropic and OpenAI separately receive the same draft, question and checked source excerpts to check it. Both checks must pass before automatic release. In the earlier single-provider configuration, Google performs drafting and checking. Generic published improvement guidance and at most one previous exchange may be included for a follow-up. ZYS does not send your account email to the model. Answers can be released after automated evidence checks without individual administrator approval; they remain labelled AI-generated. You can report an answer you consider wrong. Questions outside our checked resources are flagged for moderators to improve the collection.

Authorised moderators can see submissions, generated drafts, reports and transcripts. Chat questions, answers and associated report/audit content are kept for up to 180 days. You can export your visible conversations, delete individual exchanges or delete all chat history. The history holds up to 200 exchanges and shows warnings during the final 14 days before expiry and when storage is nearly full. Answers you explicitly save to personal notes are separate copies: chat expiry or history deletion does not delete those notes. Learning access is required to read retained notes and chat; the chat retention period continues while access is locked. Short spending records with your opaque account identifier remain for 35 days to enforce limits. No chat history is stored in browser local storage. Obvious identifiers are screened, but screening cannot detect all personal information.

Speaking in learning chat

Where enabled, you can agree to use your browser speech service (Google or Apple, depending on your browser) to recognise spoken questions. Audio is processed by that service; ZYS does not receive or store the raw audio. Check the recognised words, especially drug names, doses and units, before pressing Ask question. Confirmed questions are saved in your private learning-chat history under the 180-day policy above. Your device can read the exact checked answer aloud; ZYS does not send it to a separate speech-generation provider. Microphone capture and playback stop when you close chat or hide the tab. Browser support and pronunciation vary. Typed questions and visible answers remain available.

Improving AI responses

Moderators may publish versioned, deidentified guidance and examples supported by current UK sources for use in future chat and voice prompts. Raw reports and transcripts are not automatically used as agent instructions or submitted for model training. This is prompt improvement, not model fine-tuning. Source registers and published guidance remain for editorial accountability. Provider and backup retention may differ; contact us about deletion from those systems.

Progress and comparison with other learners

Your Progress page compares your first-attempt accuracy with other learners on the same exam. Once a day we pool learners’ first-attempt results into an anonymised summary for each exam, keyed by a one-way account code rather than your email or name. Other learners see only percentile bands (for example “Upper half”) and an overall average, never your name, email, answers or individual scores. Staff accounts are left out. The same summary gives reviewers per-question figures (how many learners answered a question first time and how many got it right) to improve questions and calibrate difficulty. If you set an exam date, weekly target or turn on the weekly progress email, we store those choices with your account; the weekly email contains figures only, never question content, and you can turn it off on your Progress page. Hands-free listening time is stored as minutes per day.

Site usage figures

To see how the site is used, we count loads of a few named pages per day, and record that an account was signed in on a given day using a one-way account code rather than your email. No IP address, cookie, browser or location details are stored for this. Administrators see only totals and site-wide practice figures (for example how many stations were completed), not individual reflections. These counts are removed after about 13 months.

Protecting the question bank

To stop the question bank being copied, we count how many answers each account opens per hour and per day, and record which answers it opened over the last two days, using the same one-way account code, not your email. These counts and records are deleted after two days. There is a generous hourly and daily limit. If an account opens answers much faster than normal study, we email the owner; if it opens at least 80% of an exam's answers, and at least 300 of them, within 24 hours, the account is paused until we have checked. Answering a question counts as opening its answer. The account's email, the day and the numbers are kept with these alerts for 12 months, and a pause, restore or extra device allowance is also recorded in the account's audit history, which is kept with the account. Staff accounts are not counted.

To apply the two-device limit, we store a random device code in an essential cookie on each browser you sign in with, together with a short description of the device (for example "iPhone · Safari") and when it was first and last used. These records are kept for 12 months after a device was last used.

Learning pages also carry an invisible pattern that encodes a short code derived from your account, so that if a screenshot of ZYS content is shared, staff can find which account it came from. The code is a one-way value and contains no personal information; staff pages carry no pattern.

Voice allowance and credit records track reserved connection time and beta provider-cost usage separately from learning membership. These records support balance checks, cost limits and audited administrator adjustments.

Storage and retention

Secure essential cookies maintain your sign-in. We use no advertising or analytics cookies, so we do not ask for cookie consent; if that changes, we will ask before setting any non-essential cookie. An account-specific device copy helps recover unsynced practice; use your own device and sign out afterwards. The app retains up to 500 PACES attempts, 200 progress notes and up to 1,000 written-question answer records per account, retaining the latest answer for different questions before older repeats. Written records include the examination, question ID and version, selected answer, correctness, date and session identifier. They support previous-attempt filters, topic recommendations and session summaries. Access to saved learning records follows your active demo, beta or subscription to the selected exam part. Essential includes core saved notes and results; Premium adds deeper support. Your registration remains indefinitely, while learning access expires with its period. Expired results, notes and reflections are retained but locked until you subscribe to that exam part. Quickfire stores the question identifier/version, selected option, correctness and answer time in a separate private record; these answers do not contribute to written exam scores. Its history and incorrect-answer revision follow the same exam access and retention rules. Written history can be deleted from the session builder. The separate personal-note service supports up to 1,000 notes per exam part with original and revision history. If you choose to discuss a saved session with the AI coach, a limited summary of that session’s results and current released topics is sent through the learning chat; your email and full answer history are not sent to the model. We keep your account and learning records while your account is open, and delete them 24 months after your last membership ends, unless you ask us to delete them sooner. Payment and tax records are kept for six years, as tax law requires. Pooled statistics that no longer identify you may be kept longer. Until automatic deletion is built, deletions are carried out manually.

Your rights

You can ask us to give you a copy of your information; correct information that is wrong; delete your information; restrict or object to how we use it, including the pooled comparisons; send your information to you or another provider in a usable format; and stop using information we hold with your consent. You can also choose email sign-in instead of Google and decline voice practice. Email support@zysacademy.com. We reply within one month, and there is normally no charge.

Complaints

Please contact us first. If you are unhappy with our reply, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this notice

We will post any change here with a new date. If a change affects how we use your information in a significant way, we will email you first.