Privacy policy
Last updated 20 August 2026
This explains what personal data NMCMATE collects, why, who else sees it, and what you can do about it.
NMCMATE is operated by Code Kubic Solutions (Company No. 2663998-P), a company registered in Malaysia, which is the data controller for your personal data. Write to us at hello@nmcmate.com about anything on this page.
What we collect
Because you gave it to us. Your name and email address, and a hash of your password. If you sign in with Google, we receive your name, email address and Google account identifier rather than a password. Your nursing field of practice and your exam date, if you tell us. Anything you write to us.
Because you used the service. Your answers, marks, flags, notes, reading position and progress. Which questions you have unlocked, so the free daily allowance can be counted and so revision of what you have already seen is never rationed. Your mock attempts and their results. Your OSCE transcripts and marking reports.
Because your browser sent it. IP address, browser and device type, timestamps and pages requested, in ordinary server logs, kept for security and debugging.
Because you paid us. The fact and amount of a payment, what it bought, and the last four digits and expiry of the card. We never see or store your full card number — that goes directly to Stripe.
We do not ask for and do not want clinical information about you or anyone else. Please do not put it into a question report, a note or an OSCE attempt.
Why we use it, and our lawful basis
- To run your account, provide what you bought and keep your progress: performance of our contract with you.
- To send service email such as verification, receipts and account notices: performance of our contract. You cannot opt out of these while you have an account, because they are how the service works.
- To keep the site secure, prevent fraud and account sharing, and debug faults: our legitimate interests in running a service that works and is not abused.
- To improve our questions using aggregate performance, for example spotting an item everybody gets wrong: our legitimate interests in the material being good. This works on aggregates, not on singling you out.
- To send marketing email: your consent, asked for separately and withdrawable at any time from the unsubscribe link in any such email.
- To run analytics: your consent, given through the cookie banner and withdrawable at any time.
- To meet our accounting, tax and legal obligations: legal obligation.
We do not sell your personal data, and we do not use it to train machine learning models.
Who else processes it
We use a small number of providers, each receiving only what it needs:
| Provider | What for | Where |
|---|---|---|
| Stripe | Taking payment | EU / US |
| Neon | Hosting the database | EU |
| Cloudflare | Hosting and serving the site | Global edge |
| Brevo | Sending service email | EU |
| Amazon Web Services (S3) | Storing question images | EU |
| Google (Sign-In) | Signing you in, if you choose that | US |
| Google (Gemini) | Running the OSCE simulator | US |
| Google (Analytics) | Aggregate usage statistics, only if you consent | US |
The OSCE simulator, specifically
This one deserves saying plainly rather than leaving in a table. When you take an OSCE attempt, what you type is sent to Google's Gemini API, along with the scenario, so the model can play the patient and mark your performance. Your name and email are not sent with it.
We use Google's paid API tier, on which Google states that submitted content is not used to train its models. We chose the paid tier for that reason, and we would not run this feature on a tier that did.
If you would rather nothing you write went to a third-party model, do not use the OSCE simulator. Everything else on the site works without it.
Cookies
We use two kinds of cookie, and the banner on your first visit asks about the second.
Essential cookies are always on. They keep you signed in, remember your theme and your cookie choice, and protect the session. The site cannot work without them, so there is no way to turn them off and still use it.
Analytics cookies power Google Analytics 4, and are off unless you turn them on. Until you accept, the Google Analytics script is not loaded at all. They tell us which pages people visit and where they give up, in aggregate. To change your mind, clear the cookie for this site and the banner will ask again.
You can also block or delete cookies in your browser. Blocking the essential ones will break signing in.
International transfers
We are based in Malaysia and some of our providers are in the United States, so your data is transferred outside the United Kingdom and the European Economic Area. Where that happens we rely on the receiving provider's standard contractual clauses or an equivalent approved safeguard. Ask us at hello@nmcmate.com if you want the detail for a specific provider.
How long we keep it
Your account data is kept while your account exists. Ask us to delete it and we will, except for records we are required to keep: payment and invoice records are retained for six years for tax and accounting purposes, and those are kept whatever else is deleted.
Server logs are kept for a short period for security and then discarded. An account left dormant with no access and no activity for three years is deleted.
Your rights
Under UK and EU data protection law you may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to you in a portable format. Where we rely on consent you may withdraw it at any time, which does not affect what we did before you withdrew it.
Write to hello@nmcmate.com. We will answer within one month. We will not charge you, and we will not treat you worse for asking.
If you think we have got this wrong, you can complain to the UK Information Commissioner's Office at ico.org.uk, or to the supervisory authority where you live. We would rather you told us first so we can fix it.
Security
Passwords are stored hashed, never in plain text. Traffic is encrypted in transit. Access to production data is limited to those who need it. No system is perfectly secure, but if a breach affects your rights we will tell the relevant regulator, and you, as the law requires.
Changes
If we change this policy materially we will say so by email or on the site. The current version always lives here.
NMCMATE is operated by Code Kubic Solutions (Company No. 2663998-P), a company registered in Malaysia. Contact us at hello@nmcmate.com.
NMCMATE is an independent preparation service. It is not affiliated with, endorsed by or connected to the Nursing and Midwifery Council.