Privacy policy

This explains what personal data NMCMATE collects, why, who else sees it, and what you can do about it.

NMCMATE is operated by Code Kubic Solutions (Company No. 2663998-P), a company registered in Malaysia, which is the data controller for your personal data. Write to us at hello@nmcmate.com about anything on this page.

What we collect

Because you gave it to us. Your name and email address, and a hash of your password. Your nursing field of practice and your exam date, if you tell us. Anything you write to us.

If you sign in with Google. We ask Google for three things and no more: your email address, your basic profile (your name and your profile picture) and an identifier for your Google account. We use them to create your account, to recognise you when you come back, and to send the email the service has to send, such as a password reset or a receipt. We do not receive a password. We do not post anything to your Google account, and we do not read your contacts, your calendar or your files. You can use an email address and password instead and never connect Google at all.

How we handle Google user data. NMCMATE's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use that information only to sign you in and run your account as described above. We do not use it for advertising, we do not sell it, and we do not transfer it to anyone except as needed to run the service, for security, or to comply with the law. Nobody at NMCMATE reads it unless you ask us for support, we need to investigate abuse, or the law requires it. You can disconnect NMCMATE at any time in your Google Account permissions, and deleting your account from your profile page removes your Google details from our records.

Because you used the service. Your answers, marks, flags, notes, reading position and progress. Which questions you have unlocked, so the free daily allowance can be counted and so revision of what you have already seen is never rationed. Your mock attempts and their results. Your OSCE transcripts and marking reports.

Because your browser sent it. IP address, browser and device type, timestamps and pages requested, in ordinary server logs, kept for security and debugging.

Because of where you came from, if you accept analytics. If you press "Accept all" on the cookie banner, then when you create an account we record the first page you visited in that session, the website that sent you (the site name only, never the full address) and any campaign tags on the link. Until you accept, nothing about this is stored on your device. If you decline, it is not recorded at all. It is saved once with your account and never updated, so we can tell which pages bring people to NMCMATE.

Because you paid us. The fact and amount of a payment, what it bought, and the last four digits and expiry of the card. We never see or store your full card number, which goes directly to Stripe.

We do not ask for and do not want clinical information about you or anyone else. Please do not put it into a question report, a note or an OSCE attempt.

Why we use it, and our lawful basis

• To run your account, provide what you bought and keep your progress: performance of our contract with you.
• To send service email such as verification, receipts and account notices: performance of our contract. You cannot opt out of these while you have an account, because they are how the service works.
• To keep the site secure, prevent fraud and account sharing, and debug faults: our legitimate interests in running a service that works and is not abused.
• To improve our questions using aggregate performance, for example spotting an item everybody gets wrong: our legitimate interests in the material being good. This works on aggregates, not on singling you out.
• To send marketing email: your consent, asked for separately and withdrawable at any time from the unsubscribe link in any such email.
• To run analytics, including recording the first page and referring site when you sign up so we can tell which pages bring people to the site: your consent, given through the cookie banner and withdrawable at any time. The sign-up record is one entry per account and is never used to follow you around.
• To meet our accounting, tax and legal obligations: legal obligation.

We do not sell your personal data, and we do not use it to train machine learning models.

Who else processes it

We use a small number of providers, each receiving only what it needs:

The OSCE simulator, specifically

This one deserves saying plainly rather than leaving in a table. When you take an OSCE attempt, what you type is sent to Google's Gemini API, along with the scenario, so the model can play the patient and mark your performance. Your name and email are not sent with it.

We use Google's paid API tier, on which Google states that submitted content is not used to train its models. We chose the paid tier for that reason, and we would not run this feature on a tier that did.

If you speak an answer instead of typing it, the short recording is sent to Google's Gemini API to be turned into text. We keep the words in your transcript and do not store the recording.

If you would rather nothing you write or say went to a third-party model, do not use the OSCE simulator. Everything else on the site works without it.

The Android app

The NMCMATE Android app is the same service with the same account. It keeps your sign-in in your phone's secure storage so you do not have to type your password each time. If you have paid access you can download questions and Gems to use offline. Downloads are deleted from your phone when you sign out and when your access ends. Answers you give offline are held on your phone and sent to us the next time you are online. The app asks the same cookie question as the website and uses Google Analytics only if you accept. You cannot buy anything in the app.

Cookies

We use two kinds of cookie, and the banner on your first visit asks about the second.

Essential cookies are always on. They keep you signed in, remember your theme and your cookie choice, and protect the session. The site cannot work without them, so there is no way to turn them off and still use it.

Analytics cookies power Google Analytics 4, and are off unless you turn them on. Until you accept, the Google Analytics script is not loaded at all. They tell us which pages people visit and where they give up, in aggregate. To change your mind, clear the cookie for this site and the banner will ask again.

You can also block or delete cookies in your browser. Blocking the essential ones will break signing in.

International transfers

We are based in Malaysia and some of our providers are in the United States, so your data is transferred outside the United Kingdom and the European Economic Area. Where that happens we rely on the receiving provider's standard contractual clauses or an equivalent approved safeguard. Ask us at hello@nmcmate.com if you want the detail for a specific provider.

How long we keep it

Your account data is kept while your account exists. You can reset your progress or delete your account yourself from your profile page. Deleting removes your name, password, Google link and access, and frees your email address to be used again. You can also ask us to delete it by email. Either way, we keep the records we are required to keep: payment and invoice records are retained for six years for tax and accounting purposes, and those are kept whatever else is deleted.

Server logs are kept for a short period for security and then discarded. An account left dormant with no access and no activity for three years is deleted.

Your rights

Under UK and EU data protection law you may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to you in a portable format. Where we rely on consent you may withdraw it at any time, which does not affect what we did before you withdrew it.

Write to hello@nmcmate.com. We will answer within one month. We will not charge you, and we will not treat you worse for asking.

If you think we have got this wrong, you can complain to the UK Information Commissioner's Office at ico.org.uk, or to the supervisory authority where you live. We would rather you told us first so we can fix it.

Security

Passwords are stored hashed, never in plain text. Traffic is encrypted in transit. Access to production data is limited to those who need it. No system is perfectly secure, but if a breach affects your rights we will tell the relevant regulator, and you, as the law requires.

Changes

If we change this policy materially we will say so by email or on the site. The current version always lives here.

---

NMCMATE is operated by Code Kubic Solutions (Company No. 2663998-P), a company registered in Malaysia. Contact us at hello@nmcmate.com.

NMCMATE is an independent preparation service. It is not affiliated with, endorsed by or connected to the Nursing and Midwifery Council.