In short. We hold your email address, what you have bought, and your revision activity — which questions you have answered, how you scored, which flashcards are due, and which pages you have opened. We use it to give you the product you paid for, to work out whether you meet the 550 Guarantee, and, if you ask for it, to send you email. We do not sell it and we do not advertise to you.
1. Who we are
MSRA Masterclass provides online revision material for the Multi-Specialty Recruitment Assessment. It is run by Mohammad Syed, trading as MSRA Masterclass, as a sole trader.
Mohammad Syed is the data controller for the personal data described here, which means he decides why and how it is used.
Controller: Mohammad Syed, trading as MSRA Masterclass (sole trader)
Contact: syed@msramasterclass.com
Postal address: available on request by email
We are an independent revision provider. We are not affiliated with NHS England, the GMC, or any body that administers the MSRA, and we do not share your data with them.
2. What we collect
Everything below is either given to us by you or generated by your use of the platform. We do not buy personal data, and we do not collect anything from you before you enter an email address.
| What | Where it comes from |
|---|---|
| Your email address | You, when you sign in or buy |
| What you bought and when — the plan, the price, when access ends, and a Stripe customer reference | Stripe, when a payment succeeds |
| Your revision activity — which questions you have answered, what you chose, what you scored, how long you took, which mock papers you sat, and which flashcards are due | Generated as you use the platform |
| Which pages you have opened — disease library pages and guides, with a count and the first and last time you opened each | Generated as you use the platform |
| An unfinished session, if you save one to come back to — the questions, your place in them, and your answers so far | Generated when you save a session |
| Your exam date, if you tell us | You, optionally |
| Questions you contest and what you wrote about them | You, when you flag a question |
| Your use of the AI tutor — which model, how much was used, and what it cost | Generated when you use the tutor. See section 4. |
| A record of payment events — including refunds and chargebacks, and what access was removed as a result | Stripe, and our own records |
We do not collect your name unless you put it in an email to us, and we never ask for it. We do not ask for your GMC number, your specialty, your employer, or your actual MSRA result. We do not collect health data about you.
We do not take card details. Payment happens on Stripe's own checkout pages. We receive confirmation that a payment succeeded, the email address you gave Stripe, and a customer reference. We never see your card number.
3. Why we use it, and our lawful basis
Under UK GDPR we must have a lawful basis for each use. Ours are:
| What we do | Lawful basis |
|---|---|
| Sign you in and keep you signed in | Contract — we cannot give you access to something you paid for without knowing who you are |
| Give you access for the period you bought, and end it when that period runs out | Contract |
| Record your answers so that your progress, your archive, your mistakes filter and your flashcard schedule work | Contract — these are the product |
| Count your activity against the five conditions of the 550 Guarantee | Contract — the guarantee is part of what you bought. See section 5. |
| Send you a receipt, a sign-in code, or a message about your account | Contract |
| Investigate a question you have contested, and correct the material | Legitimate interests — keeping the question bank accurate |
| Keep records of payments, refunds and disputes | Legal obligation (tax and accounting) and legitimate interests (defending a chargeback) |
| Monitor how much the AI tutor is being used, and its cost | Legitimate interests — preventing abuse and keeping the feature affordable |
| Send you marketing email | Consent, which you can withdraw at any time. See section 9. |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights. You can object to any of it — see section 11.
We do not profile you or make automated decisions with legal effect. The platform adapts what it shows you based on what you have answered, but nothing decides anything about you.
4. The AI tutor
The AI tutor is powered by Anthropic. When you ask it something, we send Anthropic the question you are looking at, its explanation, and what you typed. We do not send your email address, your account identifier, your score history, or anything else that identifies you — Anthropic receives the question and your message, not you.
We keep a record on our side of which model answered and how much it was used, so we can watch the cost and spot abuse. That record is linked to your account. It does not contain what you asked.
Practical advice. Do not type anything about a real patient into the tutor, or into any other free-text box on the platform. Nothing here is a clinical system and nothing you write is protected as clinical information.
5. The 550 Guarantee and your activity record
The 550 Guarantee depends on five conditions, all measured from what you actually did: questions seen, mock papers completed, flashcards reviewed, library pages opened, and guides opened. Those counts come from the activity record described in section 2 and are shown live on your dashboard.
This means two things worth being explicit about:
- We have to keep that record for the guarantee to work. If you ask us to delete your data while a guarantee claim is open or possible, we cannot then verify the claim, and it will fail. We will tell you this before acting on a deletion request.
- The figures we rely on are the ones you can see. There is no second, hidden measure. If your dashboard says you have opened 100 library pages, that is the number we use.
The conditions themselves are in the Terms of Service.
7. Where your data goes
Your account and revision data are held in a database in London (eu-west-2). Our email is sent from Ireland (eu-west-1).
Some of our processors are based in, or transfer data to, the United States — Stripe and Anthropic in particular, and Cloudflare operates globally. Where data leaves the UK it is transferred under the safeguards UK GDPR requires, which in practice means the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
8. Storage on your device
We do not use tracking cookies, advertising cookies, or third-party analytics. There is no cookie banner because there is nothing to consent to.
The platform does store a few things in your browser, all of which are necessary for it to work:
- Your sign-in session, so you stay signed in between visits.
- A mock paper in progress — its deadline, your answers so far and where you had got to — so that locking your phone or closing the app does not lose the paper or reset its clock.
- The email address you last requested a sign-in code for, held for fifteen minutes, so that going to your mail app and back does not empty the form.
- Whether you have dismissed the "add to home screen" prompt.
Clearing your browser storage removes all of it. You will be signed out, and an unfinished mock paper will be lost.
9. Marketing email
We only send marketing email to people who have asked for it. Signing up to the mailing list is separate from buying, and buying does not add you to the list.
Every marketing email has an unsubscribe link, and unsubscribing takes effect immediately. You can also email us and we will remove you.
Unsubscribing from marketing does not stop service messages — sign-in codes, receipts, and messages about your access. Those are part of the product and we cannot send them optionally.
We send marketing from mail.msramasterclass.com and service messages from
msramasterclass.com, deliberately kept separate so that unsubscribing from one
cannot interfere with the other.
10. How long we keep it
| What | How long |
|---|---|
| Your account and revision record | While your account exists. If your access has expired and you have not signed in for 24 months, we delete it. |
| Payment and refund records | Six years after the end of the tax year they fall in, which UK tax law requires |
| Records of guarantee claims | Six years, to defend a claim or dispute |
| Marketing list membership | Until you unsubscribe, then a minimal record that you unsubscribed so we do not add you back |
| Questions you contested | Kept after your account goes, but detached from you, because the correction to the question bank outlives the account |
11. Your rights
Under UK GDPR you can:
- Ask what we hold about you, and get a copy.
- Correct anything wrong. Your email address is the main thing we hold that can be wrong, and we can change it.
- Ask us to delete your data. See the caveats below.
- Get your data in a portable form — we will give you your revision record as a structured file.
- Object to anything we do on the basis of legitimate interests.
- Restrict what we do with your data while a dispute is resolved.
- Withdraw consent to marketing at any time.
Email syed@msramasterclass.com. We will respond within one month, and it is free.
Two honest limits on deletion
We cannot delete payment records that tax law requires us to keep, or records needed to defend a legal claim. We will delete everything else and keep those to the minimum.
Deleting your revision record ends any guarantee claim. The guarantee is measured from that record. If it is gone, the claim cannot be verified and will not be paid. We will say so before we act, so you can decide.
12. Security
Data is encrypted in transit and at rest. Access to the database is through a small set of controlled operations rather than open table access, so a flaw in the website cannot expose other people's records.
We sign you in with a one-time code sent to your email address. There is no password to steal, guess or reuse. A code expires shortly after it is sent and works once.
No system is perfectly secure. If a breach happens that is likely to put your rights at risk, we will tell you, and we will report it to the ICO within 72 hours as the law requires.
13. Age
This platform is for doctors preparing for a postgraduate recruitment assessment. It is not intended for anyone under 18 and we do not knowingly collect data from children. If you believe a child has given us data, tell us and we will delete it.
14. Changes
We may update this policy. The version in force is the one on this page, with the date at the top. If we make a change that materially affects how we use your data, we will email you before it takes effect.
15. Contact and complaints
For anything in this policy, including a request to see or delete your data: syed@msramasterclass.com. We aim to answer within one working day.
If you are not satisfied with how we have handled your data, you can complain to the Information Commissioner's Office, the UK regulator:
ico.org.uk/make-a-complaint
Helpline 0303 123 1113
We would rather you came to us first, but you do not have to.