Practilium
Privacy Policy
Version DRAFT-2026-10-31.1 · Last updated: 31 October 2026
Controller: upSkillScore LLC, a wholly owned subsidiary of Pyrmont Holdings, Inc., 8 The Green #25924, Dover, DE 19901, United States ("Practilium", "we"). Data Protection Officer: Jeremy Dixon, privacy@practilium.com.
Also read the Terms of Use.
1. Data we process
| Category | Examples | Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|---|---|
| Registration | e-mail, name, credentials (Amazon Cognito) | create and authenticate the account | performance of a contract (Art. 6(1)(b)) |
| Study usage | answers to cases/mock exams, scores, progress, attempts | provide the service, measure performance | performance of a contract (Art. 6(1)(b)) |
| Free text | typed answers graded by AI | grading and feedback | performance of a contract (Art. 6(1)(b)) |
| Payment | Stripe customer identifier, subscription status and cycle (we do not store card numbers) | billing | performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Device/security | device identifier (used to prevent account sharing) | prevent account sharing | legitimate interests (Art. 6(1)(f)) |
| Technical | access and error logs (kept for 6 months); page-view and performance measurement (Vercel Web Analytics and Speed Insights) | security, diagnostics and understanding how the site is used | legitimate interests (Art. 6(1)(f)) |
| Acceptance | accepted version, date and time, IP address and browser | prove you accepted the terms | legal obligation (Art. 6(1)(c)); legitimate interests in defending legal claims (Art. 6(1)(f)) |
| Advertising (Google Ads and Meta) and landing-page measurement | on this site: page address (without query parameters), events (visit, sign-up, subscription with value), pseudonymous account identifier, cookies _gcl_au, _gcl_aw, _fbp, _fbc, IP address and browser; hashed email to Google Ads only, at sign-up. On go.practilium.com.br: Google Analytics 4, with approximate location and device and browser data (cookies _ga, _ga_*); Google signals off and no user-provided data | ad measurement and remarketing on this site; visit measurement on the landing page | consent (UK GDPR Art. 6(1)(a)) |
We process personal data under the UK GDPR and the Data Protection Act 2018. We do not ask for health data about you. Do not enter identifiable data of a real patient. The table shows what we process, why, and the lawful basis for each purpose. We ask for consent before storing advertising and measurement cookies, and you can withdraw it at any time.
2. AI and automated decisions
Free-text answers are sent to language models (Amazon Bedrock) for grading and tutoring. Scores are produced by AI as educational estimates. Where UK GDPR Article 22 applies, you have the right not to be subject to a decision based solely on automated processing, to ask for human review and to give your view. You can also submit a score dispute through the platform. It goes into an internal review queue handled by our team. This is not a clinical review, there is no guaranteed response time and there is no automatic notice. To ask for a person to review an automated score, write to privacy@practilium.com. See the AI Notice.
3. Who we share data with
Processors: Amazon Web Services (hosting, sign-in with Amazon Cognito, Amazon Bedrock and email with Amazon SES), Stripe (payments) and Vercel (web analytics and performance measurement). Vercel also hosts the website and the e-signature application we run ourselves (Documenso Community Edition, open source, on Pyrmont's own Vercel account). Documenso, Inc. does not process that data. The full list is on the Subprocessors page. We do not sell personal data. Vercel Web Analytics and Speed Insights, as configured, do not set cookies on your device, and we do not send them names, email addresses or user IDs. Page addresses are cleaned of access tokens and most query parameters before they are sent.
Advertising partners: Google (Google Ads) and Meta (Facebook and Instagram) receive online identifiers, events and technical data after you consent, to measure ads and for remarketing. At sign-up, Google Ads also receives your email address in hashed form. They act as controllers of the data they receive. We do not sell personal data. The landing page go.practilium.com.br uses Google Tag Manager (GTM-542T27QT) and Google Analytics 4. On that property Google signals and user-provided data collection are off; approximate location and device and browser data collection are on. We do not link that measurement across devices. Details, durations and how to decline are in the Cookie Policy.
4. International transfers
Practilium is operated from the United States, and our processors handle data in the United States and may handle it in other countries. Where we transfer personal data outside the UK, we use an approved safeguard, such as UK adequacy regulations (including the UK-US data bridge for certified recipients), the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. You can ask privacy@practilium.com for more information about the safeguards we use. Our advertising partners (Google and Meta) process advertising data in the United States and other countries where they operate. For that advertising data we also rely on the EU-US Data Privacy Framework (and its UK Extension) where the recipient is certified. The landing page go.practilium.com.br is measured with Google Analytics 4 under the settings in the Cookie Policy.
5. Retention
We retain personal data only for as long as necessary for the purposes in this Policy. The following schedules apply:
Identity and account (name, email, credentials, settings): kept for the life of the account. Erased after a verified erasure or account-deletion request, except records we are legally required to keep, or need to establish, exercise or defend legal claims.
Study usage (answers to cases and mock exams, attempts, scores, progress, AI grading text): kept for the life of the account and erased with the account on a verified erasure request. We do not operate a separate automated purge calendar for study history beyond that request path.
Billing and contract records: kept for the duration of the contract plus 7 years, in accordance with applicable accounting and legal obligations.
Support correspondence: kept for up to 2 years after account closure.
Acceptance audit trail (accepted version, date and time, IP address and browser): mandatory retention — it proves your consent and is kept for as long as the relationship lasts and for the statutory limitation period.
Access logs: kept for 6 months.
Advertising: the campaign source stays in your browser for 90 days; Google Ads and Meta cookies on this site last about 90 days; Google Analytics 4 cookies on go.practilium.com.br may last up to 2 years; Google and Meta keep what they receive under their own policies. If you decline on this site, we delete the advertising cookies on this site and the stored campaign source from your browser.
6. Your rights and how to complain
You have the right to be informed about how we use your data and to access, rectify, erase and restrict its use; to data portability; to object to processing based on legitimate interests; to withdraw consent where we rely on it; and to rights about automated decision-making. Write to privacy@practilium.com. We may ask for details to confirm it is you. We will reply within one month, and we may extend that by up to two further months for complex or numerous requests, telling you why. There is normally no charge. If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk. We would welcome the chance to put things right first. A score dispute on the platform follows item 4.2 of the Terms of Use and does not replace a rights request. You can also send us a privacy complaint electronically through our privacy complaints form; we will acknowledge receipt within 30 days.
7. Security
We use encryption in transit, access control and logs. Relevant incidents will be reported to the ICO and to the people affected as required by law.
8. Children
The platform is intended for people aged 18 or over (Terms of Use, item 5.1). We do not knowingly collect data from children. If we identify an account in that situation, we will close it and erase the data.
9. Changes
We will announce relevant changes by e-mail or on the platform, and we will update the date and version at the top.