Last updated: 16 October 2026
Mosaic is a free learning tool for GP registrars, built by Dom Patterson as a personal project to support the Structured Learning Programme. It is not an NHS England product. Dom Patterson is the data controller for this service.
If you have questions about your data, contact: hello@mosaicgp.app
When you create an account and use Mosaic, we collect and store:
We do not collect health data about you, payment information, or location data. Mosaic is not designed to hold information about patients. When you write a question or a reflection you must not include anything that could identify a real patient, colleague or family member — no names, dates of birth, NHS or hospital numbers, addresses or unusual details. Mosaic warns you when something you type looks identifying, but the responsibility is yours, in the same way as your ePortfolio.
Your data is used to:
We do not use your data for marketing, advertising, profiling, or automated decision-making.
What a cohort admin can see. A training programme that runs a Mosaic cohort can nominate admins (usually the programme's facilitators). They see activity summaries for their cohort — how many questions, cards, reflections and comments members have created, the names of the people in the cohort and of the most active members — and any content you have chosen to share with the cohort or publish. They can also see how much each member has used Mosaic week by week — counts only, shown on screen with each member's name — so the programme can see how Mosaic is being used and where people stop. They cannot read your private notebook entries, unshared questions, personal decks, or quick-test answers. This limit is enforced in the database, not just hidden in the screen.
We process your data on the basis of legitimate interest — specifically, providing you with the educational service you've signed up for. For community features (publishing questions and posting comments), processing is based on your consent, given when you choose to share content publicly.
Your account, content and learning activity are stored in a Supabase database and file store hosted in the eu-west-2 (London) region on Amazon Web Services. Supabase acts as a data processor on our behalf. Account emails (sign-up confirmations and password resets) are sent through Amazon Simple Email Service, also in London, which acts as a processor for your email address only.
AI review is the one place your content leaves the UK. When you ask for an AI review, the question you wrote (the stem, options, your reasoning and notes) is sent to Anthropic's Claude API, which may process it outside the UK. Anthropic's commercial API terms state that content sent through the API is not used to train its models; their handling of it is described in their privacy policy. The request is relayed by a small function that Netlify runs for us in London; it does not store your content. Nothing else — your notebook, flashcards, account details or activity — is sent to Anthropic.
Other, smaller transfers. The website's pages are served by Netlify from servers around the world so that they load quickly; the pages are the same for everyone and contain none of your data, but like any website host Netlify keeps short-lived technical logs (such as IP addresses), which may be stored outside the UK. If you email hello@mosaicgp.app, your message is forwarded to us by ImprovMX, an email-forwarding service that may handle it outside the UK. And emails we send you are, of course, delivered to whoever runs your inbox (for example NHSmail or Gmail), wherever they keep your mail.
Your account and content are retained for as long as you have an active account. If you delete your account, your data will be removed within 30 days. Questions and comments you have published to the community bank will be anonymised (your name removed) rather than deleted, so that the discussion threads remain coherent for other users. Feedback you have sent is kept with your name removed.
Under UK GDPR, you have the right to:
To exercise any of these rights, email hello@mosaicgp.app. We aim to respond within 30 days.
Mosaic uses only essential browser storage required to keep you signed in (Supabase session tokens) and to remember small preferences such as whether you have dismissed the "add to home screen" prompt. We do not use analytics, tracking, or advertising cookies.
This service is designed for adult medical professionals (GP registrars). We do not knowingly collect data from anyone under 18.
We may update this policy from time to time. Significant changes will be communicated via a notice on the site. The "last updated" date at the top of this page indicates when it was last revised.
If you are unhappy with how we handle your data, you can contact us at hello@mosaicgp.app. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).