Privacy Policy

Last updated: 20 May 2026

Who we are

Mosaic is a free learning tool for GP registrars, built by Dom Patterson as a personal project to support the Structured Learning Programme. It is not an NHS England product. Dom Patterson is the data controller for this service.

If you have questions about your data, contact: hello@mosaicgp.app

What data we collect

When you create an account and use Mosaic, we collect and store:

• Account information: your email address, display name, and a securely hashed password (managed by Supabase Auth)
• Content you create: questions you write, AI review feedback, and comments you post in discussions
• Usage data: which questions you've answered in quick tests (stored locally in your browser, not on our servers)

We do not collect sensitive personal data, health data, payment information, or location data.

How we use your data

Your data is used to:

• Provide you with an account so you can save and retrieve your questions
• Display your display name alongside questions and comments you choose to publish to the community
• Send your question content to the Claude AI API (provided by Anthropic) to generate review feedback
• Send you a password reset email if you request one

We do not use your data for marketing, advertising, profiling, or automated decision-making.

Lawful basis for processing

We process your data on the basis of legitimate interest — specifically, providing you with the educational service you've signed up for. For community features (publishing questions and posting comments), processing is based on your consent, given when you choose to share content publicly.

Where your data is stored

Your data is stored in a Supabase database hosted in the eu-west-2 (London) region on Amazon Web Services. Supabase acts as a data processor on our behalf. When you submit a question for AI review, the question content is sent to Anthropic's Claude API for processing; Anthropic's data handling practices are described in their privacy policy.

Your data is not routinely transferred outside the UK or EEA.

How long we keep your data

Your account and content are retained for as long as you have an active account. If you delete your account, your data will be removed within 30 days. Questions and comments you have published to the community bank will be anonymised (your name removed) rather than deleted, so that the discussion threads remain coherent for other users.

Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data (you can edit your questions and display name directly in the app)
• Delete your account and associated data
• Export your data in a portable format
• Object to processing based on legitimate interest
• Withdraw consent for community publishing at any time by unpublishing your questions

To exercise any of these rights, email hello@mosaicgp.app. We aim to respond within 30 days.

Cookies

Mosaic uses only essential cookies required for authentication (Supabase session tokens). We do not use analytics, tracking, or advertising cookies. Quick test progress is stored in your browser's local storage and is not sent to our servers.

Children

This service is designed for adult medical professionals (GP registrars). We do not knowingly collect data from anyone under 18.

Changes to this policy

We may update this policy from time to time. Significant changes will be communicated via a notice on the site. The "last updated" date at the top of this page indicates when it was last revised.

Complaints

If you are unhappy with how we handle your data, you can contact us at hello@mosaicgp.app. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).