Welcome to FRCOphthNotes

Begin your journey to passing the FRCOphth exams.

Privacy Policy

Last revised: 25 October 2026

Parties

The website operator of frcophthnotes.com; and
You, the user of frcophthnotes.com.

Background

frcophthnotes.com ("the Website") provides educational notes and resources for ophthalmology trainees and qualified ophthalmologists. Users can subscribe to access additional premium educational content available on the Website.
To subscribe, a user is required to provide their email address. A user's email address will be stored securely in a MongoDB Atlas database (a service provided by MongoDB, Inc. and hosted on Amazon Web Services in Ireland) for the purposes of authorising access to subscriber content and managing the user's subscription.
Subscription payments are processed through Stripe. However, credit card or other financial details are not stored on the Website or in its database.
The Website does not use any non-essential cookies such as those used for analytics or advertising. Any cookies used are essential for the functioning and security of the Website.
The processing of users' email addresses is necessary for the purposes of the legitimate interests of providing the subscription service and content. Users consent to their email address being stored when they subscribe.
Definitions
1. Personal data means any information relating to an identified or identifiable living individual.
2. Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
3. User means any individual who accesses or uses the Website.
4. Website means the website located at the domain name frcophthnotes.com.
5. We/Us/Our refers to the operator of the Website.
Introduction
1. This privacy policy sets out how We process any personal data that We collect about you, or that you provide to Us, when you use the Website.
2. It is important that you read this privacy policy together with any other privacy notice or fair processing notice We may provide on specific occasions when We are collecting or processing personal data about you so that you are fully aware of how and why We are using your data.
3. For the purpose of applicable data protection legislation (including but not limited to the General Data Protection Regulation (Regulation (EU) 2016/679) (the "UK GDPR") and any national implementing laws, regulations and secondary legislation, as amended or updated from time to time, in the UK, together with any successor legislation to the UK GDPR and the Data Protection Act 2018), the data controller is the operator of frcophthnotes.com.
4. We only collect and use your personal data in accordance with this privacy policy and applicable data protection laws.
5. This policy only covers our collection and use of personal data through the Website. To the extent that you disclose your personal data to Us through other means such as over the phone or via email, different privacy notices may apply.
6. We are committed to protecting your personal data and privacy and We will only process any personal data you provide to Us in accordance with applicable data protection legislation.
7. If you have any questions about this privacy policy or our privacy practices, please contact Us.
Scope
1. This privacy policy covers the email addresses of users who subscribe to premium content on the Website.
2. This privacy policy applies to all personal data processed about users of the Website by the Website operator. It applies to users who are located in the European Economic Area (EEA) and the United Kingdom.
3. Stripe processes payment information as part of the payment process but the Website operator does not have access to or control over any financial or other personal data processed directly by Stripe.
4. MongoDB Atlas, a database service provided by MongoDB, Inc. and hosted on Amazon Web Services (AWS) in Ireland, processes users' email addresses securely in order to enable account access and manage subscriptions on behalf of the Website operator.
5. This privacy policy will apply for as long as the Website operator processes a user's personal data as described in this policy.
Information Collected
1. For users who subscribe to the premium content on the Website, their email address is collected and securely stored in MongoDB Atlas. This email address is used for authorising access to subscriber content and managing the user's subscription.
  1. Email addresses are stored securely in MongoDB Atlas in accordance with applicable law.
2. The Website uses essential technical cookies that are necessary for the functioning and security of the Website. No non-essential cookies such as those used for analytics or advertising are set.
3. Payment information, including credit card or other financial details, are not collected or stored by the Website or in its database. Payments are processed through Stripe.
4. No other personal data is actively collected from users of the Website. The Website does not use analytics or tracking tools.
How We Use Your Personal Information
1. We use users' email addresses:
  1. To manage and administer their subscription, including providing access to subscriber content and authorising sessions.
  2. To communicate with users about their subscription, including subscription renewal reminders.
2. The lawful basis for processing email addresses under Article 6(1)(f) of the UK GDPR is our legitimate interests, in order to provide the subscription service.
3. Some payment information may be shared with Stripe to process payments. The lawful basis for this processing under Article 6(1)(b) of the UK GDPR is to fulfil our contractual obligations to users.
4. We do not conduct any profiling of users or use personal data for automated decision making.
5. We do not share personal data with any third parties except our payment processor Stripe, as necessary to process payments.
6. Personal data is stored in the EEA (Ireland). Stripe may transfer limited payment information to the US under standard contractual clauses. See the International Data Transfers section below.
7. Email addresses are retained for the duration of the subscription and for 6 months after cancellation for accounting purposes only. Payment information is deleted after payment processing.
Sharing Your Personal Information
1. We may share your personal information with our third party payment processor Stripe in order to process any subscription payments you make through Stripe. Stripe does not share your full payment details with us.
2. We may share your personal information, in particular your email address, with our third party service provider MongoDB, Inc. (which provides the MongoDB Atlas database service) in order to manage your authorisation and access to subscriber content on the Website.
  1. MongoDB, Inc. is contractually bound by confidentiality and data protection obligations restricting its use of your personal information.
3. In the event of a business transfer, such as a reorganisation, merger, sale or asset sale, your information, including personal information, would be part of the transferred assets.
4. We may share your personal information with third parties if required to do so by law, or if we have a good faith belief that such disclosure is reasonably necessary to respond to legal process, enforce our terms and conditions, or protect the rights, property or safety of our users or others.
International Data Transfers
1. Personal data stored in MongoDB Atlas is held on Amazon Web Services servers located in Ireland (AWS region eu-west-1), within the European Economic Area.
2. The United Kingdom recognises the EEA as providing an adequate level of data protection, so storing personal data in Ireland does not require additional safeguards for users in the UK.
3. MongoDB, Inc. is a company based in the United States. Where it or its sub-processors may access personal data from outside the UK/EEA, this takes place under appropriate safeguards provided for in its data processing agreement, such as standard contractual clauses and the UK International Data Transfer Addendum.
4. If any of these safeguards ceases to be valid, the Website will require MongoDB, Inc. to put alternative safeguards approved by the relevant regulators in place before any further transfer of personal data outside the UK/EEA.
5. Individuals have the right to request a copy of the safeguards put in place for transfers of their personal data outside the UK/EEA.
6. The Website will cooperate with the UK Information Commissioner's Office as required regarding any international transfers of personal data processed in connection with the Website.
Data Security
1. We have implemented appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing and against accidental loss, destruction, damage, alteration or disclosure.
2. Access to your personal data is restricted on a need-to-know basis through password protection and multi-factor authentication.
3. Personal data transmitted and stored is encrypted using industry standard TLS 1.2. Data at rest is encrypted using AES-256.
4. MongoDB Atlas stores data in secure AWS data centres which are monitored 24/7 and have stringent access controls, firewalls, intrusion detection systems.
5. MongoDB Atlas and AWS undergo regular independent security audits to identify vulnerabilities. Any issues are promptly addressed.
6. All staff with access to personal data receive regular data protection training. Access is revoked if employment ends.
7. We maintain security incident management policies and procedures to promptly identify, contain and respond to any personal data breaches. Notifications are made to the ICO and affected individuals as required by law.
Data Retention
1. Email addresses will be kept for the duration of the user's subscription and for 6 months after cancellation to handle any queries.
2. Payment information is not collected or stored by the Website.
3. Dates of subscription, upgrades and cancellations will be kept for accounting purposes for 7 years from the end of the tax year in which the transaction occurred.
4. Essential cookies related to website functionality and security will be kept for the duration of the browsing session.
5. If a user exercises their right to erasure, their personal data will be deleted from our systems within 1 month of the request.
Your Rights
1. Right to access your data. You have the right to request a copy of the personal data we hold about you. We will provide this to you within one month of receipt of the request.
2. Right to rectification. You have the right to have personal data that we hold about you rectified if it is inaccurate or incomplete. We will respond to requests for rectification within one month of receipt of the request.
3. Right to erasure. You have the right to request that we erase personal data we hold about you in certain circumstances. However, we may refuse to erase personal data to the extent permitted by applicable law, in particular if processing is necessary for compliance with our legal obligations or for the establishment, exercise or defence of legal claims.
4. Right to restrict processing. You have the right to request that we restrict the processing of your personal data in certain circumstances.
5. Right to data portability. You have the right to receive a copy of personal data we hold about you in a structured, commonly used and machine-readable format, and to transmit that data to another controller, where technically feasible.
6. Right to object. You have the right to object at any time to the processing of your personal data for direct marketing purposes. We will stop processing for this purpose upon receipt of your objection. You also have the right to object to our processing of your personal data for other purposes if our processing is not reasonably necessary for the lawful purposes for which we process the data. If your objection is valid, we will stop processing your personal data for that purpose.
7. Rights in relation to automated decision making and profiling. We do not use automated decision making or profiling.
8. Right to withdraw consent. You have the right to withdraw your consent at any time where we rely on consent to process your personal data.
9. Right to lodge a complaint. You have the right to lodge a complaint with the Information Commissioner's Office if you consider that our processing of your personal data infringes applicable data protection laws.
10. Contact details. To exercise any of your rights set out in this section, please contact us using the email address admin@frcophthnotes.com.
Changes to this Privacy Policy
1. We may update this Privacy Policy from time to time to ensure it remains up-to-date and accurately reflects how and why we use your personal data.
2. If we make any material changes to this Privacy Policy, we will notify you by email prior to the change becoming effective.
3. By continuing to use the Website following notification of such changes, you signify your acceptance of the amended Privacy Policy.
4. This Privacy Policy was last updated on 25/10/2026.
5. Previous versions of this Privacy Policy are archived and can be obtained by contacting us at privacy@frcophthnotes.com. This is to ensure users understand how their personal data was handled at any given time in the past. This Privacy Policy is effective as of 01/01/2024. By using the Website, the user agrees to be bound by the terms of this Privacy Policy.