Privacy notice

Last updated 30 September 2026

DipIMC.Ninja is run by EARL Health Technology Ltd, which is the data controller for the personal data described here. Contact: dojo@exam.ninja.

The short version

• The ten free sample questions need no account; the rest of the question bank needs a free one. Without an account, your progress stays in your own browser.
• With an account, we store your sign-in details and your revision progress so it follows you between devices.
• The site's owner can see the list of accounts and a summary of each account's scores, to run and support the site. The owner cannot see which options you chose.
• If you subscribe to a paid exam, Stripe takes the payment. We never see your card details.
• There is no analytics, no advertising and no marketing email, and nothing is sold.
• The site runs on Cloudflare, which receives your network (IP) address when you visit, as any website host does. Fonts are served from the site itself.

Without an account

Your progress is kept in your browser's local storage on your own device. That covers attempts, scores, badges, profile, reading list and settings, and we never receive any of it. Clearing your browser's site data deletes it, and you can export it from the Profile page.

The one thing that leaves your browser is a flag, and only if you press "Flag this". See Question flags below.

With an account

Signing in. You can sign in with Google, Apple or Microsoft. Signing in with a link sent by email will be offered when it is switched on.

• Through Google, Apple or Microsoft: we receive your name, your email address and a stable identifier for your account there. Apple will pass a private relay address instead of your real one if you ask it to. A work or university Microsoft account tells us the same three things and nothing about your work.
• By email link, when available: we receive the address you type, and the first and last name you give when you register. There is no password. Each link lasts fifteen minutes and works once. We keep a record of the link, with the network address it was requested from, to stop abuse. Link records more than a day old are deleted the next time anyone asks for a link.
• Limiting repeated attempts: your network address is also used for a moment to limit repeated sign-in attempts. Apart from the email link record, it is not stored.

What we store:

• your name, email address, and the date you joined and were last active;
• which sign-in methods you have used, with each provider's identifier for you;
• your signed-in sessions (when each started, was last used and expires);
• your attempts, scores and badges;
• your reading list;
• your profile: name, optional registration number, weekly targets, theme, your exam sitting and any dates you add to your plan;
• if you subscribe to a paid exam: which exam, when your access started and when it runs to, and Stripe's reference numbers for you as a customer and for your subscription.

Why: to provide the service you asked for by signing in, so your progress follows you between devices, and to give you the paid exams you subscribe to. That is the lawful basis: performing the service you asked for.

This browser's copy: while you are signed in, the browser also keeps a copy of your account's progress, so the app keeps working when you are offline. Signing out removes that copy once everything has been sent.

Who can see it: the site's owner, Leigh Rogers, working for EARL Health Technology Ltd, can see:

• the list of accounts, with each account's name, email address, sign-in methods, when it joined and was last active, and how many attempts it has made and its average score;
• a read-only summary of one account's progress: attempts, scores, and how each domain is going;
• who has access to each paid exam, how they got it (a subscription, or given by the owner) and until when.

This is used to run the site, fix problems and answer questions. The summary does not include which options you chose or your answers. If you ask, the owner can delete some or all of your attempts. Nobody else can see your account.

Where it is stored: on Cloudflare's platform. The database (Cloudflare D1) is in Cloudflare's Western Europe region. Requests are handled at the Cloudflare data centre nearest you.

Question flags

If you press "Flag this", we store which question or mission step it is about, the reason you chose, any note you type and when you sent it. If you are signed in, the flag also records your account, so it can be followed up. If you are not signed in, it is anonymous.

Flags are read by the site owner and by the question reviewers they appoint, who check and correct questions. They see the flag and, if you were signed in, the name and email address on your account. A reviewer may ask Claude, Anthropic's AI assistant, for help with a question: Claude is then sent the question, the reason and note of each flag on it and when it was sent, but never who sent it.

If you delete your account, your flags stay, because they are about the question. The account number they carry then points to nothing: your name, email address and everything else about the account are gone.

Your network address is used for a moment to limit how many flags can be sent at once. It is not stored.

Paying for an exam

Some exams on Exam.Ninja are a monthly subscription. You pay on Stripe's own checkout page, and you manage your card, invoices and cancelling on Stripe's billing page, reached from Manage subscription on the Profile page. Your card details go to Stripe and never to us.

To start a checkout we give Stripe your email address and a reference to your account and the exam. Stripe then tells us when a payment has gone through, a subscription has been cancelled, or a payment has been refunded, so we can give or end access. We keep which exam you have access to, the dates, and Stripe's reference numbers for you and your subscription, as listed above. We do not keep your payments, invoices or card details: Stripe does.

If you cancel, you keep access until the end of the month you have paid for.

Weekly reminder email

If you are signed in with a verified email address, you can turn on a weekly reminder on the Profile page, separately for each exam. It is off unless you turn it on. At most once a week it tells you how many questions you got wrong are due for review and how your week is going, and only when something is due or you have not practised yet that week.

To write it, we read your progress for that exam, which we already hold for your account. We store that the reminder is on, when we last checked and last sent it, and a random code for the stop link. Every reminder has a one-click stop; turning it off in Profile, stopping it from the email or deleting your account removes that record. The email delivery service below sends it.

Cookies and similar storage

• One cookie: a session cookie (sr_session) keeps you signed in. It lasts up to 90 days, or until you sign out, and is only set if you sign in.
• Local storage: your progress and settings, as described above. It never leaves your browser unless you sign in.

Cloudflare, our host, may also set its own short-lived security cookie if it needs to check for automated traffic. We use no tracking, analytics or advertising cookies. Both of these are needed for the site to do what you ask, so we don't ask for consent to them.

Other organisations involved

• Cloudflare hosts the site and the database. Like any web host it receives your network address and the pages you request. It keeps short-lived technical logs to run and protect the service.
• Google, Apple or Microsoft are involved only if you sign in with them. Their own privacy notices cover what happens on their side.
• An email delivery service sends the sign-in link, and the weekly reminder if you turn it on. It receives your address and the message only to deliver it.
• Stripe takes payments for paid exams. It receives your email address and a reference to your account from us, and the card and billing details you enter on its own pages. Stripe also uses payment information to prevent fraud and to meet its legal duties as a payment provider. For that it acts independently, and its own privacy notice (stripe.com/privacy) covers it.
• Anthropic provides Claude, which question reviewers can ask for help with a question. It receives the question and the reasons and notes of the flags on it, never your name, email address, account or progress.

Some of these organisations may process data outside the UK. When they do, they rely on the UK's approved safeguards for international transfers.

Our lawful basis for the hosting, logs and the limits on flags and sign-in attempts is our legitimate interest in running a secure, working site. For your account and any subscription, it is providing the service you signed up for. For the weekly reminder, it is your consent, which you can withdraw at any time by turning it off.

How long we keep it

• Your account and progress: until you delete the account.
• Sessions: until they expire, or until you sign out on that device.
• Email link records: about a day, as above.
• Your access to paid exams: with your account, including after a subscription ends, so there is a record of what you had. Stripe keeps its own payment records for as long as the law requires it to.
• Flags: as long as the question they are about.

Your rights

• Delete your account from the Profile page. This removes your account, profile, every attempt, badge and reading-list item, your access to paid exams, your sign-in methods and sessions, and any unused sign-in link from the database. It also cancels any subscription with Stripe straight away, without a refund for the rest of the month. Stripe keeps its payment records as the law requires. Flags stay, as explained above. Progress this browser kept before you signed in stays in its local storage until you clear it or reset it from the Profile page.
• Get a copy of your data with Export on the Profile page. It downloads your attempts, scores, badges, profile and reading list as a file. Your name, email address and sign-in methods are shown on the Profile page.
• Anything else: to correct something, to ask what we hold about you, for any other request, or to complain, email dojo@exam.ninja. You can also complain to the Information Commissioner's Office (ico.org.uk).