On this page

Public articles, guides and quizzes are accessible without an account. The study web app uses Google sign-in so your subscription and study history can follow you across devices. The mobile apps keep their existing device-based experience.

Who we are

DAHMANI LIMITED, company number 14723909, publishes RBT Practice and is the data controller. Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Contact: support@rbtpracticequestions.com.

Information handled

  • Google account: when you sign in, Google shares your account identifier, email address and name with us. We use the identifier to associate your study account and subscription. We do not request Gmail, Drive, Ads or other Google API access.
  • Study data: answers, accuracy, practice sessions, mock exam attempts, lesson and flashcard activity, goals, your exam date and settings are saved to your signed-in account in Cloudflare D1 and cached locally in your browser. This lets you resume study and review previous answers on another device. Mobile app data remains on your device.
  • Web subscription data: when you subscribe on the web, Stripe processes your payment. We receive the subscription status, a Stripe customer and subscription reference, the email address you give Stripe at checkout, and billing records needed to provide Premium, send receipts, prevent fraud and meet tax obligations. We never receive or store your full card number.
  • Access token: a signed Premium access token is kept in your browser's local storage so Premium works on your next visit. The access link you can copy from your account contains this token; treat it like a password.
  • Sign-in cookies: a necessary secure, HttpOnly session cookie keeps you signed in for up to 30 days. A short-lived sign-in challenge cookie prevents replay. Signing out revokes that browser session and clears its cookie.
  • App subscription data: in the iPhone, iPad and Android apps, Apple, Google Play and RevenueCat may process a pseudonymous app-user identifier, product and entitlement status, transaction identifiers, device and app version, country, IP address and service logs needed to sell, validate and restore purchases.
  • Email choices: your email address, first name, plan (free or Premium), the country you signed up from, when you signed up and last signed in, whether you receive study emails, when and how that choice was made (sign-in notice, ticked box or account setting), and whether messages were delivered, opened, clicked or bounced.
  • Support: if you email us, we receive your address and whatever you choose to send.

We do not sell personal information, and we never ask you to enter client health information. Do not include identifiable client information in support messages.

Email

We send two kinds of email. Service emails (sign-in, receipts, billing and security notices) are sent because they are needed to run your account. Study emails are tips, product updates and offers.

Outside the EEA, the UK and Switzerland, signing in means you agree to receive study emails; the sign-in screen says so. In the EEA, the UK and Switzerland we send them only if you tick the box on the sign-in screen. Every study email has an unsubscribe link, and you can switch them off at any time in Account (or reply to ask us to). When you unsubscribe we keep your address on a suppression list so we do not email you again.

Email is sent through our own mailing system hosted by us and delivered by Amazon Web Services (Amazon SES). It records whether messages were delivered, opened, clicked or bounced so we can improve them and protect our sender reputation. Opens are measured with a small image; blocking images prevents that.

Cookies, analytics and advertising measurement

The website and web app may use analytics and advertising measurement from Google and Meta to understand which pages and ads lead to visits, sign-ups and purchases. This can include page views, clicks on buttons, purchase events and values, device and browser information, and IP-derived approximate location. Your answers and study progress are not sent to these services.

In the EEA, the UK and Switzerland, these tools run only after you accept them in the consent banner, and you can change your choice at any time. Elsewhere they are on by default and you can opt out through the privacy choices control on the site. On public website pages the Google tag library is referenced with every consent signal set to denied so that Google can verify our ad landing pages; loading it contacts Google's servers, which receive your IP address and browser details like any file request, but it sends no measurement events and sets no advertising cookies until these tools are allowed. Our hosting provider, Cloudflare, also measures aggregate traffic with a cookieless service (Cloudflare Web Analytics) that does not track people across sites and does not depend on this choice. Declining does not affect any study or Premium feature. Strictly necessary storage (your study progress and access token) is used without consent because the service cannot work without it.

On public website pages, Microsoft Clarity helps us understand navigation and button interactions through session replay and heatmaps. It follows the same website consent choice above, with strict text masking and masked inputs. Replay is not installed inside the signed-in study app, and links containing access tokens are excluded. We send only selected interaction event names to Clarity, not your name, email, answers, study history or payment details. Microsoft advertising consent remains denied. Clarity may process pseudonymous session identifiers, device information, page addresses and interaction data. You can withdraw through Privacy choices; collection stops and Clarity cookies are cleared. See Microsoft's privacy statement.

In the Android and iOS apps, advertising measurement follows the rules described in the app: consent first in the EEA, UK and Switzerland, Apple's tracking permission on iOS, and an in-app switch to turn measurement off.

Local study data supports the features you request. Payment processing is necessary to provide Premium and is also used for security, tax and legal compliance. Analytics and advertising measurement rely on your consent in the EEA, UK and Switzerland, and on our legitimate interest in measuring and improving our marketing elsewhere, balanced by your right to opt out. Stripe, Google, Apple, RevenueCat, Meta and Cloudflare (our hosting provider) may process data in countries outside yours under their own safeguards and policies.

Sharing

We share information only with service providers needed to host the service, take payments, operate subscriptions, measure advertising and provide support; when required by law; or in a business reorganization with appropriate protections. Key providers are Cloudflare, Stripe, Apple, Google, RevenueCat, Meta and Microsoft Clarity. Advertising providers may act as independent controllers for information they receive under their own terms.

Retention and your choices

Account study history is retained while you use the account, with up to 60 recent practice sessions and 36 recent mock attempts. You can export a backup or reset study progress in Account; contact support to request account deletion. Clearing browser data does not delete cloud history. Browser caches remain until cleared; mobile app data remains until its storage is cleared or the app is uninstalled. Expired sign-in sessions are removed as part of sign-in maintenance. Stripe, Apple, Google, RevenueCat and Meta keep information under their own legal and operational requirements. Purchase and tax records may need to be kept for the legally required period. Support email is kept only as long as needed to resolve the request and meet legal obligations.

You may request access, correction, deletion, restriction or objection by emailing us. A deletion request does not cancel a subscription: cancel web Premium in the Stripe customer portal and app subscriptions in your store account.

Security, children and changes

We use reasonable technical and organizational safeguards, but no system is risk-free. RBT Practice is intended for RBT candidates and professionals, not children. We may update this policy; the effective date above will change when material revisions are published.