Last updated 29 August 2026
The short version: Cascade stores your email address, the medical school you pick, and what you did in the app. It does not sell anything to anybody, does not run advertising, and does not load analytics or tracking scripts. Card details never touch this site. The rest of this page is the same thing said properly, because UK data protection law requires the detail.
On this page
Cascade is operated by Lamaryalia Shenwary, a sole trader based in the United Kingdom, trading as Cascade. For the purposes of UK GDPR and the Data Protection Act 2018, that person is the data controller for everything described on this page.
Contact for any data protection question, including a request to exercise the rights in section 9: support@cascade.clinic.
Cascade is run by a sole trader in England. A postal address for correspondence is available on request by emailing support@cascade.clinic.
| What | Basis |
|---|---|
| Running your account and giving you access | Performance of a contract |
| Taking payment and keeping records of it | Performance of a contract, and legal obligation (tax and accounting records) |
| Storing your attempts and daily results | Performance of a contract, this is the product |
| Security, rate limiting, fraud and abuse prevention | Legitimate interests: keeping the service working and reliable |
| Acting on content reports to correct clinical errors | Legitimate interests: the accuracy of teaching material people rely on |
| Showing your name on a leaderboard | Consent, off by default, and withdrawable at any time |
| The waiting list | Consent, you gave the address for that purpose |
Cascade does not sell personal data and does not share it for anyone else's marketing. The following processors handle data on Cascade's behalf, each under their own terms:
| Who | What they do |
|---|---|
| Supabase | Database and authentication: your account, progress and entitlements |
| Vercel | Hosting and the serverless functions the site runs on |
| Stripe | Payment processing. Stripe is a controller in its own right for the payment data it collects |
| Resend | Sending account emails: confirmation codes, sign-in links, password resets |
| Forms and Sheets, used only for the waiting list |
Data may also be disclosed where the law requires it.
The database and authentication are hosted in West EU (London), eu-west-2. Some of the providers above are based in, or route data through, the United States. Where personal data leaves the UK it is protected by the safeguards those providers put in place, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework, depending on the provider.
There are two leaderboards, and they work differently. Both count the points scored on the daily case in the current week (Monday to Sunday, UTC) and reset each Monday.
The personal leaderboard is opt-in. Your name never appears on it until you turn the setting on in your account and set a display name. If you turn it on, anyone can see your display name, your medical school, your points this week, how many days you have played this week, your median score across those days, your current streak and the stars you have earned this week. They cannot see your email address, your score on any individual case, or anything else. Turning it off removes you from future personal leaderboards immediately. Choose a display name you are happy for strangers to see; if you would rather not be identifiable, use something that is not your real name.
The school leaderboard names schools, not people. It shows each medical school, its total points this week, how many of its students played, the number of days played, and that school's median score. It counts every student who has a confirmed account and has set a medical school, whether or not they have turned the personal leaderboard on, because it is a school-versus-school total rather than a list of individuals.
One consequence worth knowing: when only a single student from a school has played in a given week, that school's points and median are, in effect, that one student's results. So a school can appear on the board, with a score, from its very first player. If you would prefer your play not to show up in your school's numbers, leave the medical school field on your account blank: a student with no school set is not counted towards any school.
Cascade sets no advertising or analytics cookies, and there is no consent banner because nothing here requires consent. What it does use:
| Name | Purpose |
|---|---|
| Authentication tokens | Set by Supabase to keep you signed in. Strictly necessary |
| cascade-theme | Remembers whether you chose the cream or dark background |
| cascade-pending-uni | Holds the school you picked during sign-up until your account exists to store it on |
| cascade-synced-v1 | Records that progress saved on this device before you had an account has already been merged into it, so it is not merged twice |
| Local progress | Your attempts are also kept in this browser so the app works signed out and offline. It never leaves the device unless you sign in |
Clearing your browser storage will sign you out and remove any progress that has not been synced to an account.
Under UK GDPR you have the right to:
Email support@cascade.clinic to exercise any of these. A response will follow within one month.
If you are unhappy with how a request was handled you can complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113. You are welcome to raise it with Cascade first, but you do not have to.
Cascade is built for medical students and is intended for people aged 18 or over. It is not directed at children and accounts should not be created by anyone under 18.
This policy will change as Cascade does. The date at the top is the version in force. Anything that materially changes how your data is used will be notified by email to account holders before it takes effect.