Privacy Policy

Who we are

LIFFT Labs ("LIFFT", "we") operates a mentoring platform connecting people exploring healthcare careers with experienced mentors. We are the data controller for the personal data described here. Contact: privacy@lifftlabs.com.

What we collect and why

Account data — name, email, and password (stored hashed), to operate your account. Profile data — the professional background, goals, and preferences you provide during onboarding, to run the mentoring service. Session data — bookings, session times, and statuses. Messages — messages you exchange with your mentor or learner through the platform. Payment records — amounts, dates, and references for payments (see Stripe below — we never hold card or bank details).

Our lawful bases are performance of our contract with you and, for service emails and fraud/abuse prevention, legitimate interests.

Google Calendar

If you are a mentor and choose to connect Google Calendar, we request permission to view and manage events on your calendar. We use this to: (1) read the times you are busy so learners cannot book over your commitments — we store start and end times only, never event titles, descriptions, attendees, or any other event content; and (2) add, update, or remove calendar events for confirmed LIFFT sessions. You can disconnect at any time from your calendar settings or your Google account security page, which stops all access. LIFFT's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Video sessions

Video calls run on Agora's real-time infrastructure. Sessions are not recorded by LIFFT. Agora processes the audio/video streams to deliver the call.

Our processors

Supabase (database hosting, EU region — eu-west-1); Stripe (payments and mentor payouts — card and bank details are collected and held by Stripe, never by LIFFT); Agora (video calls); Resend (transactional email); Vercel (application hosting). Each processes data under their own data processing terms.

Retention and deletion

We keep your data while your account is active. On a deletion request we remove or anonymise your personal data across our systems, except records we must keep for legal reasons (e.g. payment records for tax purposes, retained in anonymised form where possible). To request deletion, email privacy@lifftlabs.com.

Your rights

Under UK GDPR you can request access to, correction of, or deletion of your personal data, object to or restrict processing, and request portability. You can complain to the Information Commissioner's Office (ico.org.uk). We are registered with the ICO.

Cookies and analytics

We use strictly necessary cookies for signing in. Analytics (PostHog, hosted in the EU) run only with your consent, given via the cookie banner, and can be declined without affecting the service.