MedExamHelperCookie & Tracking Policy
Last updated: 26 October 2026
This Cookie & Tracking Policy explains what cookies and similar storage technologies ("cookies") we use on Med Exam Helper (the "Service"), operated by VE LAXMI EXIM LLP ("we", "us", "our"), a limited liability partnership incorporated under the Limited Liability Partnership Act, 2008 (India), LLPIN AAK-5957, with our registered office at D-222/51, Behind Pennawalt, MIDC, Nerul, Navi Mumbai 400706, India. It also explains how you can manage your choices.
For the broader story on why we collect data, who we share it with, and your rights, see our Privacy Notice. This policy focuses on cookies and similar storage only.
1. What is a cookie?
1.1. A cookie is a small text file placed on your device by a website. "Similar storage" includes localStorage, sessionStorage, IndexedDB, Cache Storage, and SDKs that set identifiers on your device.
1.2. We use the term "cookies" in this policy to mean cookies and similar storage.
2. What we use today (live)
2.1. Today, the Service uses the following. Each is set by us on our own site unless stated, and each is listed by name in section 4.
(a) Session cookie — strictly necessary. Keeps you signed in. Removed when you sign out or your session expires.
(b) Browser storage for features you use — strictly necessary. localStorage keeps your theme preference (light or dark), your answer to the analytics banner, and a copy of the notes and differential you type during a station, which is removed once our server has saved them, and whether a station you can resume runs in Study or Exam mode. sessionStorage remembers, until you close the tab, that you dismissed the daily quote.
(c) App files in Cache Storage — strictly necessary. Our service worker keeps copies of our own site files (pages, scripts, styles and images) so that the app loads quickly and opens when you are offline. They are replaced when we release a new version.
(d) Patient voice model in Cache Storage — strictly necessary for voice mode, which you turn on. The first time you turn on voice mode, your browser downloads the patient's voice model and voice files from our website and keeps them so that later sessions do not download them again. The files stay even if the model then fails to start on your device.
(e) Analytics identifiers, only if you accept analytics — consent. On our marketing pages, localStorage keeps a random identifier. On our marketing pages and in the app, sessionStorage keeps the referring site and campaign tags you arrived with until you close the tab. They are sent with usage events to our own server (Privacy Notice, section 2.1). Declining analytics removes both.
(f) Cloudflare Turnstile bot check — strictly necessary for security. When you create an account, at sign-in after repeated failures, when a visitor without an account starts a station, and on the free-download and updates forms, your browser loads Cloudflare's challenge script, which may use cookies or similar storage under Cloudflare's own terms to tell people from bots. Cloudflare receives your IP address and browser and device information (Privacy Notice, section 11).
(g) Visitor cookie — strictly necessary. The first time your browser reaches our site, we set a cookie holding a random identifier that our server signs, so that it cannot be forged. Without an account, the practice you do in that browser (the stations you play, your progress and your flashcards) is kept against it, and it lets us apply the free play limits. It is replaced with a new identifier when you sign in, create an account or sign out. Our site's scripts cannot read it. It lasts one year.
2.2. Signing out clears the localStorage entries whose names start with meh_. Cached copies of our own site files and the voice model hold no personal data and stay until the next release or until you clear this site's data. You can remove everything at any time by clearing this site's data in your browser. We do not set analytics cookies. We do not set advertising cookies. We do not set any third-party tracking cookies. Our server reports its own errors and security events, and our app reports its own script errors, to GlitchTip, an error-monitoring tool hosted on our own server; this places nothing on your device (Privacy Notice, section 11).
3. What we plan to add (consent-gated)
3.1. Each of the following tools is consent-gated. Umami is installed on our own server; the others are planned. Each is described below and in the table in section 4.
(a) Umami (product analytics, self-hosted) — INSTALLED, CONSENT-GATED. Umami helps us understand how people use the Service so we can improve it (for example, which screens cause confusion, where people drop off in onboarding). It runs on our own server. No page of our site links to Umami: our site adds it to a page only after you accept the analytics banner, and only while we have analytics turned on. Our site's security policy lets your browser load scripts from, and send data to, our own website only, so your browser cannot load Umami from its own address or send data there; it can reach Umami only through our own website. When it loads, your browser sends it page-view and usage events. Your usage data will not leave our infrastructure and is not shared with any third-party analytics provider. Umami is cookieless by design and collects only pseudonymised, aggregated page-view and usage events. We will never record free-text inputs (consult transcripts, support tickets, or any field marked as a free-text input). Declining analytics, or withdrawing it later, stops Umami loading.
(b) Google sign-in and Google Drive backups — PLANNED. Google will be used only as an authentication provider (sign-in) and, if you choose, for backup exports to your own Google Drive. Google will receive your sign-in attempt and (if you initiate a backup) the backup payload. Google is not used for advertising on the Service and we will not place Google advertising cookies.
(c) Marketing tools — PLANNED. When we enable analytics or marketing tools from third-party providers (for example Google or Meta, including in connection with our Facebook, Instagram, and WhatsApp pages), those providers may set their own cookies. Any such tool will be consent-gated before it loads. We never sell personal information.
3.2. We will not enable any of these tools until: (a) consent-gating is implemented in-product; (b) this policy is updated to describe the live cookies set by each tool (including names, durations, and provider); (c) a "manage cookies" control is available so you can change your choice at any time; and (d) we have run a proportionate assessment for any tool that processes data outside your country of residence.
4. Cookie table
4.1. The table below lists the cookies and similar storage we use or plan to use. "Live" means in use today. "Installed, consent-gated" means the tool runs on our own server and your browser loads it, through our own website, only after you accept analytics (section 3.1(a)). "Planned" means we intend to enable the tool, but only behind consent and after the steps in section 3.2 are complete.
| Name / identifier | Purpose | Duration | Category | Provider | Status |
|---|---|---|---|---|---|
__Host-meh_auth (cookie) | Keeps you signed in (one active session per account). | Session (ends on sign-out or expiry). | Strictly necessary | Us | Live |
meh_visitor (cookie) | A random identifier for this browser, signed by our server: keeps the practice you do without an account and applies the free play limits. Replaced at sign-in, account creation and sign-out. | One year. | Strictly necessary | Us | Live |
meh-theme (localStorage) | Stores your light/dark theme preference. | Persistent until you clear it. | Strictly necessary | Us | Live |
meh-analytics-consent (localStorage) | Remembers whether you accepted or declined analytics. | Persistent until you clear it. | Strictly necessary | Us | Live |
meh_note_ and meh_ddx_ followed by the station session (localStorage) | A copy of the notes and differential you type during a station, kept until our server has saved them. | Until our server has saved them or you sign out. | Strictly necessary (a feature you use) | Us | Live |
meh_mode_ followed by the station session (localStorage) | Whether a station you can resume runs in Study or Exam mode. | Until the station ends or you sign out. | Strictly necessary (a feature you use) | Us | Live |
meh_qotd_dismissed (sessionStorage) | Remembers that you dismissed the daily quote. | Until you close the tab. | Strictly necessary (a feature you use) | Us | Live |
meh-shell- followed by a version (Cache Storage) | Copies of our own site files, so that the app loads quickly and opens offline. | Until the next release. | Strictly necessary | Us | Live |
transformers-cache and kokoro-voices (Cache Storage) | The patient's voice model and voice files, after you turn on voice mode. | Persistent until you clear this site's data. | Strictly necessary for voice mode | Us | Live |
meh_session_id (localStorage) | Random identifier sent with usage events from our marketing pages. | Persistent until you decline analytics, sign out, or clear it. | Analytics (consent required) | Us | Live |
meh_attribution (sessionStorage) | The referring site and campaign tags sent with usage events. | Until you close the tab or decline analytics. | Analytics (consent required) | Us | Live |
| Cloudflare Turnstile challenge | Telling people from bots at account creation, at sign-in after repeated failures, at station starts without an account, and on the free-download and updates forms. | Provider defaults. | Strictly necessary (security) | Cloudflare | Live |
| Umami (cookieless, self-hosted) | Product analytics — aggregate usage patterns. | Pseudonymised; no persistent identifier placed on your device. | Analytics (consent required) | Us (self-hosted) | Installed, consent-gated |
Google sign-in cookies (e.g. GAPS, 1P_JAR, __Secure-1PSID) | Sign-in via Google; account linkage. | Provider defaults. | Strictly necessary for the sign-in flow you initiated | Planned | |
| Google Drive OAuth tokens | Backing up your export to your own Google Drive, if you choose to. | Until you revoke or sign out. | Strictly necessary for the backup feature you initiated | Planned |
4.2. We do not use any advertising cookies. We do not use any cross-site tracking cookies. We do not allow third parties to set advertising cookies through our pages.
5. Consent
5.1. Storing or accessing information on your device generally requires your consent, unless the storage or access is strictly necessary to provide a feature you have asked for.
5.2. We treat every live entry in section 4 marked strictly necessary, and the Cloudflare Turnstile bot check, as strictly necessary. They are required for the Service to function (keeping you signed in, keeping the practice you do without an account and applying the free play limits, loading the app and keeping bots out) or to deliver a feature you have chosen (your theme, your analytics choice, your station notes and mode, the dismissed daily quote and the voice model), and they do not require consent.
5.3. Everything else waits for your consent. The analytics identifiers are set, and usage events are sent, only after you accept the analytics banner, and planned tools will stay blocked until consent is given.
5.4. If you have given consent, you can withdraw it at any time (see section 6). Withdrawal does not affect the lawfulness of processing before withdrawal.
6. How to manage or withdraw consent
6.1. In-product control. The "Manage cookies" link in the site footer reopens the analytics banner, where you can accept or decline analytics at any time. Declining removes the analytics identifiers from your browser and stops usage events.
6.2. Browser controls. You can also block or delete cookies through your browser. Each major browser (Chrome, Edge, Firefox, Safari, Brave) provides settings to: (a) block all cookies; (b) block only third-party cookies; (c) delete cookies on close; or (d) delete specific cookies.
6.3. Mobile controls. On mobile, you can reset the advertising identifier (IDFA on iOS, GAID on Android) and limit ad tracking through your device settings. We do not use these identifiers, but the controls may affect other apps and websites.
6.4. Effect of blocking. If you block strictly-necessary cookies, the Service will not work — you will not be able to sign in or stay signed in. If you block analytics cookies, the Service will still work, but we will have less insight into how to improve it.
7. Third-party cookies and advertising
7.1. We do not place third-party advertising cookies. We do not allow advertising networks to set cookies through our pages. We do not sell personal information.
7.2. Where we integrate third-party sign-in or backup (Google), the third party may set its own cookies as part of that flow. Those cookies are governed by the third party's own cookie notice and privacy notice, not by this policy. We link to those notices in-product.
8. Changes to this policy
8.1. We may update this policy. We will give you reasonable notice by email and, for material changes, by an in-product notice. Material changes include adding a new cookie or tool, changing a cookie's category or duration, or changing our consent flow.
8.2. The "Last updated" date at the top shows when it was last revised.
9. How to contact us
9.1. Questions about this policy should be sent to hello@medexamhelper.com or privacy@medexamhelper.com, or by post to VE LAXMI EXIM LLP, D-222/51, Behind Pennawalt, MIDC, Nerul, Navi Mumbai 400706, India. We aim to acknowledge enquiries within five working days.