← All legal documents

Last updated: [EFFECTIVE DATE]

This Privacy Notice explains how [LEGAL ENTITY NAME] ("we", "us", "our") collects, uses, stores, shares, and protects personal data when you use Med Exam Helper (the "Service"). We are a company incorporated in [JURISDICTION OF INCORPORATION] with our registered office at [REGISTERED ADDRESS] (company number [COMPANY NUMBER]).

We have written this notice in plain English so that you can understand what we do with your data, why, and what choices you have. If anything is unclear, contact us at hello@medexamhelper.com or privacy@medexamhelper.com (our Data Protection / Privacy contact).

1. What this notice covers

1.1. This notice applies to: (a) visitors and users of the Med Exam Helper website and web application; (b) anyone who creates an account, purchases an access pack, or contacts our support team; and (c) anyone who receives emails or other messages from us in connection with the Service.

1.2. This notice does not apply to: (a) third-party websites or services we link to (for example, payment processor pages at checkout); (b) marketing surfaces operated by other parties on which we appear (our WhatsApp, LinkedIn, Facebook, or Instagram pages) — those are run by their providers and governed by their own notices; we do not send your Service data to them.

2. What we collect and why

2.1. The table below lists the categories of personal data we collect, the purpose, and the lawful basis we rely on under the UK GDPR (with the Data Protection Act 2018) / EU GDPR (Article 6). Where a different lawful basis applies under another law, the regional annex says so.

2.2. We do not collect real patient data (all cases are simulated), your full IP address (only a truncated network prefix at sign-in), any advertising or cross-site tracking identifier, or biometric data from your voice. We do not sell personal data, do not share personal data for cross-context behavioural advertising as those terms are used in the California CCPA/CPRA, and do not profile users for advertising.

2.3. Country lookups at sign-in run entirely on our own server against a locally stored database — your IP address is never sent to a third party for this. Attribution: this product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

3. AI processing — in plain words

3.1. The Service uses AI to simulate patients and to grade your performance. Here is what happens:

(a) When you type or dictate text in a consult, the text is sent over an encrypted connection to our LLM provider, currently MiniMax, under a data-processing agreement. The provider generates the patient's next reply and sends it back. The provider is instructed to use the text only to provide the Service.

(b) When the consult ends, the transcript is sent to the same provider to grade it against our clinical rubric and to generate feedback. The grading and feedback are stored against your account.

(c) When you press "play" on a patient reply, our server asks the provider's text-to-speech service for an audio version, which is cached on our infrastructure.

3.2. Voice input is transcribed in your browser. We do not upload audio for dictation and we do not store voice recordings.

3.3. No real patient data. All patient cases are simulated. You must not enter real patient data or anyone else's personal data into a consult. If you do, we may delete that data and suspend or terminate your account.

3.4. EU AI Act transparency. We treat our AI features as general-purpose AI used for educational simulation and grading. We do not deploy the Service as a high-risk AI system within the meaning of the EU AI Act, because the Service is not used for clinical decision-making, recruitment, or any other high-risk use listed in the AI Act. AI outputs may be inaccurate or incomplete; they are educational, not clinical. You must not rely on AI output for real clinical decisions.

4. Cookies and similar storage

4.1. We use a session cookie (strictly necessary) and a local-storage entry for your theme preference. A full list, with categories, durations, and how to withdraw consent, is in our Cookie & Tracking Policy. We do not place any advertising cookies. Analytics and error-monitoring tools (planned: Umami and GlitchTip, both self-hosted on our own server, so this data does not leave our infrastructure) will only be enabled behind consent.

5. Marketing email

5.1. We send marketing email only with your consent. There is no soft opt-in and no pre-ticked box. Withdraw at any time by clicking "unsubscribe" in any marketing email or by contacting hello@medexamhelper.com.

5.2. Canada (CASL). We rely on express consent for marketing email to Canadian recipients. Each marketing email includes an unsubscribe mechanism that works without effort and within the time required by CASL.

5.3. United Kingdom (PECR). We have designed our flows as consent-first (opt-in) rather than soft opt-in. [LAWYER NOTE: please confirm whether the consent-first stance should remain, or whether a soft-opt-in path is acceptable for existing customers in defined circumstances. If soft opt-in is permitted, please add a clear opt-out in every message and a record of the qualifying conditions.]

5.4. United States (CAN-SPAM). Every marketing email identifies us as the sender, includes a valid physical postal address, includes a clear opt-out, and honours opt-out requests promptly. We do not use deceptive subject lines.

5.5. Transactional and lifecycle emails (verification, password reset, receipts, important service or security notices) are not "marketing" and are sent as part of running the Service.

6. Children

6.1. The Service is not directed at children. The minimum age to use the Service is [18 years old — or 16 years old if the lawyer confirms a 16+ age gate is acceptable; flag choice in the bracketed note below] (the "Age Gate"). [LAWYER NOTE: please confirm the minimum age. We propose 18+. If 16+, please add a clause requiring verifiable parental consent for users under 18 and ensure COPPA, the UK Age-Appropriate Design Code, and any EU member-state equivalents are addressed.]

6.2. We do not knowingly collect personal data from anyone below the Age Gate. If we learn that we have, we will delete the account and its data as soon as reasonably practicable.

7. Security

7.1. We protect your data with a layered set of measures: argon2 password hashing; hashed authentication and password-reset tokens; one active session per account with session rotation on sign-in and password change; rate limiting on sign-in and other sensitive endpoints; truncated IP storage at sign-in (the /24 for IPv4 and the /48 for IPv6, never the full address); an audit log for admin and security events; TLS in transit; and least-privilege access controls for staff. Backups are kept on infrastructure segregated from production. Further details are available on request to hello@medexamhelper.com for security reviewers under NDA.

8. Retention

8.1. How long we keep each category of data is set out in our Sub-processors & Retention document. In short: most account data is kept for the life of your account; consult transcripts, grades, feedback, flashcards, and progress stats are deleted when you erase your account; certain records (payment and entitlement rows; audit log; truncated-IP sign-in events) are kept for defined periods to meet legal, accounting, and security needs. Data in a backup copy is deleted when the backup is overwritten or when you validly request erasure, subject to standard backup rotation timelines.

9. Your rights — UK and EU

9.1. If you are in the UK or the EU, the UK GDPR (with the Data Protection Act 2018) and the EU GDPR give you the rights to: (a) access — to ask whether we process your data and to receive a copy; (b) rectification — to correct inaccurate or incomplete data; (c) erasure ("right to be forgotten") — to ask us to delete your data in defined circumstances; (d) restriction — to ask us to suspend processing in defined circumstances; (e) data portability — to receive your data in a structured, commonly used, machine-readable format; (f) object — to object to processing based on legitimate interests or for direct marketing; and (g) rights related to automated decision-making, including profiling (Article 22) — we do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

9.2. Self-service export and erasure. You can export your data as JSON and erase your account from inside the product. Erasure cascades: consult transcripts, grades, feedback, flashcards, and progress stats are deleted; audit log rows and truncated-IP sign-in events are deleted as part of the cascade; entitlement and payment rows are retained for accounting and tax as required by law.

9.3. Complaints. You can complain to the Information Commissioner's Office (ICO) if you are in the UK, or to your local data protection authority if you are in the EU. We would, however, prefer the chance to deal with your concern first.

9.4. Article 27 representatives. Where Article 27 of the EU GDPR requires us to appoint a representative in the EU, our representative is [EU REPRESENTATIVE]. Where a UK representative is required, our UK representative is [UK REPRESENTATIVE].

9.5. International transfers. Some of our processors (notably MiniMax) operate outside the UK and the EEA. Where we transfer your data outside the UK or EEA, we rely on the appropriate safeguard — typically the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses — together with a transfer impact assessment. [LAWYER NOTE: MiniMax is headquartered in China. The transfer of consult transcript text and TTS audio requests to MiniMax must be assessed by the lawyer, including lawfulness under UK and EU rules, contractual safeguards in our DPA with MiniMax, and any supplementary measures required.]

10. India (DPDP Act 2023)

10.1. If you are in India, the Digital Personal Data Protection Act 2023 ("DPDP Act") applies to us in respect of your personal data. We process your data only for the purposes described in this notice and any specific consent you have given.

10.2. Data principal rights. Subject to the DPDP Act, you have the right to: (a) access a summary of your personal data and the processing activities; (b) correct and update your personal data; (c) request erasure of your personal data; and (d) grievance redressal.

10.3. Grievance officer. Our grievance officer for DPDP matters is [INDIA GRIEVANCE OFFICER], reachable at hello@medexamhelper.com with the subject line clearly marked "DPDP grievance".

10.4. Breach notification. We will notify the Data Protection Board of India and affected data principals of any personal-data breach in accordance with the timelines and conditions in the DPDP Act and its rules.

11. Canada (PIPEDA and Quebec Law 25)

11.1. If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) applies, and Quebec Law 25 imposes additional obligations for Quebec residents.

11.2. Your rights. Subject to applicable law, you have the right to: (a) access the personal information we hold about you; (b) challenge the accuracy and completeness of the information and have it amended; (c) withdraw consent at any time, subject to legal or contractual restrictions; and (d) in Quebec, additional rights under Law 25, including rights related to automated decision-making and the right to be informed of any decision that significantly affects you.

11.3. Privacy officer. Our privacy officer for Canadian matters is privacy@medexamhelper.com, reachable at hello@medexamhelper.com. We rely on express consent for commercial electronic messages to Canadian recipients (CASL). You may complain to the Office of the Privacy Commissioner of Canada, and (for Quebec residents) to the Commission d'accès à l'information du Québec.

12. United States

12.1. State privacy laws. Several US states give residents rights over their personal information, including rights to access, delete, correct, and (where applicable) opt out of the sale or sharing of personal information, and to limit the use of sensitive personal information. We do not sell personal information and do not share personal information for cross-context behavioural advertising as those terms are used in the California CCPA/CPRA.

12.2. Categories, sources, purposes, third parties. Categories of personal information we collect are listed in section 2. Sources are you (directly) and our service providers. Business or commercial purposes are listed in section 2. Third parties to whom we disclose personal information are the sub-processors listed in our Sub-processors & Retention document.

12.3. Your rights. Subject to applicable state law, you may have the right to: (a) confirm whether we process your personal information and to access it; (b) delete personal information we have collected from you; (c) correct inaccurate personal information; (d) opt out of sale or sharing (not applicable — we do not sell or share); (e) limit the use of sensitive personal information (not applicable — we do not collect sensitive personal information as defined by CPRA); (f) non-discrimination for exercising your rights; and (g) appeal a decision if we decline your request.

12.4. Email (CAN-SPAM). Every marketing email identifies us as the sender, includes a valid physical postal address, includes a clear opt-out, and honours opt-out requests promptly. We do not use deceptive subject lines.

12.5. Children. We do not knowingly collect personal information from children under 13 (COPPA) or under the Age Gate (section 6), whichever is higher.

13. International transfers (general)

13.1. Where personal data is transferred outside your country of residence, we take steps to ensure that it is protected to a standard consistent with this notice and with applicable law, including by using contractual safeguards (UK IDTA / UK Addendum / EU SCCs as appropriate) and by carrying out transfer impact assessments. The hosting region for our primary infrastructure is [HOSTING REGION — Shan to fill]. Our LLM provider, MiniMax, processes consult transcript text and TTS audio requests in regions and under terms disclosed in our Sub-processors & Retention document.

14. Changes to this notice

14.1. We may update this notice. We will give you reasonable notice by email and, for material changes, by an in-product notice. Material changes include changes to the categories of data we collect, the purposes of processing, our lawful bases, our sub-processors, our retention periods, or your rights. The "Last updated" date at the top shows when it was last revised.

15. How to contact us

15.1. For any privacy question, request, or complaint, contact us at: general — hello@medexamhelper.com; Data Protection / Privacy — privacy@medexamhelper.com; post — [REGISTERED ADDRESS]. We aim to acknowledge privacy enquiries within five working days and to respond substantively within the timelines required by applicable law (one calendar month under the UK GDPR / EU GDPR; timelines under the DPDP Act; 30 days under PIPEDA). Regional contacts: EU representative (Article 27) — [EU REPRESENTATIVE]; UK representative (Article 27, if applicable) — [UK REPRESENTATIVE]; India grievance officer (DPDP) — [INDIA GRIEVANCE OFFICER], hello@medexamhelper.com; Canada privacy officer — privacy@medexamhelper.com.

← All legal documents