Privacy Policy
Effective 2026-10-22 · Version 2026-10-22
[to be completed] (“we”) operates MedIQ and is responsible for your personal data (the “controller”). Contact: [to be completed].
What we collect and why
| Data | Why | Legal basis (GDPR terms) |
|---|---|---|
| Name, email address, password (stored only as a secure hash by our authentication provider) | Your account, sign-in, account emails | Contract |
| Your answers, the time spent on them, block settings and names, notes, flashcards and reviews, bookmarks, study preferences | To provide the question bank, your history, analytics and spaced repetition | Contract |
| Issue reports you send about questions | To fix content | Legitimate interest |
| Purchases: plan, amount, currency, dates, payment status and the payment provider's reference. Card details are handled by Stripe, never by us | To give you access, handle refunds, keep accounting records | Contract; legal obligation (tax and accounting) |
| Technical data: IP address and browser details processed by our security check (Cloudflare Turnstile) and in our providers' security logs | To protect sign-up and sign-in from abuse and keep the service secure | Legitimate interest |
| Usage and sign-in records (how many practice blocks and questions you use, how fast answers are submitted, and how many sessions, devices and networks sign in to your account) | To enforce the one-person-per-account and no-bulk-copying rules in the Terms | Legitimate interest |
We combine students' answers into anonymous statistics, such as the percentage who chose each option. These contain no personal data.
We don't sell your data, show ads, or use analytics or advertising trackers.
Cookies and storage on your device
We use only what the service needs:
- sign-in cookies that keep you logged in;
- storage in your browser (IndexedDB and local storage) that holds exam progress, unsent answers and notes, and your display preferences, so nothing is lost when your connection drops;
- Cloudflare Turnstile, which may set a cookie during the security check.
None of these track you across other websites, so no consent banner is needed.
Signing out clears MedIQ's storage on that device. If unsent work is waiting, we ask you first.
Who processes data for us
Each provider acts on our instructions under a data processing agreement:
| Provider | Role | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | European Union (Ireland) |
| Vercel | Website hosting | Global network; may process requests outside your country |
| Stripe | Payments | United States and other countries |
| Cloudflare (Turnstile) | Security check on sign-up, sign-in and password reset | Global network |
| Resend | Sending account emails | United States |
Some providers process data outside your country, including in the United States. Where the law requires it, these transfers rely on the providers' standard contractual clauses or an adequacy decision.
How long we keep it
- Account data is kept while your account exists.
- When you delete your account, your profile, answers, history, notes, flashcards, bookmarks and preferences are deleted permanently and immediately.
- Payment records are kept without your name or email, for as long as tax and accounting law requires.
- Our database provider keeps backups for up to 7 days, after which deleted data is gone from them too.
Your rights
- Download your data: Settings → Data & privacy → Download my data, in a standard format.
- Correct your name in Settings → Profile; change your email or password in Settings → Account & security.
- Delete your account: Settings → Data & privacy.
- For anything else write to [to be completed], for example to object to processing, restrict it, or ask a question. We reply within one month.
- If you're in the EU, UK or another country with a data-protection authority, you can complain to it.
Security
- Data travels encrypted (HTTPS).
- Access is limited by role, and every database request is checked against the signed-in user.
- Question images are served through short-lived signed links.
- Staff actions on content are logged.
Children
MedIQ isn't for anyone under 18, and we don't knowingly collect their data.
Changes
We'll post updates here with a new date, and tell you by email or in the app if they're significant.