Privacy Policy

1. Who we are

USMLEWise (“we”, “us”, “our”) provides online medical-education courses, notes and study resources at usmlewise.com. For data protection purposes the data controller is [Registered company name], [Registered business address].

If you have any question about this policy or your data, contact us at admin@usmlewise.com.

2. The data we collect

2.1 Information you give us

• Account details — your name, email address and password. Passwords are stored only as a salted hash; we never see or store your actual password.
• Sign-in with Google — if you register using Google, we receive your name and email address from your Google account. We do not receive your Google password.
• Your notes — any personal notes you write against a lesson, including the timestamp they relate to. These are private to your account.
• Correspondence — messages you send us by email or through support requests.

2.2 Information about your learning

• Course progress — which lessons you have watched, how far through each video you are, and which lessons you have marked complete.
• Purchases and access — your membership type, which individual courses you own, and your payment history (amount, currency, status and date).

2.3 Activity and usage data

So that we can understand how the platform is used and improve it, we record events tied to your account. Each event stores the type of action, the area of the platform it happened in, the course or lesson concerned, and the time it occurred:

• logins, and whether you signed in by email or Google;
• pages you open inside your student dashboard;
• lessons you open, videos you start and PDFs you view;
• resources you download;
• lessons you complete and notes you create;
• the date and time you were last active.

This data is visible to our administrators in aggregate and per student. We use it to see which courses and resources are useful, to spot students who may be struggling, and to plan new content. We do not use it for advertising, and we do not sell it.

2.4 Payment information

Payments are processed by Stripe. Your card number, expiry date and security code are entered directly with Stripe and are never sent to or stored on our servers. We retain only the transaction record and a Stripe customer reference so that we can confirm your access, issue receipts and handle refunds.

2.5 Technical data

Our servers keep standard logs needed to operate and secure the service, and we set a session cookie so that you stay signed in. See section 8 on cookies.

3. Why we use your data, and our legal basis

Where the UK/EU General Data Protection Regulation applies, we rely on the following legal bases:

• To provide the service you signed up for — creating your account, giving access to purchased courses, saving your progress and notes, processing payments. Legal basis: performance of a contract.
• To operate, secure and improve the platform — usage analytics, diagnosing faults, preventing fraud and unauthorised account sharing. Legal basis: our legitimate interests in running a reliable, sustainable service, balanced against your rights.
• To communicate with you — service messages such as password resets, receipts and important changes. Legal basis: performance of a contract and legitimate interests.
• Marketing emails, if we send them — legal basis: your consent, which you can withdraw at any time.
• To meet legal and tax obligations — retaining transaction records. Legal basis: legal obligation.

4. Who we share data with

We do not sell your personal data and we do not share it for others’ advertising. We share only what is necessary with the service providers that run the platform:

• Stripe — payment processing and fraud prevention.
• Google — if you choose to sign in with Google, and where lesson material is hosted on Google Drive or Google Docs.
• Our hosting provider — servers and databases that store your account.
• Email delivery provider — sending password resets and service messages.
• Video hosting providers — where a lesson video is embedded, the provider (for example YouTube or Bunny Stream) may receive your IP address and set its own cookies when the player loads. Their privacy policies apply to that processing.

We may also disclose data where required by law, or to establish or defend legal claims, or as part of a merger or sale of the business (in which case we will tell you first).

5. International transfers

Our students are spread across many countries and some of our providers operate outside your country of residence. Where personal data is transferred out of the UK or European Economic Area, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or the European Commission’s Standard Contractual Clauses.

6. How long we keep data

• Account, progress and notes — for as long as your account is open, and for up to 12 months afterwards in case you return.
• Activity data — up to 24 months, after which it is deleted or aggregated so it can no longer identify you.
• Payment and tax records — for as long as the law requires, typically six to seven years.
• Records of your acceptance of these policies — for as long as your account exists, plus six years.

7. Your rights

Depending on where you live, you have some or all of the following rights:

• Access — get a copy of the personal data we hold about you.
• Correction — have inaccurate data corrected.
• Erasure — ask us to delete your data, where we have no overriding obligation to keep it.
• Portability — receive your data in a portable format.
• Restriction and objection — object to processing based on our legitimate interests, including our usage analytics.
• Withdraw consent — where we rely on consent, withdraw it at any time.
• Complain — lodge a complaint with your data protection authority. In the UK this is the Information Commissioner’s Office.

If you are a California resident, you additionally have the right to know what personal information we collect and how it is used, to request deletion, to opt out of the “sale” or “sharing” of personal information (we do neither), and not to be discriminated against for exercising these rights.

To exercise any right, email admin@usmlewise.com. We will respond within the period required by law — one month under the UK/EU GDPR and 45 days under California law. We may need to verify your identity first.

8. Cookies

We keep our own cookie use to the minimum needed to run the service:

• Essential session cookies — keep you signed in and protect forms against cross-site request forgery. The platform cannot work without these.
• Preferences — remember choices such as light or dark theme.

We do not use advertising or cross-site tracking cookies. Our usage analytics are recorded against your account on our own servers rather than by a third-party advertising network. Embedded video players may set their own cookies as described in section 4; you can block these in your browser settings, though some lessons may then not play.

9. Security

We protect your data with measures including hashed passwords, encrypted connections (HTTPS), access controls restricting administrator access, and encryption of sensitive configuration values. No system is perfectly secure, so please use a strong, unique password and tell us immediately if you believe your account has been compromised.

10. Children

The platform is intended for medical students and qualified professionals. It is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy as the platform develops or the law changes. When we make a material change we will update the version number above and ask you to review and accept the new version next time you sign in. The governing law for this policy is that of [Country/State whose law governs].

12. Contact us

Questions, requests or complaints: admin@usmlewise.com, or write to [Registered company name], [Registered business address].