Privacy Policy
DRAFT for legal review, not legal advice · last updated 2026-09-13
What we store
- Administrators: e-mail address, name, sign-in times, and when they accepted the terms. For Program sign-ups: Program name, specialty, approximate learner count, and any note they send.
- Examiners and learners: name, program site, training level, e-mail address (to send login codes), and a one-way hash of their login code.
- Exam data: case materials uploaded by the Program, schedules, evaluations (ratings, critical actions, written comments), and an activity log of administrative actions and sign-ins.
- Operational data: daily e-mail counts per Program and a short log of server errors, used to keep the Service running.
What we do not store
No patient health information (it is prohibited by the Terms). No readable login codes or passwords. No card or bank details: if a Program pays online, Stripe handles the payment and we keep only Stripe reference numbers, the plan status, and any discount code used. No tracking cookies or third-party analytics.
Where data lives and who processes it
- Cloudflare hosts the Service and stores all data (D1 database, KV storage), encrypted in transit (HTTPS only) and at rest.
- Brevo delivers transactional e-mail (sign-in links, codes, invitations, score reports). Recipient address, subject, and message content pass through Brevo for delivery.
- Stripe processes subscription payments for Programs that pay online (the paying administrator's e-mail and payment details go to Stripe, not to us).
Who can see what
- Program administrators see everything in their Program and nothing in any other. An administrator given a single test day sees only that test day.
- An examiner sees only the learners scheduled in their room and the case materials for their module, and only while the test day is published (up to 6 days).
- A learner sees only their own schedule and, after the Program releases results, their own score report, while the test day is published.
- The platform operator can access Programs for approval, support, and maintenance. That access is recorded in the activity log.
Retention schedule
| Data | Kept |
|---|---|
| Test days: rosters, cases, PDFs, schedules, scores | Until the Program deletes the test day or the Program |
| Automatic backups of a test day | Latest 30 snapshots; deleted together with the test day |
| Examiner and learner portal access | 6 days from when the Program publishes (can be re-opened) |
| Sign-in links | Expire in 20 minutes to 3 days, single use; deleted 1 day after expiry |
| Administrator session records (time, IP address, browser) | Until the session expires or is signed out, then deleted within 1 day |
| Activity log | 2 years |
| Daily e-mail counts | 90 days |
| Server error log | 30 days |
| Deleted data in database point-in-time recovery | Up to 30 days, then gone |
When a test day or Program is deleted, it is removed from the live database and file storage immediately. Sign-ups that are not approved may be deleted at any time.
Cookies
Only strictly necessary session cookies (signed, HttpOnly, Secure). Administrator sessions last 14 days (platform-owner sessions 12 hours); signing out ends the session on our server, and "Sign out on all devices" ends every one. Examiner and learner sessions last up to 24 hours and never outlast the test day's access window.
Your rights
Learners and examiners can ask their Program administrator to correct or delete their information. Programs can export all of their data at any time, and a Program owner can delete the whole Program themselves (Administration → Delete this program) or ask us to.