Legal
Privacy Policy
What we collect, why we collect it, who we share it with and the choices you have.
Last updated 17 September 2026
1. Data we collect
- Account details: your name, username, email, the university you choose at signup, an optional profile picture, and your password, which is stored hashed by Supabase Auth.
- Study data: the cards you rate, the questions and OSCE stations you answer, your test results, notes, bookmarks, streak, exam dates and study plan. This runs spaced repetition, your dashboard and your performance reports.
- Plan and stars: your plan, when it ends, and how many stars you have used each day.
- Purchases: order references, what you bought, the amount, and the payment status PayHere sends us. We never see your card number.
- Demo: to open the demo we ask for your first and last name, email, graduating year and optionally your country. Nothing you do inside the demo is saved.
- Devices: an account can be used on up to three devices. To manage that we store a random device ID in your browser, your browser details, your IP address and an approximate location (city and country) looked up from it.
- Technical data: error reports, which features are used, and standard server logs (IP address, browser, time).
- Things you send us: messages from the Contact and Feedback forms.
2. How we use it
- Run your account, your plan and your daily stars.
- Schedule your reviews and build your study plan and reports.
- Take payments and activate the plan you bought.
- Enforce the device limit and detect account sharing, fraud and abuse.
- Fix errors and improve the product.
- Reply to support requests and feedback.
- Send service emails, such as password resets and payment receipts. We do not send marketing emails.
3. We do not sell your data
QuizMed does not sell, rent or trade your personal information. We never give advertisers your name, email or study activity, and we do not pass your data to data brokers. Ads on the Free and Plus plans are served by Google, as described in section 7.
We share information only when:
- a provider listed in section 4 needs it to run the service, and then only what it needs;
- the law requires it, for example a valid court order;
- we need to investigate fraud, abuse or a credible security threat against you, us or other users.
4. Our providers
QuizMed runs on third-party services, each under its own terms. Some of them process data outside your country, including in the United States, the European Union and Australia.
- Supabase: database, sign-in and file storage.
- Vercel: hosting and server functions.
- PayHere: payments.
- Google: ads on the Free and Plus plans (Google AdSense and Google Ad Manager). See section 7.
- PostHog: product analytics, hosted in the EU.
- Sentry: error reports, with IP addresses removed where possible.
- Resend: sending service emails.
- ipapi: turning an IP address into an approximate location for the device list.
5. Security
Passwords are hashed by Supabase Auth, so we never see them. All connections use HTTPS. Card details go straight from your browser to PayHere and never touch our servers. Access to the database is restricted by role, and each account can read only its own data.
No system is perfectly secure. If you think your account has been compromised, change your password straight away and email support@quizmed.org.
6. Content protection
The study app has basic protections against copying, such as blurring the screen when the window loses focus and blocking common copy and print shortcuts. These collect no extra data about you.
7. Cookies, advertising and local storage
We use your browser’s local storage to keep you signed in, remember your theme and settings, keep a small offline copy of your study data, count the stars you have used today and hold your device ID.
The Free and Plus plans show ads; Pro has none. Ads are served by Google. Third-party vendors, including Google, use cookies to serve ads based on your previous visits to this and other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on those visits.
- You can opt out of personalised advertising in Google Ads Settings, or opt out of some third-party vendors’ cookies at aboutads.info.
- Visitors in the European Economic Area, the UK and Switzerland are asked for consent before personalised ads or advertising cookies are used, and can change that choice at any time.
- Learn how Google uses information from sites that use its services.
- We never pass your study activity, name or email to Google for advertising.
8. Your rights
Wherever you live, you can:
- see and change your name, username and email in Settings;
- ask for a copy of your data, or ask us to correct it;
- delete your account from Settings, which removes your profile, study data, notes, bookmarks and plan. Payment records are kept for accounting (see section 9) with your personal details removed;
- object to or ask us to limit how we use your data, and withdraw any consent you have given.
Depending on where you live (for example the EU, UK or California) you may have further rights under local law, including the right to complain to your data protection authority. Email support@quizmed.org for any request; we reply within 30 days.
9. How long we keep it
- Account and study data: for as long as your account exists.
- Payment records: at least 7 years, for tax and accounting.
- Demo sign-up details: up to 24 months, or until you ask us to delete them.
- Contact and feedback messages: up to 24 months, or until you ask us to delete them.
- Device records: while the device is on your account.
10. Children
QuizMed is not intended for anyone under 16. If you believe someone under 16 has created an account, email us and we will delete it.
11. Changes and contact
We may update this policy as the service changes, and will tell you about material changes in the app. For any privacy question or request, email support@quizmed.org.