Privacy Policy

DRAFT for legal review, not legal advice · last updated 2026-09-13

What we store

Administrators: e-mail address, name, sign-in times, and when they accepted the terms. For Program sign-ups: Program name, specialty, approximate learner count, and any note they send.
Examiners and learners: name, program site, training level, e-mail address (to send login codes), and a one-way hash of their login code.
Exam data: case materials uploaded by the Program, schedules, evaluations (ratings, critical actions, written comments), and an activity log of administrative actions and sign-ins.
Operational data: daily e-mail counts per Program and a short log of server errors, used to keep the Service running.

What we do not store

No patient health information (it is prohibited by the Terms). No readable login codes or passwords. No card or bank details: if a Program pays online, Stripe handles the payment and we keep only Stripe reference numbers, the plan status, and any discount code used. No tracking cookies or third-party analytics.

Where data lives and who processes it

Cloudflare hosts the Service and stores all data (D1 database, KV storage), encrypted in transit (HTTPS only) and at rest.
Brevo delivers transactional e-mail (sign-in links, codes, invitations, score reports). Recipient address, subject, and message content pass through Brevo for delivery.
Stripe processes subscription payments for Programs that pay online (the paying administrator's e-mail and payment details go to Stripe, not to us).

Who can see what

Program administrators see everything in their Program and nothing in any other. An administrator given a single test day sees only that test day.
An examiner sees only the learners scheduled in their room and the case materials for their module, and only while the test day is published (up to 6 days).
A learner sees only their own schedule and, after the Program releases results, their own score report, while the test day is published.
The platform operator can access Programs for approval, support, and maintenance. That access is recorded in the activity log.

Retention schedule

Data	Kept
Test days: rosters, cases, PDFs, schedules, scores	Until the Program deletes the test day or the Program
Automatic backups of a test day	Latest 30 snapshots; deleted together with the test day
Examiner and learner portal access	6 days from when the Program publishes (can be re-opened)
Sign-in links	Expire in 20 minutes to 3 days, single use; deleted 1 day after expiry
Administrator session records (time, IP address, browser)	Until the session expires or is signed out, then deleted within 1 day
Activity log	2 years
Daily e-mail counts	90 days
Server error log	30 days
Deleted data in database point-in-time recovery	Up to 30 days, then gone

When a test day or Program is deleted, it is removed from the live database and file storage immediately. Sign-ups that are not approved may be deleted at any time.

Cookies

Only strictly necessary session cookies (signed, HttpOnly, Secure). Administrator sessions last 14 days (platform-owner sessions 12 hours); signing out ends the session on our server, and "Sign out on all devices" ends every one. Examiner and learner sessions last up to 24 hours and never outlast the test day's access window.

Your rights

Learners and examiners can ask their Program administrator to correct or delete their information. Programs can export all of their data at any time, and a Program owner can delete the whole Program themselves (Administration → Delete this program) or ask us to.