Privacy Policy

The data controller responsible for your personal data is:

If you have any questions about how we handle your data, or wish to exercise your rights, please contact us at the email address above.

We collect the following categories of personal data:

• Account data: your name, email address, and hashed password, collected when you register. Optionally: target country, current academic status, and target entry year (collected during post-signup onboarding).
• Learning activity data: your answers to Q-Bank questions (selected option, correctness, time spent), study session state, question bookmarks, and Codex annotations.
• Mock exam data: your responses and scores for timed mock examinations.
• Payment metadata: when you subscribe to a paid plan, Stripe processes your payment card details. We store only non-sensitive billing metadata (Stripe customer ID, subscription ID, plan, and current period end). We never store full card numbers.
• Technical and device data: your IP address, browser/device type, and access timestamps, collected automatically by our hosting infrastructure (Vercel) for security and performance.
• Communications: any messages you send us via email or support channels.

We process your personal data only where we have a valid legal basis under Article 6 GDPR:

• Performance of a contract (Art. 6(1)(b)): providing your account, delivering Q-Bank access, processing subscription payments, and maintaining your learning progress.
• Legitimate interests (Art. 6(1)(f)): fraud prevention, rate-limiting abuse, platform security, and aggregate analytics to improve our service. These interests are balanced against your rights and do not override them.
• Consent (Art. 6(1)(a)): sending you marketing communications (study tips, product news, offers). You may withdraw this consent at any time by emailing us or using the unsubscribe link in any marketing email.
• Compliance with legal obligations (Art. 6(1)(c)): retaining financial records as required by applicable tax and accounting law.

• Creating and maintaining your account and subscription.
• Delivering personalised learning features (performance tracking, spaced-repetition recommendations, adaptive Q-Bank filters).
• Processing payments and issuing receipts.
• Sending transactional emails (account confirmation, password reset).
• Sending marketing emails where you have given consent, including study tips and product updates.
• Detecting and preventing fraud, abuse, and unauthorised access.
• Aggregated, anonymised analytics to understand how the platform is used and to improve it.
• Complying with applicable law.

We share your data with the following sub-processors, each bound by data processing agreements (DPAs) and appropriate safeguards:

We do not sell your personal data to any third party, and we do not share it with advertisers.

• Account data: retained for the duration of your account and deleted within 30 days of a verified deletion request.
• Learning activity data: retained for the duration of your account to power performance tracking; deleted on account deletion.
• Payment records: retained for 8 years to comply with Hungarian and EU financial record-keeping obligations (Act C of 2000 on Accounting), even after account deletion.
• Server logs: retained for up to 90 days by Vercel for security and debugging purposes.
• Marketing consent records: retained until you withdraw consent, plus a further period sufficient to demonstrate compliance.

Some of our sub-processors are based outside the European Economic Area (EEA), primarily in the United States. Where such transfers occur, we rely on European Commission Standard Contractual Clauses (SCCs, Commission Decision 2021/914) and, where available, adequacy decisions to ensure an equivalent level of data protection. You may request a copy of the relevant safeguards by contacting [email protected].

Under GDPR Articles 15–22, you have the following rights regarding your personal data:

• Right of access (Art. 15): request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.
• Right to restriction of processing (Art. 18): request that we restrict processing of your data in certain circumstances.
• Right to data portability (Art. 20): receive your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interests, including profiling and direct marketing.
• Right to withdraw consent (Art. 7(3)): where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right not to be subject to automated decisions (Art. 22): we do not make solely automated decisions that produce legal or similarly significant effects.

To exercise any of these rights, email [email protected]. We will respond within 30 days. We may ask you to verify your identity before acting on the request.

We use strictly necessary cookies for authentication (managed by Supabase) and local storage for user preferences such as theme selection and cookie consent state. We may use anonymised analytics (Vercel Analytics). For full details, please read our Cookie Policy.

PreMedEU is intended for users who are 16 years of age or older. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by a prominent notice on the platform at least 14 days before the changes take effect. Continued use of PreMedEU after the effective date constitutes acceptance of the updated policy.

If you believe we have processed your personal data in breach of the GDPR, you have the right to lodge a complaint with a supervisory authority. In Hungary, the competent supervisory authority is:

You may also lodge a complaint with the supervisory authority of your EU member state of habitual residence or place of work.