In short: we keep your account details, your answers and your purchases so the service works. We do not sell your data and we do not use advertising trackers. You can ask for a copy or deletion at any time.
What we collect
- Account: name, email address and an encrypted password.
- Study data: the questions you answer, your scores, time spent and which exam you are preparing for, so we can show progress and weak areas.
- Purchases: which pass you bought, when and for how much. Card details go straight to our payment provider; we never see the full card number.
- Support messages you send us.
- Technical data: IP address and browser type in server logs, kept for security.
Why we use it
To provide the service you bought (contract), to keep the platform secure and prevent account sharing (legitimate interest), to send emails about your pass such as expiry reminders (contract), and to meet tax and accounting rules (legal obligation). We send marketing emails only if you opt in, and every one has an unsubscribe link.
Cookies
We use only essential cookies: to keep you signed in and to run checkout. We do not use advertising or cross-site tracking cookies.
Who processes your data
- Our web host, which stores the site and database.
- Our payment provider, which handles card payments.
- Our email provider, which delivers account emails.
- When you use the AI tutor, it sends the question you are viewing and your message to our AI provider to generate an explanation. Do not include patient-identifiable information.
These providers act on our instructions. Some are outside your country; where needed we rely on standard contractual safeguards.
How long we keep it
Account and study data: while your account is open and for 24 months after your last pass expires, then deleted. Purchase records: as long as tax law requires (usually 6 to 7 years). Server logs: up to 90 days.
Your rights
You can ask to see, correct, export or delete your data, or object to how we use it. Email support@medpassexams.com from your account address and we will reply within 30 days. You can also complain to the data-protection authority in your country.
Children
The service is for health professionals and students aged 18 and over.
Changes
If we change this policy in a way that matters, we will tell account holders by email before it takes effect.
Last reviewed October 2026