Privacy Policy

Last updated [EFFECTIVE DATE] · Data controller: Progress Note · Contact: [PRIVACY EMAIL]

This policy explains what personal information Progress Note collects, why, who it is shared with, and the choices you have. It covers the Progress Note website and application.

1. Information we collect

1.1 Information you give us

Account details — name, email address, username, and the study track you select at registration (for example Nursing/NCLEX, Pre-Med/MCAT, Medical Student, or a residency specialty).
Profile and study settings — training level, notification preferences, quiet hours, accessibility preferences, and any exam date you enter.
Content you submit — question feedback and challenges, board posts, direct messages, and study-group activity.
Support correspondence — messages you send us.

1.2 Information generated by your use

Performance data — questions attempted, answers selected, correctness, time taken, confidence ratings, self-tagged error types, spaced-repetition scheduling, streaks, points and achievements.
Derived analytics — calculated indices such as readiness, retention and burnout-risk scores, and predicted score estimates. These are inferences we generate about you, not measurements from any examination body.
Product analytics — we record in-app events (for example starting a session, generating an explanation, or cancelling a plan) together with your user identifier and email address, so we can understand how features are used and diagnose faults. This analytics data is stored in our own backend, not sent to an advertising network.
Referral codes — if you arrive through a referral link, we store that code in your browser and associate it with your account when you register, so referrals can be credited.
Technical data — IP address, browser and device type, and log data, used for security and to operate the Service.

1.3 Payment information

Payments are processed by Stripe. We do not receive or store your full card number. We receive limited billing status information (such as plan, renewal date and whether a payment succeeded).

1.4 Information stored on your device

We store data locally in your browser to make the Service work. This is not transmitted to us except where noted:

Local storage — theme, study-mode preferences, exam date and type, dismissed reminders and feature suggestions, weekly-recap state, locally tagged error types, and answers recorded while you are offline (queued and sent to us when you reconnect).
Offline packs (IndexedDB) — if you download questions for offline study, the questions and their images are stored on your device until you delete the pack.

We do not use advertising cookies and we do not sell personal information.

2. How and why we use it

Purpose	Legal basis (UK/EU GDPR)
Create and operate your account; deliver study sessions and scheduling	Performance of a contract
Generate progress analytics, predicted scores and recommendations	Performance of a contract
Process payments and manage subscriptions	Performance of a contract
Send service messages and reminders you have enabled	Consent (reminders) / legitimate interests (service notices)
Secure the Service, prevent abuse, debug faults	Legitimate interests
Improve content and features using aggregated or de-identified data	Legitimate interests
Comply with legal obligations	Legal obligation

We do not use your data to make decisions with legal or similarly significant effects about you, and we do not use it for automated profiling beyond the study analytics described here.

3. AI processing

If you use AI coaching features, the question text, its answer options, the answer you selected and the reference explanation are sent to Google (Gemini API) to generate a response. Your name, email address and account identifier are not included in that request — only the study content above. Generated responses may be cached on your device. Do not enter personal or patient information into any free-text field used with these features.

4. Who we share it with

We share personal information only as described below. We do not sell it.

Recipient	Purpose
Base44	Application backend and database hosting
Supabase	Real-time "studying now" presence (transient; no study records stored)
Stripe	Payment processing and subscription management
Google (Gemini API)	Generating AI coaching responses (Section 3)
[HOSTING PROVIDER — e.g. Netlify]	Website hosting and delivery
Your institution	Where your access is funded or provided by a school or program (Section 5)

We may also disclose information where required by law, to enforce our Terms, to protect rights or safety, or in connection with a merger or acquisition (you will be notified).

5. Institutional access and shared reports

If a school, program or institution provides or funds your access, it may view your activity and performance and assign work to you. Progress-report links may be generated and shared with instructors. Anyone holding such a link can view that report — treat it as confidential and share it only with people you intend to see it. Your institution's own privacy policies also apply. If you are a US student and your institution treats this data as an education record, its FERPA obligations may apply to it.

6. Retention

Account and study data: kept while your account is active.
After deletion: removed or de-identified within [30–90] days, except where we must keep records longer (for example transaction records for tax and accounting).
Backups: deleted data may persist in encrypted backups for a limited period before being overwritten.
Aggregated or de-identified statistics that cannot identify you may be kept indefinitely.

7. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, port, restrict or object to processing of your personal information, and to withdraw consent. To exercise any of these, email [PRIVACY EMAIL]. We will respond within the period required by applicable law and will not discriminate against you for exercising a right.

Access and deletion — request a copy of your data or deletion of your account.
Reminders — turn notification categories and quiet hours on or off in settings at any time.
Accountability partners and social features — these are opt-in; nothing is shared with another user until you turn them on, and you may withdraw at any time.
Offline data — delete downloaded packs from within the app to remove them from your device.
EU/UK users — you may lodge a complaint with your local supervisory authority.
California residents — you have rights under the CCPA/CPRA, including to know, delete, correct, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined.

8. Children

You must be at least 16 to hold an account. The Service is not directed to children under 13 and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact [PRIVACY EMAIL] and we will delete it.

9. Security

We use access controls, encryption in transit, and reputable infrastructure providers to protect your information. No online service can be guaranteed completely secure, and we cannot promise absolute security. Keep your password confidential and treat any shareable report link as sensitive. If we become aware of a breach affecting your personal information, we will notify you and any regulator as required by law.

10. International transfers

We and our providers may process your information in countries other than your own, including the United States. Where personal information is transferred out of the UK/EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. [Confirm with counsel which transfer mechanism applies to each processor.]

11. Changes to this policy

We may update this policy. We will post the updated version here with a new "last updated" date, and for material changes give reasonable notice by email or in-app before they take effect.

12. Contact

Progress Note
[REGISTERED ADDRESS]
[PRIVACY EMAIL]