Privacy Policy

1. What we collect

Account data: email, display name, role (student/teacher/admin), language, timezone.
Teacher data: license number, issuing authority, country, expiry.
Usage data: courses viewed, watch progress, Q&A activity, certificates earned.
Payment data: handled by Stripe. We never see your card number.
No PHI: we do not collect patient information. The Platform is for clinician education, not patient care.

2. How we use it

• To provide the Platform (auth, course access, certificates).
• To process payments and pay teachers.
• To send transactional emails (enrollment, reminders, receipts).
• To send marketing emails (only with explicit opt-in; unsubscribe in every email).
• To improve the Platform (aggregated, anonymized analytics).

3. Where data lives

All data is stored in DigitalOcean's Frankfurt (fra1) region. Object storage is on DigitalOcean Spaces. Backups are taken daily. Data residency is regional today; a residency selector is on the v1.1 roadmap.

4. Who we share with

• Stripe: payment processing (PCI-DSS compliant).
• LiveKit Cloud: live video (no recording on their side after session ends).
• SendGrid: transactional email.
• Cloudflare: DNS and DDoS protection (no data content passes through).
• Sentry: error tracking (stack traces only, no PII).

We do not sell your data. We do not share it for advertising.

5. Your rights

You can access, correct, export, and delete your account at any time from Settings. For data portability requests, email privacy@medlearnapp.com — we respond within 30 days.

6. Cookies

We use first-party cookies for authentication (JWT) and locale preference. No third-party tracking cookies.

7. Compliance

GDPR (EU). Kuwait PDP Law 2024. CCPA (California). HIPAA is not applicable — we don't store PHI.

8. Contact

Data Protection Officer: dpo@medlearnapp.com.
Postal: MedLearn, Kuwait City, Kuwait.