Privacy Policy

Effective 29 September 2026

This page explains what information the MedPal app collects, why we collect it, and the choices you have.

1. Who we are

MedPal is a medical education app for medical students, offering recorded lectures, study materials and practice quizzes. This policy covers the MedPal mobile app and the services behind it. It does not cover other websites you may reach through links inside MedPal.

2. What we collect

Account information

• Your name and email address, used to create and identify your account.
• Your password, which is hashed by our authentication provider (Firebase Authentication). MedPal never sees or stores it in plain text.
• A phone number, only if you choose to add one when you sign up. It is used for phone-based verification during account recovery.

Content you add

• A profile picture, only if you choose to upload one. This requires your permission to use the camera or photo library.

Learning activity

• Which modules and lectures you view, and your progress through them.
• Your quiz and question-bank results, so you can track your progress.
• When you were last active and which days you used the app, used to count how many students are active.

Device and security information

• A random device identifier created by the app and kept in your device's secure storage, so your account can be used on one device at a time. It is not your advertising identifier and is not shared with anyone.
• Security events linked to your account, such as attempts to record or mirror lecture content, and sign-in attempts from a device other than your registered one.
• A short-lived app attestation token (Apple App Attest via Firebase App Check), used only to confirm requests come from a genuine copy of the app.

The app does not collect your location, contacts, health data or payment information.

3. How we use it

• To create and maintain your account and let you sign in securely.
• To deliver lectures, materials and quizzes and save your progress.
• To send account messages, such as verification codes and password resets, through our email provider.
• To prevent abuse, such as automated sign-ups, account sharing across devices and recording of course content.
• To count active students for our own internal dashboard.

We do not use your information for advertising and do not track you across other companies' apps or websites.

4. Who we share it with

We don't sell your personal information. We share it only with the service providers that help us run MedPal:

We may also disclose information if required by law, or to protect the rights and safety of MedPal, our users or the public.

5. How we protect it

• All traffic between the app and our servers is encrypted (HTTPS), and the app verifies our server's certificate directly (certificate pinning).
• Passwords and one-time verification codes are never stored in plain text.
• You can only read or change your own records; administrative access is separately authenticated.
• Sign-in and password-reset requests are rate-limited.

6. How long we keep it

We keep your account and learning data while your account is active. If you delete your account, we delete or anonymize your personal data, except where we must keep certain records to meet legal obligations.

7. Your choices

• View or update your information from your profile in the app.
• Delete your account: open Profile → Delete My Account in the app to permanently delete your account and data. If you can't sign in, email us and we'll complete the deletion within 30 days.
• Ask what we hold about you, or ask us to correct it, by emailing us.

8. Age requirement

MedPal is intended for medical students and is not directed at children. You must be at least 16 years old to create an account. If you believe a child has given us personal information, contact us and we will delete it.

9. Changes to this policy

We may update this policy as MedPal changes. We'll update the effective date above and, where appropriate, notify you in the app.

10. Contact us