Privacy policy

Information we collect

• Account information: your email address, account identifier, sign-in and verification records, and any profile information you provide. Passwords are handled by our authentication provider and are never sent with study material for AI processing.
• Google sign-in information: if you choose Continue with Google, Google shares your name, email address and account identifier with us as permitted by that sign-in. We never receive your Google password.
• Study information: the professions and courses you choose, course enrollments, saved notes, notes read, answers, scores and session history. Most study progress is stored on your device (see below). Enrollment, download and security records are stored with your account.
• Personal documents: files you choose to upload, their names and sizes, extracted text, discovered topics, generated notes and quizzes, and saved quiz results.
• Technical information: service requests can include your IP address, device and browser type, timestamps, and security or error records.

We do not collect your location, contacts, photos (other than documents you choose to upload), or payment card details. We do not sell personal information and do not use it for targeted advertising.

How we use your information, and why

• To provide the service you asked for (performing our agreement with you): creating and securing your account, email verification and password reset, opening your courses, saving progress, and running the document feature.
• Document features you request: when you choose to import study material and request topic discovery, notes or quizzes, relevant material is sent to Google Gemini to carry out that request. These optional features are described below.
• For security and fair use (our legitimate interests): preventing abuse, bulk copying of the course library and fraud, enforcing reasonable download limits, and diagnosing failures.
• To meet legal obligations where they apply, such as responding to lawful requests.

Your documents and AI

Importing study material is optional. When you choose to import a document, relevant text or scanned page fragments are sent to Google Gemini for topic discovery. When you request notes or quizzes, the relevant material is processed to generate that output. Use these features only for material you have permission to upload. Remove patient records and other personal or confidential information before uploading.

You can stop using optional document processing by not importing more material or requesting further processing. To remove an uploaded document and its generated content, open it in My documents and choose Remove document. This cannot retract processing already completed by a provider. Existing documents are otherwise kept until their 30-day retention period ends. Keep your originals.

Original files are stored privately in Supabase. Our server extracts text; relevant text is sent to Google Gemini to find topics and generate the notes or quizzes you request. Scanned PDF pages may be sent as PDF fragments for transcription. Generated notes and quizzes stay in your private document library and are never added to the shared course library or shown to other users.

Google processes submitted material under its Gemini API terms and privacy policy. We cannot promise that information sent to an external provider never appears in that provider’s operational or abuse-prevention records. Do not submit sensitive patient information.

Uploaded documents are deleted automatically 30 days after upload, together with their extracted text, generated notes, quizzes and saved document results. You can remove a document sooner at any time.

AI output is a study aid and can contain mistakes. It is not medical advice, diagnosis or treatment. Check clinical details against your source and approved teaching materials. The practice library’s clinical accuracy has not been independently reviewed.

Service providers who process data for us

• Supabase: authentication, private file storage and database.
• Vercel: website hosting and server functions.
• Resend: verification and password-reset emails.
• Google: Gemini document processing (only when you use the document feature) and Google sign-in (only if you choose it).
• Expo: mobile app delivery and updates.

Each provider receives only what it needs to perform its role and processes it under its own terms. We may also disclose information if required by law, to protect the safety and rights of our users or the public, or as part of a merger or transfer of the service, in which case this policy would continue to apply. No advertising SDK is used in the current release.

Payments: where checkout is available, website payments in Ghana are processed by Paystack under our XQRA merchant account. We send your account email, payment reference, selected plan and account identifier to link the payment to your access. Card and mobile-money authentication details are handled by the payment provider, not stored by Health Students. App-store purchases, when enabled, are processed by Apple or Google; RevenueCat helps verify store purchase identifiers and access for your account. We keep payment status, amount, currency, plan and access dates to restore access and handle payment support. Deleting your account removes its link to our payment ledger; payment providers retain their own records under their privacy policies and applicable obligations. Purchases marked unavailable cannot be made.

Where your data is processed

Our database and file storage are hosted by Supabase in the European Union (Ireland). Our website is served by Vercel through data centres and edge locations in several countries, and our other providers may process data in the United States and elsewhere. When data leaves your country, it is protected by our providers’ contractual and security commitments.

Cookies and storage on your device

• Sign-in cookies: an encrypted, HTTP-only session cookie keeps you signed in for up to 7 days. Short-lived cookies (up to 10 minutes) protect password reset and Google sign-in. We use no advertising or tracking cookies.
• Study progress: saved notes, notes read, practice sessions and history are kept in your browser or app storage, linked to your account on that device.
• Course copies: on the website, the course you open is kept in your browser for up to 24 hours so the app opens quickly. On mobile, selected courses are kept in an encrypted offline cache for up to 7 days. Both are removed when you log out or delete your account.
• App shell: the website stores its own pages, styles and images so it loads quickly. It never stores your account content there.

You can clear this data at any time through your browser or device settings. Clearing it signs you out and removes progress stored only on that device.

How long we keep data

• Uploaded documents and everything generated from them: 30 days after upload, then deleted automatically. Earlier if you remove them.
• Account, enrollment and security records: while your account exists. Removed when you delete your account.
• Course copies on your device: up to 24 hours on the website and up to 7 days on mobile.
• Provider logs and backups: kept by our providers for their limited security and recovery cycles, then deleted.

Removing the app alone does not delete server-side account data. Use Delete account, below.

Security

Connections use HTTPS. Sessions are encrypted, personal-document storage is private, and every request is checked against its owner on the server. The course library is stored encrypted and protected by download limits. These protections reduce risk; no service can guarantee that data can never be copied or compromised. If we learn of a breach that affects you, we will notify you as the law requires.

Delete a document or your account

In My documents, remove a document to delete its stored upload, scans, extracted text, generated notes, quizzes and saved document results. Your original file on your device is unchanged.

To delete your account in the app, open More → Profile → Delete account. On the website, open Delete account and sign in if asked. Enter your current password and confirm. If you only use Google sign-in, set a password first with Forgot password on the sign-in page.

Deletion removes your account and its documents, enrollments and private study records, and clears that account’s data on the device you delete from. A delayed cleanup removes any upload that finishes after deletion. Data in providers’ backups or security records may persist until their retention cycles end.

If you cannot access your account, email us from its registered address to request help or deletion. We may need to verify ownership before acting.

Your rights

Depending on where you live, including under Ghana’s Data Protection Act, 2012 (Act 843) and similar laws, you can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct information that is inaccurate or incomplete;
• delete your information, or stop or limit how we use it;
• withdraw any consent you have given without affecting earlier processing, and stop using optional document features.

Email us using the address below and we will respond within a reasonable time, normally 30 days. If you are not satisfied with our response, you can complain to the Data Protection Commission of Ghana or the data protection authority where you live.

Children

Health Students is intended for health students preparing for professional study and licensure. It is not directed at children under 16, and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will delete it.

Changes to this policy

We update this page when our practices change, and the date at the top shows the current version. If a change significantly affects how we use your information, we will tell you in the app or by email before it takes effect.

Contact us

For support, privacy questions, access or correction requests, or deletion requests, email paystackcheckoutt@gmail.com.