Privacy Policy.

What we collect

• Your email address and password: to create and secure your account and to contact you about the product. Your password is stored in hashed form by our authentication provider (Supabase); we never see or store the plaintext.
• Account confirmation: when you sign up, we send a confirmation link to your email address to verify it.
• Your study-plan intake: when you set up your plan, we collect what you tell us: your target score, test date or application timeline, weekly availability, courses you've completed, other commitments, and your baseline practice score if you provide one.
• Your generated study plan and schedule: the plan we build for you based on your intake, stored so it persists between sessions.
• Your practice activity: the questions you attempt, the answers and reasoning you submit, your scores, error-pattern tags, and timestamps. This is the core of the service: it lets the tutor find your patterns and track your progress. When you log questions from outside sources, we store only how it went (your score, tags, and an optional note), never the question text itself.
• Flashcard review progress: which cards you've reviewed and how you rated them.
• Feedback you submit: if you use the in-app feedback form.
• Basic technical data: standard server and browser information (browser type, approximate region, log data) generated when you use the site, used to keep the service running and secure.

We do not collect payment information (nothing is for sale yet). We do not knowingly collect data from anyone under 18; PreMedulla is for adult pre-medical students.

How we use it

• To provide the service: grade your practice, build your error-pattern profile, generate and maintain your study schedule, and adapt what you study.
• To send you your account confirmation email, password reset emails, and occasional product communications. You can opt out of non-essential email anytime.
• To keep the service secure and working, and to improve it.

We do not sell your personal information, and we do not share it for advertising.

Who processes your data

We use a small set of trusted providers to run the service. They process data on our behalf, under their own security and privacy commitments:

• Supabase: stores your account and all app data (managed PostgreSQL with per-user row-level security so your records are isolated to you). Supabase also handles authentication, including password hashing and session management.
• Anthropic (Claude API): when your practice response is graded, the relevant content is sent to Anthropic's API to generate the assessment. Anthropic does not use data submitted through its API to train its models.
• Vercel: hosts the website and runs the serverless functions that power the app.
• Resend: sends our transactional email (account confirmation and password reset) from noreply@premedulla.com.

Where your data lives and how long we keep it

Your data is stored in the United States. We keep your account and practice data for as long as your account is active. If you ask us to delete your account and data, we will do so promptly, except where we are required by law to keep something. To close your account, email premedulla@gmail.com.

Your choices and rights

• Access or delete your data. Email premedulla@gmail.com and we will provide a copy of, or delete, your personal data. We aim to respond within 30 days.
• Opt out of non-essential email at any time by replying to any email we send or by emailing us directly.
• California residents: we do not sell or share your personal information. You may request access to or deletion of your personal data as described above.

If you are located outside the United States and have questions about how we handle your data, email premedulla@gmail.com.

How we protect your data

Data is encrypted in transit. Account and practice records are isolated per user through database-level access controls. Passwords are hashed by our authentication provider; we never handle or store plaintext passwords. No system is perfectly secure, but we take reasonable, stage-appropriate measures. If a breach affecting your data occurs, we will notify you as required by law.

Cookies and local storage

We use only what is needed to keep you signed in (an authentication token stored in your browser) and to run the site. We do not use third-party advertising trackers.

Children

PreMedulla is for adults 18 and older. We do not knowingly collect personal data from anyone under 18.

Changes to this policy

We will update this page when our practices change and revise the "Last updated" date. Material changes will be communicated to account holders.

Not affiliated with the AAMC

PreMedulla is not affiliated with the AAMC. The MCAT is a registered trademark of the Association of American Medical Colleges, which does not endorse this product.

Contact

premedulla@gmail.com