The short version: we collect what we need to deliver your purchase, run our website, and improve the product. We don't sell your data. We use Google Analytics and the Meta (Facebook) Pixel for analytics and advertising. You can ask us to access, correct, or delete your data at any time.
Who We Are
This privacy policy applies to medschoolzone.com ("MedSchoolZone," "we," "our," or "us"). MedSchoolZone provides high-yield medical study notes as digital PDFs to medical students and exam candidates worldwide.
We are the data controller for the personal data described in this policy, meaning we decide why and how it's processed.
What We Collect
We collect personal data in three ways: when you give it to us directly, automatically when you use our site, and from a small number of trusted third parties.
Data you give us
- Account & order details - your name, email address, country, and the products you've purchased.
- Payment details - handled and stored by our third-party payment processor, not by us. We only receive a confirmation that payment succeeded, the last four digits of the card, the card brand, and the billing country.
- Communications - messages you send through our contact form, support emails, and any information you choose to share with us (e.g. content suggestions or error reports).
- Marketing preferences - whether you've opted in to receive emails from us, and which lists you're on.
Data we collect automatically
- Device & browser data - IP address, approximate location (city / country level), browser type and version, operating system, screen size, and device type.
- Usage data - pages you visit, links you click, time spent on each page, referring URL, and how you arrived on our site.
- Cookies & similar technologies - see Cookies & tracking.
Data from third parties
- Advertising platforms - if you arrive on our site through an ad, the advertising platform (such as Meta) shares limited information with us about that click so we can measure ad performance.
- Analytics providers - aggregated insights about how visitors find and use our site.
How We Use Your Data
We use personal data only for the purposes listed below.
- Deliver the product - process your purchase, send your download links, give you access to your account, and respond to support requests.
- Run the business - handle refunds, prevent fraud, comply with tax and legal obligations, and keep our records accurate.
- Improve the product - analyze how the site and notes are used so we can fix what's broken and prioritize what to build next.
- Marketing - send you product updates, offers, and educational content if you've opted in. You can unsubscribe at any time using the link at the bottom of every email.
- Advertising - measure the performance of our ads and show relevant ads to people who've visited our site (see Cookies & tracking for how to opt out).
- Security - detect and prevent fraud, abuse, account sharing, and other activity that violates our terms.
Legal Basis (For Users In The EU / UK)
If you're in the European Economic Area, the United Kingdom, or another jurisdiction with similar laws, we rely on the following legal bases under the GDPR and UK GDPR:
- Contract - to fulfil our agreement with you (deliver the product you bought, give you access to your account, provide support).
- Legitimate interests - to run, secure, and improve our business, for example, fraud prevention, basic analytics, and direct marketing to existing customers.
- Consent - for non-essential cookies, marketing emails to non-customers, and any other use where we ask you to opt in. You can withdraw your consent at any time.
- Legal obligation - to comply with tax law, accounting rules, and other legal duties that apply to us.
International Data Transfers
MedSchoolZone serves students in 80+ countries. Some of the service providers we use store and process data outside your home country, including in the United States and other countries that may have different data-protection rules.
When we transfer personal data outside the EEA or the UK, we rely on legal mechanisms such as the Standard Contractual Clauses approved by the European Commission and the UK government, and (where applicable) the EU-US and UK-US Data Privacy Framework. These mechanisms are designed to ensure your data continues to receive a similar level of protection.
How Long We Keep Your Data
We keep personal data only as long as we need it for the purposes described in this policy, or for as long as the law requires. As a rough guide:
- Account & purchase records - for the lifetime of your account, plus up to 7 years afterward to comply with tax and accounting laws.
- Support messages - typically 3 years from the last interaction.
- Marketing data - until you unsubscribe, plus a short suppression period to make sure we don't accidentally email you again.
- Analytics & advertising data - generally retained by the third-party platforms (Google, Meta) under their own retention rules, often 14-26 months.
- Cookies - vary in duration; most session cookies expire when you close your browser, while persistent cookies last from a few days to up to 2 years.
When we no longer need your data, we delete or anonymize it.
Your Rights
Depending on where you live, you have some or all of the following rights over the personal data we hold about you:
- Access - ask us for a copy of the personal data we hold about you.
- Correction - ask us to fix data that's inaccurate or incomplete.
- Deletion - ask us to delete your data, subject to legal obligations that may require us to keep some of it (e.g. tax records).
- Restriction - ask us to pause processing of your data while we sort something out (e.g. a dispute).
- Portability - ask us to provide your data in a portable, machine-readable format.
- Objection - object to processing based on our legitimate interests, including direct marketing (which you can stop at any time).
- Withdraw consent - where we rely on consent, you can withdraw it at any time without affecting earlier processing.
- Complain - lodge a complaint with your local data-protection authority. UK residents can contact the ICO; EU residents can contact their national authority.
To exercise any of these rights, get in touch through our contact page. We'll respond within 30 days, or sooner where the law requires.
California Residents (CCPA / CPRA)
If you live in California, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act:
- Right to know - what personal information we've collected about you, where we got it, why we collected it, and who we shared it with in the last 12 months.
- Right to delete - ask us to delete personal information we've collected, with a few legal exceptions.
- Right to correct - ask us to correct inaccurate personal information.
- Right to opt out of "sharing" - California treats some advertising activity (like the Meta Pixel) as "sharing" of personal information for cross-context behavioral advertising. You can opt out by adjusting your browser's Global Privacy Control signal or by getting in touch.
- Right to non-discrimination - we won't deny you service or charge you a different price for exercising your rights.
We do not sell personal information for money. We may "share" it for advertising purposes as defined by California law, as described above.
Children
MedSchoolZone is intended for medical students and exam candidates, who are generally adults. Our products and site are not directed to children under 16. We don't knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, please contact us and we'll delete it.
Security
We use industry-standard measures to protect your personal data, including:
- HTTPS / TLS encryption for all data in transit.
- Reputable, security-audited third-party providers for hosting, payments, and email.
- Access controls so that only people who need your data can see it.
- Regular review of our practices and the providers we use.
That said, no online service is 100% secure. If you ever suspect your account has been compromised, please contact us right away.
Changes To This Policy
We may update this policy from time to time. When we do, we'll change the "Last updated" date at the top of this page. If the changes are significant, we'll let you know by email or with a notice on the site before they take effect. Your continued use of MedSchoolZone after the changes take effect means you accept the updated policy.
Contact Us
Questions about this policy, or want to exercise your rights? Get in touch through our contact page and we'll get back to you within 24 hours.
Have A Privacy Question?
We'll respond within 24 hours, 7 days a week. Real humans, no bots.
Contact Us →