Privacy Policy

This Privacy Policy explains how MedTUS ("we", "us", "our") collects, uses, and protects your personal data when you use medtus.net and app.medtus.net (the "Service"). We are the data controller for the information described here.

1. Information we collect

• Account data — name, email address, password (stored hashed), language and profile preferences.
• Usage data — lessons studied, quiz and flashcard activity, progress, study plans, and similar learning data used to run and improve the Service.
• Device & log data — IP address, browser type, and basic technical logs for security and reliability.
• Payment data — when you pay by card, the payment is processed by our Merchant of Record, Paddle. We do not receive or store your full card number. We receive limited transaction data (e.g., plan purchased, country, subscription status) needed to activate and manage your subscription.
• Communications — messages you send us for support.

2. How we use your information

• To provide, personalise, and maintain the Service and your account.
• To process subscriptions, activate access, and prevent fraud.
• To send service and transactional messages (e.g., subscription activation, expiry reminders).
• To respond to support requests and improve our content and features.
• To comply with legal obligations.

3. Legal bases

We process data to perform our contract with you (providing the Service), for our legitimate interests (security, improvement), to comply with legal obligations, and — where required — with your consent (e.g., optional marketing). You can withdraw consent at any time.

4. Sharing your information

We do not sell your personal data. We share it only with:

• Paddle (payments & Merchant of Record) — to process card payments, taxes, invoices, and refunds. Paddle acts as an independent controller for payment data under its own privacy notice.
• Service providers — hosting, email delivery, and analytics, acting on our instructions.
• Authorities — where required by law.

4a. Learning data (event stream)

To personalise your study plan, build your own knowledge map and improve our content, we record learning events while you use the Service: opening a lesson, answering a question and whether it was correct, reviewing a flashcard, the time you took to answer, and — only if you switch it on in Settings → Extras — how confident you said you were. These events are tied to your account, are never sold, are used only for the purposes above and for aggregate, anonymised statistics, and are deleted together with your account. You can turn optional signals off at any time in your settings.

4b. Partners

If you came to MedTUS through a partner's link or discount code, that partner sees only aggregated, anonymous figures needed to calculate their commission: the number and amount of signups, active use and purchases. Your name, contact details, study progress or support messages are shared only if you give explicit consent at signup or in your profile, and only the items you agreed to. You can withdraw consent at any time under Profile → Referred by; access ends immediately. By contract, partners may use this information only to help you within MedTUS and may not copy it, share it or use it for marketing. Payments and refunds are always handled directly by MedTUS. A partner link sets a cookie (mt_ref) that remembers which partner referred you, for the attribution period of that partner's plan.

5. Cookies

We use essential cookies to keep you signed in and to run the Service securely. We use non-essential cookies only where permitted. You can control cookies through your browser settings.

6. Data retention

We keep your data for as long as your account is active and as needed to provide the Service, then for any period required to meet legal, tax, or accounting obligations. You can delete your account yourself at any time from Settings → Delete account — see how account deletion works (a 7-day grace period, then everything except the records we must retain by law is erased).

7. Your rights

Depending on your location, you may have the right to access, correct, delete, restrict, or object to the processing of your personal data, and to data portability. To exercise these rights, contact us at info@medtus.net.

8. Security

We use technical and organisational measures to protect your data, including hashed passwords and encrypted connections (HTTPS). No method of transmission or storage is completely secure, but we work to protect your information.

9. International transfers

Your data may be processed in countries other than your own (including by our providers and Paddle). Where required, appropriate safeguards are applied to protect your data.

10. Children

The Service is intended for adults (18+), typically medical students and graduates. It is not directed at children.

11. Changes

We may update this Policy; material changes will be posted here with a new "Last updated" date.

12. Contact

For privacy questions or to exercise your rights: info@medtus.net.