Privacy Policy

1. What we collect

Account data: email, display name, role (student/teacher/admin), language, timezone.
Learner professional profile: full name in English and Arabic, profession, specialty and subspecialty, grade, years of experience, workplace, department, job title, sector, country, city, area and mobile number; optionally your licence number, issuing authority and expiry (recorded as you enter them, not verified), date of birth, gender and nationality. Your English name is printed on your certificates. Your CME credits are shared with your licensing authority only if you tick that option.
Google or Apple sign-in: if you choose it, we receive your name, your email address and an account identifier from Google or Apple. Nothing else, and we never see your Google or Apple password.
Teacher data: license number, issuing authority, country, expiry.
Usage data: courses viewed, watch progress, Q&A activity, certificates earned.
Payment data: handled by Stripe. We never see your card number.
No PHI: we do not collect patient information. The Platform is for clinician education, not patient care.

2. How we use it

• To provide the Platform (auth, course access, certificates).
• To suggest courses that fit your profession and specialty, and to show MedLearn administrators who our learners are (by profession, specialty, country and workplace).
• To process payments and pay teachers.
• To send transactional emails (enrollment, reminders, receipts).
• To send marketing emails (only with explicit opt-in; unsubscribe in every email).
• To improve the Platform (aggregated, anonymized analytics).

3. Where data lives

All data is stored in DigitalOcean's Frankfurt (fra1) region. Object storage is on DigitalOcean Spaces. Backups are taken daily. Data residency is regional today; a residency selector is on the v1.1 roadmap.

4. Who we share with

• Stripe: payment processing (PCI-DSS compliant).
• LiveKit Cloud: live video (no recording on their side after session ends).
• SendGrid: transactional email, including the sign-up confirmation code.
• Google and Apple: only if you sign in with them, to confirm who you are.
• Cloudflare: DNS and DDoS protection (no data content passes through).
• Sentry: error tracking (stack traces only, no PII).

We do not sell your data. We do not share it for advertising.

5. Your rights

You can access, correct, export, and delete your account at any time from Settings. For data portability requests, email [email protected].

6. Cookies

We use first-party cookies for authentication (JWT) and locale preference. No third-party tracking cookies.

7. Compliance

GDPR (EU). Kuwait PDP Law 2024. CCPA (California). HIPAA is not applicable — we don't store PHI.

8. Contact

Data protection enquiries: [email protected].
Postal: MedLearn, Kuwait City, Kuwait.