Legal
Privacy Policy
Last updated: August 2026
1.Who we are
usmle.tech (“we”, “us”) provides an educational USMLE question bank. This policy explains what personal data we collect and how we use it. Questions? Email support@usmle.tech.
2.Data we collect
- •Account data — name and email, handled by our auth provider (Clerk).
- •Billing data — subscription status and a customer ID from our payment processor (Stripe). We do not store your full card number; Stripe processes payments.
- •Usage data — questions answered, scores, sessions, and study preferences, to power your analytics and enforce plan limits.
- •Technical data — IP address, device/browser info, and cookies necessary to run the Service.
3.How we use it
To provide and personalise the Service; run your account and subscription; measure your progress; enforce free-plan limits; prevent abuse; communicate service and billing messages; and comply with law. We do not sell your personal data.
4.Legal bases (EEA/UK)
We process data to perform our contract with you (providing the Service), for our legitimate interests (security, improving the product), to comply with legal obligations, and with your consent where required (e.g. non-essential cookies).
5.Processors we share with
We share the minimum necessary with service providers that process data on our behalf: Clerk (authentication), Stripe (payments), Neon (database), Vercel (hosting), Resend (email), and AI providers (OpenAI, OpenRouter) for question generation and verification. We do not send your personal identity to AI providers as part of study.
6.Retention
We keep account and usage data while your account is active and as needed for legal, accounting, and security purposes. You can request deletion (see below).
7.Your rights
Depending on your location (GDPR/UK GDPR, CCPA/CPRA, and similar laws), you may have rights to access, correct, delete, port, or restrict processing of your data, and to object or withdraw consent. To exercise these, email support@usmle.tech. We do not sell or “share” personal information for cross-context behavioural advertising.
8.Cookies
We use cookies that are strictly necessary to sign you in and keep the Service secure (including authentication cookies from Clerk). We do not use third-party advertising cookies.
9.International transfers
Your data may be processed in countries other than yours. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for cross-border transfers.
10.Children
The Service is intended for medical students and professionals and is not directed to children under 16. We do not knowingly collect data from children.
11.Security
We use industry-standard measures (encryption in transit, access controls, reputable processors) to protect your data. No method is perfectly secure, but we work to safeguard your information.
12.Changes
We may update this policy; material changes will be posted here with a new “last updated” date.