Privacy Policy

1. Introduction

Welcome to Error Analysis Tool (EAT) Tracker ("we," "our," or "us"). We are committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our medical study error tracking application.

This controlled-pilot information is not a legal certification, data-processing agreement, or final privacy notice. External legal/privacy review is required before paid or institutional release.

2. Information We Collect

2.1 Information You Provide

• Account Information: Email address, name, and account credentials
• Educational Data: Medical exam type, target exam date, institution domain
• Study Data: Error logs, practice test scores, study session records
• User Preferences: Dashboard settings, notification preferences, exam focus areas

2.2 Automatically Collected Information

• Usage Data: Pages visited, features used, time spent in app
• Device Information: Browser type, operating system, IP address
• Cookies: Session tokens, authentication cookies, preference cookies

3. How We Use Your Information

• Provide and maintain our service
• Calculate exam readiness and generate study recommendations
• Identify patterns in your error logs and study habits
• Send important account notifications (verification emails, password resets)
• Improve our algorithms and user experience
• Detect and prevent fraud, abuse, or security incidents
• Comply with legal obligations

4. Data Security

The pilot build includes application security controls. Production security, storage, backup, and operational controls require evidence and approval before external claims are made:

• Application controls: Authenticated routes, role checks, CSRF controls, and rate limiting are implemented in the pilot build.
• Production evidence: Encryption, backup/restore, tenant isolation, and monitoring claims remain subject to release verification.

While we strive to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

5. Data Sharing and Disclosure

We do NOT sell or rent your personal information to third parties.

We may share your information in the following limited circumstances:

• Service Providers: Supabase (database hosting), Vercel (application hosting), Sentry (error monitoring)
• AI Provider: OpenAI. On paid plans with AI features enabled, content you submit to an AI feature is sent to OpenAI to produce the result: text and screenshots you use for question capture, the transcript of voice notes you use for error capture, and the vignette text and notes you write when you request an AI explanation or approach feedback. AI features are off unless enabled, and you can practise without using them. Do not enter real patient information anywhere in the app.
• Legal Requirements: When required by law, court order, or to protect our legal rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Your Consent: When you explicitly authorize us to share your data

6. Your Privacy Rights

You have the following rights regarding your personal data:

• Right to Access: Request a copy of all your data (export feature available in Settings → Privacy)
• Right to Rectification: Update or correct your information in your account settings
• Right to Deletion: Request permanent deletion of your account and all associated data
• Right to Data Portability: Export your data in JSON format
• Right to Withdraw Consent: Opt-out of non-essential data collection
• Right to Object: Object to processing of your data for direct marketing

To exercise these rights, please contact us at privacy@eattracker.com or use the Privacy Controls in your account settings.

7. Cookies and Tracking Technologies

We use cookies and similar tracking technologies for:

• Essential Cookies: Authentication, security, session management (required for service)
• Preference Cookies: Remember your settings and choices (optional)
• Analytics Cookies: Understand how you use our service to improve it (optional, can be opted out)

You can control cookies through your browser settings. Note that disabling essential cookies may limit functionality.

8. Data Retention

We retain your data for as long as your account is active or as needed to provide services. Specifically:

• Active Accounts: Data retained indefinitely while account is active
• Deleted Accounts: Data soft-deleted immediately, hard-deleted after 30 days
• Audit Logs: Retained for 90 days for security and fraud prevention
• Backups: Retained for up to 30 days, then permanently deleted

9. Children's Privacy

Our service is designed for medical students (typically 18+ years old). We do not knowingly collect information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

10. International Data Transfers

Any international-data-transfer, GDPR, CCPA, or comparable compliance commitment requires legal/privacy review before it is offered or represented to users.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last Updated" date
• Sending you an email notification for material changes

You are advised to review this Privacy Policy periodically for any changes.

12. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us:

13. Legal review status

Legal/privacy review required:

E.A.T. does not represent GDPR, CCPA, FERPA, or other regulatory compliance through this controlled-pilot page. Any such representation requires external legal/privacy review and approved terms.

Institutional commitments:

Institutional data-processing terms, retention schedules, and student-record commitments are outside the controlled pilot until separately approved.