Your data is part of your trust in the platform.

The CanonMedicinae team manages the processing of platform-related data. For privacy questions or requests concerning your data, contact info@canonmedicinae.com. We may request sufficient information to verify the applicant's identity before taking action on an account.

Depending on how you use the platform, we may process the following categories:

• Account data, such as display name, email, membership and verification status.
• Learning data, such as progress, favourites, notes, question attempts and results.
• Security and operational data, such as sessions, sensitive operations and technical errors.
• Local preferences needed to present the experience as you selected.

We do not store passwords in their original form and do not request real patient data.

We use data to create and operate accounts, save study progress and notes, provide tests and results, protect the platform and prevent misuse, provide support and improve reliability. Learning data is not used to make treatment or diagnostic decisions and is not sold for advertising purposes.

The website uses a secure HttpOnly session cookie to keep users signed in and may store limited browser preferences such as university selection or display settings. Some local data may be transferred to the account on sign-in to maintain continuity between learning sessions.

Users can view their own data through account features. Authorised team members access only what is necessary for administration, support, security and quality review. The technical infrastructure may rely on hosting or operational providers that process data to deliver the service. We do not share data with advertisers or use it to build advertising profiles.

We retain data as needed to operate the account, preserve the learning record, maintain security and handle requests. Deactivating an account blocks access and revokes sessions but does not always mean every record is immediately erased. Limited retention may be necessary for security or applicable obligations. Erasure requests are reviewed systematically.

You may request access to, correction or deletion of your data, restriction of processing or objection to specific processing, within the limits of applicable law. Account holders can download a copy of their data and deactivate their account from the account and privacy page, and contact us for any other request.

We use technical and organisational controls to protect accounts, including password derivation, session management and logging sensitive operations. No digital service is completely risk-free. Protect your login details and do not enter patient names, record numbers or identifiable health information in notes or answers.

We update this notice when platform features or data processing practices change. We will display the latest update date here and announce material changes appropriately when required. Continuing to use the platform after an update does not reduce your legal rights.