Privacy Policy

• What we collect: account email, study activity, payment metadata (no card details — Stripe handles those), AI interaction logs, and basic technical data (IP, device, browser).
• Why: to deliver and improve the Service, process payments, comply with our legal obligations, and protect against fraud and abuse.
• Who we share it with: a small list of named processors (Google Cloud, Stripe, Sentry, Google Gemini for AI generation, transactional email providers). Never advertisers or data brokers.
• Where it lives: primarily on Google Cloud servers in the United States. International transfers use Standard Contractual Clauses where required.
• How long we keep it: for as long as your account is active, plus a short tail (typically 30 days) for backups, plus the periods required by tax and accounting law for billing records (currently 7 years).
• Your rights: access, correct, delete, port, restrict, object, and withdraw consent. Email contact@plabrevisions.com.

PLAB Revisions Education Inc is a corporation incorporated under the laws of the Province of British Columbia, Canada. We are the data controller for personal data processed in connection with the PLABRevisions Service. Our registered office address is available on request.

PLABRevisions is a product within the MedRevisions family of medical-exam revision platforms operated by separately-incorporated entities. While we share branding, design language, and engineering standards with our sister products, each operating entity is independently responsible for its own product, data, and intellectual property.

For privacy enquiries, including data-rights requests under BC PIPA, PIPEDA, Quebec Law 25, the UK GDPR, the EU GDPR, or the CCPA, contact us at contact@plabrevisions.com with the subject line "Privacy request".

2.1 Account information

When you create an account we collect:

• Email address (used as your unique identifier)
• Display name (optional)
• Password hash (bcrypt-hashed — we never see your raw password)
• Profile metadata you choose to provide (target exam date, study goals)

2.2 Subscription and payment data

Payments are processed by Stripe. We never see and never store your full card number, CVC, or bank credentials. Stripe shares the following with us so we can deliver and account for the Service: your Stripe customer ID, the price you purchased, billing address, subscription status, period start/end, and invoice history. For generation-pack purchases we additionally store the pack identifier, the immutable Stripe checkout session id (for idempotency), and the resulting balance updates.

2.3 Study and usage data

While you use the Service we record:

• Questions you attempt and your answers
• Performance metrics derived from those attempts
• Bookmarks, flagged questions, notes, and feedback
• AI-feature interactions — the prompts you send to AI Professor, mock-exam debrief inputs, and the resulting generated content
• Session timestamps and the IP address used to log in

2.4 Technical and device data

When you visit any page on the Service, our servers automatically record your IP address, user-agent string, browser version, operating system, viewport size, and the page URL. This is standard web-server behaviour required to deliver the page.

2.5 Cookies and similar technologies

We use a small number of strictly-necessary cookies for authentication and CSRF protection, and short-lived analytics cookies to understand aggregate usage. We do not use marketing or advertising cookies. See section 9 for the full list.

Under the UK GDPR and EU GDPR we are required to identify a lawful basis for each processing activity. Here is the matrix:

We share personal data with the following processors. Each acts on our written instructions, processes only what is necessary, and is bound by data-protection terms equivalent to our obligations to you. We do not sell or rent personal data to anybody, and we do not share it with advertisers or data brokers.

• Google Cloud / Firebase — Account authentication, user database, file storage, hosting, and Cloud Functions runtime.
• Stripe — Subscription billing and one-time generation-pack purchases. Stripe holds card details directly — we never store them.
• Google Gemini (AI services) — Generates personalised study notes, mock-exam debriefs, AI Professor chat responses, and visual aids when you use those features.
• Sentry — Error monitoring. We send anonymised stack traces and request metadata to diagnose application bugs.
• Resend / Gmail (Workspace) — Transactional email delivery (receipts, password resets, generation-pack purchase confirmations).

When you use AI Professor, generate a personalised subject note, or run a mock-exam debrief, your inputs are sent to Google Gemini under a paid enterprise contract. Google has committed not to train any general models on inputs from paid enterprise customers, and does not retain those inputs beyond the period required for abuse monitoring (currently 24 hours).

We retain the resulting generated content (and the prompt that produced it) inside your account for as long as your account is active, so you can revisit your study materials. You can delete any generated note from your account at any time.

• Account profile and study activity: for the life of your account. Deleted within 30 days of account closure.
• Generated AI content: for the life of your account, or until you delete the individual item.
• Billing records (invoices, payment metadata): 7 years after the last transaction, to comply with tax and accounting law.
• Server logs (IP, user-agent): 90 days, then aggregated or deleted.
• Backups: rolling 30-day window, then overwritten.

PLAB Revisions Education Inc is a Canadian corporation, but our infrastructure runs primarily on Google Cloud servers located in the United States. This means personal data is routinely transferred outside Canada for storage and processing. When we transfer personal data internationally we rely on one of the following legal mechanisms:

• For data transferred from Canada to the United States, we comply with BC PIPA s. 18 (notification of foreign processing), PIPEDA's accountability principle, and Quebec Law 25's transfer-impact-assessment obligation by ensuring our US processors provide a comparable level of protection through written contract, including the adoption of Standard Contractual Clauses where supported.
• For UK and EEA users, UK and EU adequacy decisions where they exist (e.g. the EU-US Data Privacy Framework where applicable).
• Standard Contractual Clauses (SCCs) approved by the European Commission and the UK ICO, supplemented with technical and organisational safeguards.
• Your explicit consent, where appropriate (e.g. for optional features that necessarily transfer data).

Depending on where you live, you have some or all of the following rights. To exercise any of them, email contact@plabrevisions.com with the subject line "Privacy request". We will verify your identity before disclosing or amending any personal data, and will respond within the statutory window (30 days under BC PIPA, PIPEDA, UK GDPR, and EU GDPR; 45 days under CCPA). We will not discriminate against you for exercising a right.

• Access — receive a copy of the personal data we hold about you (BC PIPA s. 23; PIPEDA Principle 9; UK/EU GDPR Art 15; CCPA §1798.110).
• Rectification / correction — correct inaccurate or incomplete data (BC PIPA s. 24; PIPEDA Principle 9; UK/EU GDPR Art 16; CCPA §1798.106).
• Erasure / deletion ("right to be forgotten") — request that we delete your account and personal data, subject to retention obligations for billing records (UK/EU GDPR Art 17; CCPA §1798.105; Quebec Law 25 right to de-indexing).
• Portability — receive your data in a structured, commonly-used, machine-readable format (UK/EU GDPR Art 20; Quebec Law 25; CCPA §1798.130).
• Restriction and objection — limit or object to specific kinds of processing (in particular processing based on legitimate interests).
• Withdraw consent — for any processing based on consent (e.g. marketing emails). BC PIPA s. 9 and PIPEDA both permit withdrawal of consent subject to legal or contractual restrictions.
• Do Not Sell or Share (CCPA) — we do not sell or share personal data, so this right is satisfied by default. We will honour any signal sent via Global Privacy Control.
• Lodge a complaint with a supervisory authority:
  • Office of the Information and Privacy Commissioner for British Columbia (BC PIPA) — oipc.bc.ca
  • Office of the Privacy Commissioner of Canada (federal / PIPEDA) — priv.gc.ca
  • Commission d'accès à l'information du Québec (Quebec Law 25) — cai.gouv.qc.ca
  • UK Information Commissioner's Office (UK GDPR) — ico.org.uk
  • EU member-state Data Protection Authorities (EU GDPR)
  • California Privacy Protection Agency (CCPA / CPRA) — cppa.ca.gov

The Service uses three categories of cookie:

• Strictly necessary — session cookies that keep you signed in and protect against CSRF. These cannot be turned off without breaking the Service.
• Functional — remember your preferences (theme, study mode). You can clear these via your browser settings.
• Analytics — short-lived cookies that help us understand aggregated usage (e.g. which pages crash, which features are popular). We do not use third-party advertising cookies and we do not run advertising trackers.

The Service is intended for medical professionals, medical students, and adult learners aged 16 and over. We do not knowingly collect personal data from children under 16. If we learn that we have done so, we will delete the data promptly. If you believe a child has provided data to us, contact contact@plabrevisions.com.

We protect your data with industry-standard measures, including: TLS 1.2+ encryption in transit, encrypted Firestore storage at rest, principle-of-least-privilege access controls for staff, audit logs of administrative access, secret-management for API keys, automated dependency vulnerability scanning, and PCI-compliant payment handling via Stripe. Despite these measures, no system can be guaranteed 100% secure.

If we ever suspect a breach affecting your personal data that creates a real risk of significant harm, we will notify you and (where required) the relevant supervisory authority — including notification within 72 hours under Article 33 of the UK and EU GDPR, in accordance with PIPEDA's mandatory breach reporting obligations under section 10.1, and the breach-notification requirements of British Columbia's Personal Information Protection Act (where BC or other Canadian residents are affected).

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent material change. For significant changes (for example, adding a new processor or changing the legal bases) we will notify you by email and provide a reasonable advance notice period.

PLAB Revisions Education Inc
Email: contact@plabrevisions.com
Subject line for privacy requests: "Privacy request"