Privacy policy
What we collect, why, how long we keep it and the rights you have over it.
Who we are
Vimora (operator of Medverion) is the data controller. This policy explains how Vimora (“we”, “us”) handles personal data when you use medverion.com and the Medverion service. We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For any privacy question or request, email [email protected].
What we collect
- Account details: your name, email address, chosen exam, optional country and your preferences. Your password is never stored; we keep only a salted PBKDF2-SHA256 hash of it.
- Learning data: the question blocks you create, your answers, timings, flags and notes, and synced study tools such as your plan, flashcards, quests and simulation progress.
- Community content: posts, comments, likes and reports. Your display name is shown with what you post, and posts can be read by visitors to the community pages.
- Messages: what you send through the contact form (name, email, topic and message) and password-reset requests.
- Mailing list: your email address and where you signed up, if you ask to hear about new features.
- Security data: for each signed-in session, a hashed session identifier, your browser’s user-agent string and a one-way hash of your IP address; and short-lived rate-limiting records that protect against abuse.
Why we use it, and our lawful bases
- To provide your account and the service you asked for, including saving and syncing your progress (performance of a contract).
- To keep the service secure, prevent abuse and enforce our terms, including rate limiting and moderation (legitimate interests).
- To answer your messages and requests (legitimate interests).
- To email you about new features, only if you joined the mailing list (consent, which you can withdraw at any time).
- To improve content using aggregated, non-identifying statistics such as how often a question is answered correctly (legitimate interests).
What we do not do
We do not sell or rent personal data. We do not show advertising. We do not use analytics, tracking pixels, advertising cookies or any third-party tracking scripts, and we do not build marketing profiles.
Where your data is stored
Medverion is hosted on Cloudflare (Pages, Functions and the D1 database), which processes data on our behalf under its data processing terms. Cloudflare operates globally, so data may be processed outside the UK; its terms include standard safeguards for international transfers. We do not currently send email through any third-party email provider.
How long we keep it
- Account and learning data: until you delete your account.
- Sessions: up to 12 hours, or up to 30 days if you choose “Remember me”; signing out ends the session.
- Rate-limiting records: about 24 hours.
- Contact messages and reset requests: as long as needed to deal with them and keep a record of the conversation. Ask us and we will delete them.
- Mailing list: until you ask to be removed. We do not send newsletters yet; when we start, every email will include an unsubscribe link.
Your rights
You can ask to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent. You can update your profile and delete your account yourself in Account settings; deleting your account removes your account and all data linked to it straight away. For anything else, email [email protected]. We will respond within one month. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).
Children
Medverion is designed for medical students and doctors and is not intended for anyone under 16.
Security
All traffic uses HTTPS. Session cookies are HttpOnly, so scripts cannot read them, and requests that change data must carry a custom header that other websites cannot send. Passwords are hashed with a unique salt. No system is perfectly secure, so please use a password you do not use elsewhere.
Changes to this policy
If we change how we use personal data, we will update this page and change the date at the top. Significant changes will be announced on the site.
Contact
Privacy questions and requests: [email protected]. Everything else: [email protected].
See also the cookie policy.