Privacy Policy
Last updated 29 October 2026
1. Who is responsible
TheMedCoach is responsible for the personal data described here. Contact: [email protected].
2. What we collect
| Data | Why |
|---|---|
| Email address and account identifier | To create your account and sign you in |
| Account dates: created, last sign-in, trial end date, version of the terms you accepted | To provide the free trial and record your agreement |
| Name and profile picture, if you sign in with Google | Received from Google with your email; used only to identify your account |
| Subscription details from Paddle: subscription and customer identifiers, plan, status and billing dates | To give access to the subjects you have paid for |
| Technical data processed by our hosting providers: IP address, browser type, request times | To deliver the Service securely and prevent misuse |
We do not receive or store your card or bank details; Paddle handles payment. We do not collect special categories of personal data.
3. Data kept on your device
Your My Stack, practice question history, reading progress and settings are stored in your browser’s local storage on your device. They are not sent to us. You can remove them in Settings or by clearing your browser data.
4. Legal bases
- Contract: to provide your account, trial and subscription.
- Legitimate interests: to keep the Service secure, prevent abuse of free trials and improve the Service.
- Legal obligation: to keep records required by tax and accounting law (held by Paddle as Merchant of Record).
5. Who processes your data
| Provider | Role | Location |
|---|---|---|
| Supabase | Account database and sign-in | European Union (Frankfurt) |
| Paddle | Merchant of Record: checkout, payment, tax, invoicing | United Kingdom and other locations under Paddle’s privacy policy |
| Cloudflare | Hosting and delivery of the website | Global network |
| Resend | Delivery of sign-in emails | European Union (Ireland) |
| Sign-in with Google, if you choose it; web fonts | Global | |
| jsDelivr | Delivery of the sign-in software library | Global network |
These providers process data on our behalf or as independent controllers under their own terms. We do not sell personal data and do not use advertising or analytics trackers.
6. International transfers
Where data is transferred outside the European Economic Area or the United Kingdom, it is protected by safeguards such as the European Commission’s Standard Contractual Clauses provided by our processors.
7. Cookies and similar storage
We use one cookie that keeps you signed in (named tmc_at, strictly necessary) and browser storage for your session and your study data on your device. No advertising or analytics cookies are used, so no cookie consent banner is shown.
8. How long we keep data
- Account data: for as long as your account exists.
- When you delete your account from the Account page, your account, profile and subscription records are deleted from our database immediately.
- Paddle keeps transaction records for the periods required by tax law.
- Server logs held by our hosting providers are kept for short periods under their policies.
9. Your rights
Depending on where you live, you have the right to access your data, correct it, delete it, restrict or object to its processing, and receive a copy in a portable format. You can delete your account yourself at any time. For any other request, write to [email protected] from your account email; we reply within one month. You may also complain to your local data protection authority.
10. Security
Data is transmitted over encrypted connections, access to the account database is restricted, and each student can read only their own account records. No system is completely secure; tell us at [email protected] if you suspect a problem.
11. Children
The Service is not intended for anyone under 16, and we do not knowingly collect data from them.
12. Changes to this policy
We will update this policy when our practices change and show the date at the top. Material changes will be notified by email or in the Service.