Privacy Policy

Overview

CourseHost (operated by The Center for Medical Education, Inc., “we,” “us,” “our”) provides online medical exam preparation software. This policy explains what data we collect when you use coursehost.org, how we use it, and your rights over it.

Information we collect

Information you give us

• Account info: name, email, credentials (MD, DO, RN, PA-C, etc.), the exam you're preparing for, and your target exam date.
• Payment info: billing address and payment-related details. Stripe handles and tokenizes card data; CourseHost does not store full card numbers.
• Support communications: any emails, chat messages, or phone calls you send to our support team.

Information collected automatically

• Study activity: questions answered, time spent, accuracy, flagged items, and spaced-repetition ratings. This is the core of the product and what powers your predicted score.
• Device & log data: IP address, browser type, device model, operating system, and pages visited. Used for security and debugging.
• Cookies & similar technologies: see Cookies & tracking below.

Information from third parties

If you sign in with Google, we receive your name, email address, and profile picture from Google. We never see your Google password.

How we use your information

• Deliver the product: show you questions, update your predicted score, queue your Smart Review flashcards, and sync across your devices.
• Bill you: process payments and eligible refunds.
• Communicate with you: send transactional and service-related communications for account setup, purchases, security, support, and CME activity or certificates.
• Improve the product: aggregate, anonymized study data helps us identify weak questions, calibrate predicted scores, and write better explanations. Your individual data is never shared with other students.
• Protect the platform: detect fraud, abuse, and unauthorized access.

When we share information

We do not sell your personal information. Period. We share data only in these specific cases:

• Supabase provides managed authentication, database, and storage services.
• Stripe handles and tokenizes card data for payment processing.
• Resend receives the recipient address, subject, and message content needed to deliver transactional emails. CourseHost records delivery metadata and events, including the recipient address, subject, event or delivery status, timestamps, and provider delivery data.
• Vercel hosts the application and operates its delivery infrastructure, including Vercel Analytics and Vercel Speed Insights.
• Google Analytics 4 provides usage analytics.
• Sentry provides error and performance monitoring. Session Replay is disabled.
• Legal requirements if we're compelled by a court order, subpoena, or applicable law. We'll notify you unless legally prohibited.
• Business transfers if CourseHost is acquired or merged; your data moves with the product, and the acquirer is bound by this policy.
• With your consent for anything outside the above — for example, if you opt in to a research study or public testimonial.

Your rights & choices

Depending on where you live, you may have the right to:

• Access — request a copy of the data we have about you
• Correct — fix anything inaccurate
• Delete — request deletion of your account and personal data
• Port — receive your study data in a machine-readable format
• Communication preferences — you may contact support about communication preferences; essential account, billing, security, and requested CME communications are part of providing the service

To exercise any of these rights, email support@coursehost.org. We may require identity verification before fulfilling a request. Requests are subject to applicable law and record-keeping obligations. No automated self-service deletion tool currently exists.

Data security

We take reasonable technical and organizational measures to protect your data:

• Network transport is encrypted
• Supabase provides managed authentication
• Application and database access is role-based
• Database and storage resources are protected through managed infrastructure and access controls
• We use error, performance, and service monitoring to identify operational and security issues
• Vercel BotID supplies automated bot and security signals on selected routes; we currently use those signals in monitoring mode
• Stripe tokenizes payment card data

No security measures eliminate all risk. If we become aware of a breach involving your data, we'll notify you as required by applicable law.

Data retention

We retain account and study data while your account is active and as reasonably needed to provide the service, resolve disputes, maintain security, and meet financial, tax, continuing medical education (CME), and other legal or operational obligations. Email delivery records are retained as reasonably needed for delivery, troubleshooting, security, disputes, and legal or record-keeping obligations. Retention periods differ by data category and context. Deletion requests are reviewed individually rather than processed by an automated deletion system.

Cookies & tracking

We use cookies and similar technologies to operate and understand the service:

• Service operation — support authentication, security, and saved preferences.
• Analytics — Google Analytics 4, Vercel Analytics, and Vercel Speed Insights help us understand visits, usage, and performance.
• Diagnostics — Sentry provides error and performance monitoring. Session Replay is disabled.

We do not use third-party advertising cookies.

Children's privacy

CourseHost is intended for medical students, residents, and licensed professionals. We do not knowingly collect data from anyone under 16. If you believe a minor has created an account, please email support@coursehost.org.

International users

CourseHost is operated from the United States, and personal data may be transferred to and processed in the United States. Privacy rights vary by location. Contact support@coursehost.org with questions or requests about rights that may apply where you live.

Changes to this policy

We may update this policy as we add new features or comply with new laws. When appropriate, we may provide additional notice of material changes. The “Last updated” date at the top reflects the current version.

Contact us

Questions about this policy? Reach our privacy team directly.