Privacy Policy

1. What we collect

• Account data — your name, email address, and (for trainees enrolled through an institution) your MCR number and cohort. If you sign in with Google, Google shares your name and email address with us; we do not receive your Google password or any other Google data.
• Learning data — your question attempts, answers, scores, confidence ratings, bookmarks, and spaced-repetition schedule. This is the core of the Service: it powers your dashboard and adaptive practice.
• Payment data — passes you buy, amounts, and dates. Card details are collected and stored by Stripe, our payment processor; they never reach our servers.
• Technical data — login timestamps and IP-derived request information used for security and rate limiting.

2. How we use it

We use your data to operate the Service (authentication, progress tracking, adaptive question selection), to process payments and send receipts, to send service emails such as login links and pass-expiry reminders, and to keep the platform secure. If you are enrolled through a training programme or institution, your programme administrators may see your practice and exam performance as part of cohort reporting.

3. Who we share it with

We do not sell personal data. We share it only with processors needed to run the Service: Stripe (payments), Resend (email delivery), Google (sign-in, if you choose it), and our hosting provider. Each processes data on our instructions.

4. Retention

Account and learning data are kept while your account is active so your progress is preserved between passes. Purchase records are kept as required for accounting. If you ask us to delete your account, we remove your personal data within 30 days, except records we must keep by law.

5. Your rights

Under the PDPA you may request access to, or correction of, your personal data, and may withdraw consent (which may mean closing your account). Contact our Data Protection Officer at noreply@ktmc.sg — we respond within 30 days.

6. Security

Data is transmitted over HTTPS and stored on servers with restricted access. Login uses one-time email links or Google sign-in rather than passwords, so there is no FamMed Qbank password for an attacker to steal. Backups are kept to protect your progress against data loss.

7. Changes

We may update this policy; material changes will be announced on the Service or by email.