Privacy Policy

• Account details. Your name, username, email address and phone number, and a password if you sign up with email. We never keep your password in readable form: our sign-in provider stores only a one-way hash of it.
• Sign in with Google. If you choose “Continue with Google”, Google shares your name, email address and profile picture with us. We do not receive your Google password or anything else from your Google account, such as your emails, contacts, calendar or files.
• Profile photo. The picture you upload, if you add one.
• Your study activity. Your answers, test scores and history, marked and bookmarked questions, notes, notebook pages, flashcards, highlights in the medical library, and your progress and settings.
• Subscription and payment details. Which plan you bought, its dates, and the payment status and reference numbers from our payment provider. You enter card or wallet details on the provider’s own secure page; we do not receive or store your full card number.
• Messages you send us. Feedback, support emails and any attachments you include.
• Technical information. Your IP address, browser and device type, and when you sign in. We use this to keep accounts secure, to limit repeated failed sign-ins and abuse of verification emails (for which we keep only a one-way hash of your IP address), and to fix problems.

We use cookies to keep you signed in, protect your account, remember your selected exam, and, when you arrive through a campaign link, remember its source for up to 14 days. Session and campaign cookies are HttpOnly. Study preferences and locally saved progress may be stored in your browser so work can survive interrupted connections. We do not use third-party advertising trackers or browser fingerprinting.

Affiliate and ambassador links set a first-party HttpOnly referral cookie for the program’s referral window (30 days by default, configurable up to 90 days). We record the partner, campaign label, sharing channel, campaign university and visit time, and may associate the referral with your account at signup, when you enter a partner code, or at checkout. We record whether you interact with the partner walkthrough and associate qualifying payments with your referral. Partners receive aggregate funnel counts and commission records without your name, email or question answers.

• To create and run your account, sign you in and keep you signed in.
• To provide the question bank, track your progress and show your statistics, including comparing your results with other students in aggregate form, without identifying anyone.
• To process subscriptions and payments.
• To review affiliate and ambassador applications, attribute qualifying purchases, calculate commissions, prevent self-referrals and duplicate payouts, and review manual payout requests. Partner applications contain your sharing channel, audience, university or community and application text. Payout requests contain recipient names and account details; only the partner and authorized staff can view these details. Financial referral, commission and settlement records are retained for accounting and dispute resolution. Mission proof and review records support activity rewards; approved partner introductions are public on their personal pages. Partners can opt into progress emails and turn them off from their dashboard.
• To send you service emails, such as verification codes, password resets, and replies to your support requests.
• To keep the Service secure, prevent fraud and abuse, and enforce our rules.
• To improve onboarding and studying through first-party measurement of demo use, signup, trial access, explanation opens, study sessions, checkout and confirmed payments. These records may include your account ID, exam, campaign source and event time. They do not contain answer choices, clinical question text, notes, or messages. Launch measurement records are removed by daily cleanup after 90 days; payment and study records follow their existing retention rules.
• To meet our legal obligations.

Where the law requires a legal basis, we rely on performing our contract with you, our legitimate interest in running and securing the Service, your consent (for example when you choose to sign in with Google), and legal obligations. We do not sell your personal information and we do not use it for third-party advertising.

If you sign in with Google, we use your name, email address and profile picture only to create and identify your account and to show your name and photo inside the Service. We do not use this information for advertising, and we do not sell it or share it, except with the service providers listed below that help us run the Service.

klinra’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect klinra from your Google account at any time at myaccount.google.com/permissions.

We share information only with service providers who work for us, and only as much as they need to do their job:

• Supabase for sign-in and database hosting. Our data is stored in the European Union (Ireland).
• Vercel for hosting the website and app.
• Cloudflare for storing and delivering images, audio and video, and for handling incoming support email.
• Resend for sending our emails.
• Payment providers for the payment method you choose, such as Paymob, Kashier, Stripe or PayPal.
• Google, only if you choose to sign in with Google.

We may also disclose information when the law requires it, to protect the safety and security of our users and the Service, or as part of a merger or sale of the business, in which case we will tell you.

Our providers may process information in countries other than the one you live in. When information crosses borders we rely on the safeguards our providers offer, such as contractual protections.

We keep your account and study data for as long as your account is open. If you ask us to delete your account, we delete or anonymise your personal information, except records we must keep by law (for example payment records for tax and accounting) and backup copies, which are removed on their normal schedule.

• You can view and update your name, username and profile photo on your Account page.
• You can ask us for a copy of your information, to correct anything you cannot edit yourself, or to delete your account, by emailing support@klinra.com. We may need to confirm it is really you, and we aim to reply within 30 days.
• Depending on where you live, you may also have the right to object to or restrict certain uses of your information, to withdraw consent, and to complain to your local data protection authority.

We protect your information with encrypted connections, hashed passwords, HttpOnly cookies, limits on repeated failed sign-ins, and restricted access to our systems. No service can be perfectly secure. If a breach affects you, we will tell you as the law requires.

The Service is for medical students, graduates and professionals and is not directed to anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.

We may update this policy from time to time. The date at the top shows when it last changed. If a change is significant, we will tell you by email or with a notice in the app.

klinra · www.klinra.com
Email: support@klinra.com