Privacy Policy

Effective Date: June 24, 2026 · Last Updated: June 24, 2026

1. Introduction & Scope

This Privacy Policy applies to the MedTrack iOS application and the medtrackapp.com website operated by MedTrack LLC ("MedTrack," "we," "our," or "us"). It describes the personal information we collect, how we use it, and the rights you have over it.

This Policy is effective as of June 24, 2026 and was last updated on June 24, 2026. By downloading, installing, or using the MedTrack app, or by visiting medtrackapp.com, you consent to the practices described in this Policy.

2. What We Collect

We collect only what we need to operate MedTrack and provide the features described in the app. The categories below enumerate everything we collect.

a) Account information

• Email address
• Display name (if you provide one)
• Profile photo URL (if you sign in with Google or Apple and your provider exposes one)
• Authentication provider identifier (your Google sub identifier, Apple user identifier, or email)

b) MCAT performance data

• Practice block scores you log (date, section, number correct, number of questions, raw percentage)
• MCAT exam scores you enter (overall score plus section subscores)
• Review queue items you flag
• Computed practice accuracy and projected MCAT range (derived from your data, not entered by you)

c) AMCAS-style experience data

• Clinical hours, volunteer hours, shadowing hours, and research hours you log
• Per-experience descriptions, dates, supervisor info, and location
• All self-reported by you

d) School targets

• The list of target medical schools you add
• Tier classification (reach / target / safety) — computed by the app
• School-specific notes you save

e) AI Advisor conversation history

• Full chat transcripts between you and the AI Advisor
• Stored so the Advisor can maintain context across sessions

f) Practice Interview history

• Interview transcripts (text)
• Voice recordings during live Practice Interviews — see Section 5 ("AI Features & Voice Data") for full disclosure of how audio is handled
• Rubric grades and AI-generated feedback
• Date, duration, and completion status

g) Subscription & billing data

• Subscription state (free, trial, active, expired)
• Subscription tier (Premium)
• Practice Interview consumables you own and have used in the current month
• Monthly reset dates
• We do NOT store credit card numbers or full payment information. Apple handles all payment processing.

h) Referral data

• The referral code your account generated
• Any referral code you redeemed
• Pending referral state

i) Device & usage data

• iOS version, device model, app version, and build number
• Crash reports and non-fatal error logs (via Firebase Crashlytics)
• IP address (transient — used for authentication only; not stored long-term in our database)
• Approximate region derived from IP at sign-in

j) Cookies & web tracking (medtrackapp.com only)

• Essential cookies needed for site functionality
• We do NOT use third-party advertising trackers, retargeting pixels, or analytics that build behavioral profiles
• If we add Google Analytics or a similar tool in the future, we will disclose it specifically in this section and offer opt-out

3. How We Use Your Information

We use the data above to:

• Operate the app's core features (track MCAT progress, log hours, manage your school list)
• Authenticate you and prevent unauthorized access to your account
• Compute personalized projections (Projected MCAT range, practice accuracy, MedTrack Score)
• Generate AI-powered features (AI Advisor responses, Practice Interview grading and feedback)
• Provide customer support
• Detect, prevent, and respond to security incidents and abuse
• Comply with legal obligations
• Improve the app using aggregated, anonymized analytics

We do NOT sell your personal information to third parties. We do NOT use your data for advertising or build advertising profiles.

4. Third-Party Services & Sub-Processors

MedTrack relies on the following third-party services to operate. Each is listed below with the data shared, the purpose, and a link to the provider's privacy policy.

Sign-in providers (when used):

• Sign in with Apple: https://www.apple.com/legal/privacy/
• Sign in with Google: https://policies.google.com/privacy

These sub-processors may be located outside your home jurisdiction (most are based in the United States). Data is transferred to them subject to appropriate safeguards, including Standard Contractual Clauses for transfers from the European Union.

5. AI Features & Voice Data

Legal review recommended

MedTrack offers two AI-powered features that involve sending your data to third-party AI providers:

Voice Practice Interview. During a live Practice Interview, audio from your device is transmitted directly to OpenAI's servers via an authenticated WebSocket connection to OpenAI's Realtime API. OpenAI processes the audio to generate AI interviewer responses in real time.

MedTrack does NOT store raw audio recordings of Practice Interviews on our servers. Transcripts of interviews are stored in your account so you can review your performance.

OpenAI's data handling for the Realtime API is governed by its privacy policy and API data usage policies. As of June 24, 2026, OpenAI's stated policy for API customers is that input and output are not used to train OpenAI's models unless you have explicitly opted in. For the most current terms, refer to OpenAI's policies at https://openai.com/policies/api-data-usage-policies.

AI Advisor. Your AI Advisor messages — and the context window of your prior conversation — are sent to OpenAI for processing. Responses are generated by OpenAI's GPT models.

AI Advisor outputs are AI-generated content and may contain inaccuracies. AI Advisor is NOT a substitute for guidance from licensed admissions counselors, physicians, or medical educators.

All AI features rely on third-party AI providers. We may change AI providers in the future and will update this Policy accordingly.

6. Data Sharing & Disclosure

Beyond the sub-processors listed in Section 4, we may share your data:

• With your consent
• To comply with legal process, including subpoenas, court orders, and lawful government requests
• To enforce our Terms of Service or protect the rights, property, or safety of MedTrack, our users, or the public
• In connection with a corporate transaction (merger, acquisition, or asset sale), with notice to users
• In aggregated, de-identified form for research, statistics, or product improvement

We do NOT sell or rent your personal data.

7. Data Retention

We retain different categories of data for different periods:

• Account data: retained while your account is active. Deleted within 30 days of an account deletion request (see Section 8).
• MCAT, experience, school, advisor, and interview data: retained while your account is active; deleted on account deletion.
• Subscription records: retained for 7 years for tax and accounting compliance even after account deletion. Only billing-relevant fields are retained — not personal content.
• Crash logs: retained for 90 days, then auto-purged by Firebase.
• Backup snapshots: rotated and purged within 90 days of account deletion (Firebase backup retention).

8. Account Deletion

You can request deletion of your account and associated data at any time.

In-app path:

1. Open the MedTrack app
2. Go to Settings → Account & data requests
3. Tap "Request deletion" to open a pre-filled email with your account identifier
4. Send the email

We will respond within 7 days confirming deletion. Upon processing, the following are permanently deleted from our systems within 7 days of the request:

• Your account
• MCAT data
• Experience hours
• Target schools
• AI Advisor history
• Practice Interview history
• Authentication credentials

Backup snapshots are purged within 90 days of the deletion. Subscription records are retained per the retention rules in Section 7 (billing-relevant fields only).

Alternate path: If you cannot access the app, email medtrackinfo@gmail.com from the address associated with your account.

Deletion is permanent and cannot be reversed.

9. Your Rights (US — including California Privacy Rights)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know what categories of personal information we collect, where it comes from, the purposes for which we use it, and the categories of third parties with whom we share it
• Right to access specific pieces of personal information we have collected about you in the prior 12 months
• Right to delete your personal information (see Section 8)
• Right to correct inaccurate personal information
• Right to opt out of sale or sharing. We do not sell or share personal information as defined under the CCPA.
• Right to limit use of sensitive personal information
• Right to non-discrimination for exercising any of these rights

How to exercise these rights: email medtrackinfo@gmail.com from your account email, with the subject line "California Privacy Rights Request." We will respond within 45 days.

For non-California residents in the United States: the same rights are extended on a best-effort basis. Privacy laws in Virginia, Colorado, Connecticut, Utah, and other states may also apply. Legal review recommended

10. Your Rights (EU / UK / EEA)

Legal review recommended

If you are located in the European Union, the United Kingdom, or the European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure / "right to be forgotten" (Article 17)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20)
• Right to object (Article 21)
• Rights related to automated decision-making (Article 22). The Projected MCAT score and MedTrack Score are computed algorithmically; you have the right to understand how.

Legal basis for processing (GDPR Article 6):

• Performance of a contract — operating the app you signed up for
• Legitimate interest — security, fraud prevention, and product improvement
• Consent — for optional features you explicitly enable

Data Protection Officer. MedTrack LLC has not appointed a Data Protection Officer because one is not required under GDPR Article 37 given our company size and the scope of our processing. For data protection questions, contact medtrackinfo@gmail.com.

Supervisory authority. You have the right to lodge a complaint with your local Data Protection Authority.

11. Children's Privacy

MedTrack is intended for users 17 years of age or older, matching our App Store age rating.

• The app is not directed to children under 13. We do not knowingly collect personal information from children under 13.
• If you believe a child under 13 has provided us with personal information, please contact medtrackinfo@gmail.com and we will delete the information.
• Users between 13 and the age of majority in their jurisdiction should obtain parental or guardian consent before using the app.

12. Security

We protect your data with the following measures:

• Encryption in transit (TLS 1.2 or higher) for all data between the app and our servers
• Encryption at rest in Firebase and Google Cloud (AES-256, managed by Google)
• Firebase Authentication for identity management
• Firestore Security Rules that enforce per-user data access — you can only read or write your own data
• Server-only fields for subscription state and quota, writable only by Cloud Functions using the Admin SDK; clients cannot write to these fields directly
• Firebase Crashlytics for incident detection

No security system is impenetrable. We cannot guarantee absolute security of data transmitted over the internet.

13. International Data Transfers

MedTrack is operated from the United States. Your data may be transferred, stored, and processed in the United States and in other countries where our sub-processors operate.

For users in the European Union, United Kingdom, or European Economic Area, transfers to the United States are subject to Standard Contractual Clauses or equivalent legal safeguards.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via in-app notification or email. Continued use of the app or website after changes constitutes acceptance of the updated Policy.

15. Contact Us

For privacy questions, data requests, or to exercise any of the rights described above:

Email: medtrackinfo@gmail.com

You can reach MedTrack LLC by email at medtrackinfo@gmail.com. We are a Michigan limited liability company.