Information we use

  • Account information: name, email, a securely hashed password, verification status and your account role.
  • Study activity: selected answers, flags, attempt times, results and progress. Browser-only study notes and preferences stay in browser storage unless a feature explicitly sends them to the server.
  • Purchase information: order and customer identifiers, pass tier, payment status and access dates. Card details are handled by Lemon Squeezy, not stored by SMLEMed.
  • Support and assurance information you choose to send. For assurance, provide only a redacted result and relevant exam dates. Never send patient records, identity documents, card details or unnecessary medical information.
  • Technical information: requests, security logs and limited device/network information used to operate and protect the service.

Why we process information

We use account, study and purchase information to provide the service you request, save progress, verify access and respond to support requests. We use limited security information to prevent abuse and meet applicable obligations. Marketing email and optional analytics depend on your choice. Where required by applicable law, we obtain consent or rely on the appropriate lawful ground for the specific purpose. We do not sell personal information.

Optional analytics and marketing

If enabled, optional Google Analytics loads only after consent. Its study-funnel events exclude email addresses and question responses. Optional first- and last-source cookies record the landing path, referring hostname, campaign tags and time for up to 90 days. You can decline or change your choice below. Withdrawal stops future optional collection; it does not undo earlier lawful processing.

Marketing is optional. Unsubscribe through the link in a marketing email or contact support. Account verification, purchase and service messages may still be sent when needed to provide your account.

Providers and international processing

The service uses hosting and database providers, Lemon Squeezy for checkout and Resend for email when configured. Google receives analytics information only when enabled and permitted. These providers may process data outside your country. We limit information to the relevant purpose and must use legally required safeguards for any restricted international transfer. Provider privacy notices also apply to their own services: Lemon Squeezy, Resend and Google.

Retention

Account and study records are retained while your account is open, including after a pass expires so you can return to your progress. You can request deletion at any time. We aim to complete verified deletion requests within 30 days, subject to applicable law. Some transaction, fraud-prevention or dispute records may need to be retained for legal obligations or active claims; we will explain an applicable exception in our response. Residual backup copies are removed through the relevant provider's backup lifecycle rather than kept in active use. Security request counters expire logically after their rate-limit window and are periodically cleared.

Your rights and requests

Depending on applicable law, you may request information about processing, access or a copy of your information, correction, deletion, restriction, objection and withdrawal of consent. Email support@smlemed.com from your account email. We may need proportionate verification before acting. We aim to respond within 30 days or the period required by law. We will explain a refusal or extension and any available remedy.

You can complain to the relevant data protection authority. Where Saudi Arabia's Personal Data Protection Law applies, the Saudi Data and AI Authority provides a personal data protection platform. Contact us first if you would like help resolving a concern.

Security and children

We use restricted access, encrypted sessions, password hashing and secure connections in production. No online service can guarantee absolute security. Report a suspected security issue privately to support@smlemed.com without extracting anyone else's information. SMLEMed is intended for adults preparing for medical examinations and is not offered to children.