Privacy Policy

This policy explains what information the TDMPrep question bank and the Study Guide Notes site, operated as TDMPrep (“we”), collect and how it is used. We follow Alberta’s Personal Information Protection Act (PIPA), Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable privacy laws. We handle information carefully because trust matters to the community of doctors and learners we serve. Please read this with the Terms of Use. We are based in Alberta, Canada.

We never ask for payment details or any health information, and we do not run advertising. If you sign in, we keep a record of your sign-ins and of how you use the Services, as described under “Sign-in records, activity and the watermark” below. We may require an account to use the question bank.

• Saved on your device only. Your practice progress, answers, flagged cases, test history, saved exam sessions, timers, the notes you type, display settings (such as light or dark theme and sidebar state) are stored in your browser’s local storage. They stay on your device and are not sent to us. Clearing your browser data deletes them.
• Technical logs. Our hosting provider, Vercel, automatically processes technical information needed to deliver and secure the Services, such as your IP address, browser and device type, pages requested, referring page, and date and time. We do not use it to identify you.
• Messages you send us. If you email us, we receive your email address and what you write, and use it to reply.

Please do not send or enter patient information or any actual or recalled MCC exam contentanywhere (see the Terms of Use).

Optional accounts are available. If you create one, we collect your first and last name, your email address, and, if you choose to give it, your phone number with its country code. You sign in with a password (stored only as a secure hash) or with your Google account; with Google we receive your name and email from Google, nothing else. Account data is stored by our database provider, Supabase, on servers in the United States, and is used only to run your account and to send account messages such as confirmation and password reset emails. Your phone number is shown back to you with only its last four digits.

Memberships are paid through Stripe, our payment processor. Stripe collects your card details and billing address on its own checkout page and handles them under its own privacy policy (stripe.com/privacy). The list below is what we collect and handle for a membership; nothing here is used for advertising or sold:

• Study data stored on our servers: your progress, answers, flags and test history, so you can use them on more than one device. This will be a choice, and we will tell you when it applies.
• Payment and billing records: your plan, purchase dates, amounts and billing country or province for tax. Card details are collected and held by our payment processor, not by us. We receive only a token, the last four digits and the card type.
• Service messages: receipts, security alerts, password resets and important notices. Promotional email only with your consent, with an unsubscribe link in each one.

We will keep account and billing records for as long as your account is open and for the period needed for tax, accounting and legal purposes after that. If you close your account, we will delete or anonymize your study data unless the law requires us to keep it. If a breach creates a real risk of significant harm to you, we will notify you and the regulator as the law requires.

When you are signed in, we collect and keep the following, linked to your account:

• Sign-in records: your email address, the date and time, the sign-in method (password or Google), your IP address, and your browser and device type, each time you sign in or open the Services in a new browser session.
• Activity: the pages you open and what you click (for example a link, a button, an answer option or the flag button), with the date and time. We record the label of what you clicked, not anything you type.
• Watermark: every page shows a faint pattern of your email address and the current date and time while you are signed in. Screenshots, recordings and shared screens therefore show it. We do not receive your screenshots; the watermark only lets us identify the source of copies we come across.

Why: to keep accounts secure, to detect shared or fake accounts and abuse, to protect our content from copying and redistribution, and to understand which parts of the Services are used so we can improve them. We do not sell this information, use it for advertising, or use it to make decisions about your exams or your career. Only the site owner can view it.

Consent: by creating an account and signing in, you agree to this collection for these purposes. If you do not agree, do not create an account; you can ask us to close your account and delete these records at any time (see “Your choices and rights”). Some parts of the Services may not be available without an account.

Fake accounts: to keep the community genuine, we confirm email addresses and refuse sign-ups from disposable or temporary email services, and we may suspend accounts that appear fake, shared or used to copy content.

We do not set advertising cookies. We use a small number of essential cookies: one that remembers you entered the access code, and, if you sign in, the sign-in cookies set by our account provider, Supabase. We use your browser’s local storage for the functions listed above, which you can clear at any time in your browser settings. Blocking local storage will not stop the Services from working, but your progress and settings will not be remembered.

• Hosting (Vercel). Both sites are hosted on Vercel, so Vercel receives your technical request information (section 2).
• Fonts (Study Guide Notes). The Study Notes site loads typefaces from Google Fonts, so Google receives your IP address and browser details when you open it. The TDMPrep question bank serves its fonts itself.
• Payments (Stripe). Stripe runs checkout, the 30-day trial, renewals and the billing portal. It receives your email, card and billing details and may process them in the United States and other countries.
• Links. Links to the MCC, Prometric and other sites take you to services we do not control; their own policies apply once you leave.

• to deliver, secure, maintain and troubleshoot the Services;
• to prevent abuse, scraping and breaches of the Terms of Use;
• to respond to your messages, complaints and takedown requests; and
• to meet legal obligations.

We do not sell or rent personal information, and we do not use it for advertising. We may disclose information to our service providers (such as hosting) so they can operate the Services for us, and where required or permitted by law, such as to comply with a court order or lawful request, to protect our rights, safety or the security of the Services, or to respond to a complaint about exam-content misuse, including to the MCC if asked to.

Our providers may process information on servers outside your province or outside Canada, including in the United States, where it may be subject to the laws of that place and accessible to its courts and authorities.

Sign-in records and activity are kept for 12 months and then deleted automatically; account details are kept while your account is open. Technical logs are kept by our hosting provider for the period set by its own policy. Emails to us are kept only as long as needed to respond and for record-keeping. We use reasonable safeguards, including encrypted connections (HTTPS), but no online service is perfectly secure, and data stored in your own browser is only as secure as your device.

You can clear locally stored data in your browser at any time. Under Canadian privacy law you may ask us whether we hold personal information about you (for example, an email you sent us), ask for access or correction, withdraw consent where applicable, or ask us to delete it, by emailing tdmcanadian@gmail.com. We may need to verify your identity first.

If we cannot resolve a concern, you may complain to the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca) or the Office of the Privacy Commissioner of Canada (priv.gc.ca), or to your own provincial regulator.

The Services are intended for medical graduates and trainees and are not directed to children. We do not knowingly collect personal information from children.

We may update this policy. The “Last updated” date shows the current version. When we add accounts, payments, analytics or other features that collect personal information, we will update this policy and tell you before the change takes effect.

Privacy questions, requests and complaints: tdmcanadian@gmail.com, Alberta, Canada.