Privacy Notice

Draft — not legally reviewed. Fields in [BRACKETS] must be completed by the business owner before launch.

Controller: [COMPANY NAME, ADDRESS, CONTACT EMAIL].

Data we process: email address (sign-in), orders and access period, study progress and bookmarks, content issue reports, and technical security logs. Card details are handled by the payment provider and never stored by us.

No patient data: the service has no upload function and must not be used to enter patient information.

Legal bases: contract (account, access, progress), legal obligation (accounting records), legitimate interest (security, abuse prevention). Marketing email only with separate, optional consent.

Processors: hosting/database provider, payment provider, email provider [LIST WITH LOCATIONS AND TRANSFER SAFEGUARDS].

Retention: account and progress until account deletion; orders as required by bookkeeping law [PERIOD]; logs [PERIOD].

Your rights: access, rectification, erasure, restriction, portability, objection, and complaint to your data protection authority.