Privacy policy

Last updated October 30, 2026

This English text is the binding version. The copies of this page in other languages are translations, for convenience.

Who is responsible

MedUni Exam is operated by an individual trading as MedUni Exam, based in England. That person is the data controller for personal data processed through meduniexam.com, at Hailsham, East Sussex, BN27, United Kingdom. Contact us at support@meduniexam.com about anything in this policy, including a request to see or delete your data.

What we collect

Data	Why	Legal basis
Email address and password hash (registered accounts)	To sign you in and keep your library across devices	Performance of the contract
An account id, which every workspace has, a guest workspace included	To keep your documents, questions and results together	Performance of the contract
Documents you upload and the text extracted from them	To generate and verify questions	Performance of the contract
Files of exam questions you upload: the questions and answer keys read out of them, the practice sets made from them, and the results of answer key checks against your notes	To let you practice those questions, check their answer keys against your notes and use them as a guide for new questions from your notes. They are marked as not checked, no other user can see them, and they cannot be shared	Performance of the contract
Questions, answers, grades, mastery and review history, the exam date you set with its review plan, and the tutor's replies	To grade you and schedule review	Performance of the contract
Session cookie	To keep you signed in; required for the site to work	Strictly necessary
IP address, kept for a few hours for rate limiting, and a daily one-way hash of it, stored with each upload from a guest workspace, with a referral sign-up and with a feedback message, kept until the check ends with an answer key check from a guest workspace or from an account whose email address is not confirmed, and used for the per-network counters	To stop abuse of sign-in, registration, uploads and generation	Legitimate interest in keeping the service available
Payment records: amount, currency, plan, Stripe identifiers, and for a purchase in the iOS app the App Store transaction identifiers and a random purchase token made for your account	To give you what you paid for and to keep accounts	Contract and legal obligation
With each purchase on the website: the refund rules it was sold under, when you asked at checkout for it to start at once, when you first used a paid feature it pays for, and when its thank-you email was sent	To decide a refund request by the rules you bought under, and to send that email once	Contract and legal obligation
Two-letter country code of your network, kept with each upload, generation and exam start, in the usage records and with the first-party counter's events	To count how the service is used. The network address and the city are read only to leave out our own testing and are never stored: the address is compared, as a keyed hash, with networks we have marked as ours	Legitimate interest in knowing how the service is used
Referral records, if you share your link or arrive through someone else's: your referral code, which workspace a link brought in and when, and whether the bonus was credited	To credit the bonus questions once, to each side that qualifies	Performance of the contract
A daily one-way hash of your network, kept with the referral records: for a workspace that has a referral link (one is made the first time the app shows you your invite link, or when you share an exam), each time it loads the site, uploads a file or starts a generation; for the new workspace, when the referral is recorded and when it is credited	To refuse a referral credit when both workspaces were on the same network on the same day, which is how a person would refer themselves	Legitimate interest in preventing abuse of the bonus
A first name you choose to type on an exam link you share with your class, shown to anyone who opens the link	To tell the people you share it with who sent it	Consent: leave it empty, or take the link down at any time
Messages you send through the feedback form: the message, the reply address you give, the page it was sent from, your browser's user agent and a daily one-way hash of your network address	To answer you, and to stop the form being used to send spam	Legitimate interest in answering you and in keeping the form usable
Error reports from the app: when a script on a page fails, the kind of error, the start of its message and where it happened, counted by the first-party counter	To find and fix what breaks	Legitimate interest in keeping the service working
A quote you choose to leave after rating the site 4 or 5 stars: the text, an optional first name and school, your rating and the time you gave consent	To show it on the site, and only after we have approved it	Consent, which you can withdraw at any time
Agreement to the rules for shared content: for a guest workspace, the time it agreed to them before its first shared set or quote. A registered account agrees to the terms when it is made.	To show that the rules were accepted before anything was shown to other students	Performance of the contract
Reports you send about a question, a tutor reply, a debrief or a shared class set: the reason, the note you add, and a copy of what you reported as it stood at that moment. Also the students you block, whose shared sets you then no longer see	To review and remove wrong or offensive content, and to keep a blocked student's sets away from you	Legitimate interest in keeping the service accurate and safe
In the phone apps: the time you agreed to the notice about AI processing, and the time you allowed the usage count. Withdrawing either on the Account page clears it	To send your material to the AI providers, and to count how the app is used, only after you agree	Consent, which you can withdraw at any time
Page views, counted with no identifier, and conversion events, which carry your account id if you are signed in and the country of your network, so they are not anonymous. The phone apps send the counter no events until you allow the usage count. The server still notes three things from the apps, as it does on the website: a sign-in with Google or Facebook, with your account id; a request that a daily limit refused, with your account id; and the opening of a shared set, with no identifier	To see which pages bring people to the service	Consent for the analytics and advertising tools and for the usage count in the phone apps; legitimate interest for the first-party counter on the website

We do not ask for your name, your university or any health data about you, apart from two things you can choose to give: a first name on an exam link you share, and a first name and school with a quote you leave. Do not upload documents containing personal data about other people, including patient records.

We do not sell personal data, we do not pass it to data brokers, and the site reads no advertising identifier from your device.

Where your document text goes

Generating a question means sending passages of your document to an AI provider. Depending on your plan and which providers are configured, that can be any of: OpenRouter, Groq, Cerebras, SambaNova, Mistral, Google, NVIDIA and Cloudflare Workers AI for generation, and Anthropic for the paid plans and question packs, and for checking the answer keys of free-plan questions. Only the passages needed for the request are sent, together with the instructions for the task. On a paid plan or a question pack, Anthropic also receives the questions you ask the tutor, with the question and the passages of your notes they are about, your written answers for marking, and the questions of an exam you finish, with your answers, for the debrief. These providers process the text to return a response; the ones used here state that data sent through their paid interfaces is not used to train their models, while free tiers of some providers may use submitted content for model improvement, so a free-plan job carries that risk; the app shows which lane a job will run on before you start it. A paid plan runs its jobs on the paid interfaces, but a call they cannot take, because a site-wide daily limit is spent, a provider refuses it or it times out, goes to the free pool instead of failing, and the passages in that call carry the same risk as a free-plan job. Scanned pages are additionally sent to Google Cloud Vision for text recognition. If you are not comfortable with a document leaving our servers, do not upload it.

When you open a file of exam questions in your library, our own code reads the questions and their answer keys out of it and stores them with the file. No AI provider is involved in that step. An answer key check sends each question, without the answer key from your file, together with the passages of your notes it is checked against, to the same providers as a generation. It runs on the free or paid lane the same way a generation does, so what is said above about the free tiers applies to it as well. Using a file of exam questions as a guide for a generation sends none of its questions to any provider; only your notes are sent, as in any generation. We do not use these questions or the results of a check to train any model.

In the phone apps, none of your documents, written answers or tutor questions go to these providers until you agree to the notice the app shows first. If you withdraw that agreement on the Account page, generation jobs and answer key checks that are queued or running stop, and so do explanations not yet written; a request already sent still finishes.

Other processors

Cloudflare: hosting, the database, file storage and network protection. Files and database records are stored in Cloudflare infrastructure. When the human check on the upload box is switched on, it is Cloudflare Turnstile, which sets no cookie for advertising and is used only to tell a person from a script.
Stripe: payments. Stripe receives your email and billing details directly and we never see your card number. Stripe is a controller for its own fraud prevention.
Apple: purchases in the iOS app. Apple takes the payment through the App Store, as a controller under its own terms, and we never see your Apple Account or payment details. The app gives Apple a random token made for your account, not your email, so that the purchase can be matched to your account. We then ask Apple for the record of that purchase: the product, the price and currency, the dates and whether it was refunded. For a subscription bought there, Apple also tells us when it renews, ends or is refunded.
Cloudflare Email Sending: email from the site, for example a password reset link. Your address is also used for the weekly review digest, sent only in a week when questions are due, and for one reminder seven days before the exam date you set. Both are on by default for a registered account once its address is confirmed (the link in the welcome email or in the confirm email the account page sends, a password reset, or a Google sign-in), and both stop when you switch them off on the account page or use the unsubscribe link in every message.
Google (Analytics and Ads) and Meta: measurement and advertising, loaded only after you accept in the cookie banner.
Cloudflare Web Analytics: counts page loads, how fast they load, the referring website, the country and the type of device, browser and operating system, and is loaded only after you accept analytics in the cookie banner. It sets no cookie and stores nothing in your browser. Cloudflare keeps the full data for seven days and only a sample of it after that, and its reports cover the last six months.
Fonts: the heading typeface is served from meduniexam.com itself, so no third party is contacted for it and nobody outside this site sees your IP address or browser when a page loads. No cookie is set by it, and the site falls back to a font already on your device if the file is blocked.

Some of these providers are outside the United Kingdom and the European Economic Area. Those transfers rely on the UK International Data Transfer Addendum and the European Commission’s standard contractual clauses.

Cookies and similar storage

ef_session: the sign-in cookie. Essential, set for 30 days, no consent needed.
ef_ref: set only when you arrive on a referral link someone shared with you and tap the button that claims the bonus questions. Opening the link alone sets nothing. It holds the referral code, the time of the visit and a signature that stops it being written by hand, and nothing about you. First party and HTTP only, kept for 30 days and removed once the referral is settled.
meduni_consent and meduni_theme: stored in your browser only, to remember your cookie choice for six months and your theme.
meduni_ui_lang: the language you are reading the site in, kept for a year. It holds a language code and nothing else, and the server reads it so the page arrives in that language instead of switching after it loads. Essential to the choice you made, no consent needed.
Analytics and advertising cookies: set by Google Analytics 4, Google Ads, the Meta pixel, the Reddit pixel and the TikTok pixel, each only when the owner has configured it and only if you choose Accept all. Until then Google Consent Mode is set to denied for analytics storage, ad storage, ad user data and ad personalization, and no advertising cookie is written.
First-party counter: page views are counted server side as a day, a path and a referring website, with no identifier of any kind. Conversion steps (a sample exam finished, a file uploaded, a sign-up, a checkout, a purchase, and the reason you pick if you answer the question shown after a canceled checkout) are stored with your account id if you are signed in, with the campaign the visit arrived on (utm tags, an ad platform's click id, or the tag on a link from one of our articles; for a visit from an AI assistant such as ChatGPT that carries none of these, the assistant's web address as your browser reports it; kept in your browser's local storage for 30 days), with the address of the first page of this site you opened in those 30 days (kept the same way, without any query or search terms) and with the two-letter country code of your network. No IP address, no cookie and no name is stored by the counter. It runs whether or not you accept cookies because it sets no cookie of its own.

On the website you can change your choice at any time from the Cookie choices link at the foot of every page, or from Cookie settings on your Account page. The phone apps load no cookie-based analytics and show no cookie banner. Clearing site data in your browser also resets it.

How long we keep things

Documents, questions and results: until you delete them or delete your account, which you can do yourself at any time from the account page (how deletion works).
Files of exam questions: the questions and answer keys read out of a file are kept until you delete the file or your account. An answer key check keeps, for each question, the answer the model gave and at most one sentence it quoted from your notes, with its page. These results are kept until you delete the file, the notes it was checked against or your account. Deleting the file also deletes its practice set and the tutor chats about its questions, and removes those questions from your review queue and from your other sets and their results. In a guest workspace, all of this goes when its documents expire.
Messages sent through the feedback form: kept with the message, the page it was sent from and the browser it came from; the email address is removed when the account is deleted.
Guest workspaces with no documents in them: deleted three days after the workspace is created.
Guest workspaces that hold documents: the documents, and the stored files behind them, are deleted after 30 days with no activity in that workspace. Uploading, generating or taking an exam counts as activity, and so does signing in to it again. Create an account and your library is kept until you delete it.
Sessions: 30 days, or until you sign out.
Rate limiting records: a few hours. The per-network daily counters: three days, and the hash they are keyed by stops matching an address as soon as the salt rolls at midnight.
The daily network hash kept with an answer key check from a guest workspace or from an account whose email address is not confirmed: until the check ends, and never longer than three days.
Referral records: until either workspace is deleted. The daily network hashes of a workspace that has a referral link: 31 days, the life of a referral cookie and one day more, and like every daily hash they stop matching an address when the salt rolls at midnight. Both go sooner when you delete your account, or when a guest workspace expires.
Exam share links, with the first name you typed on one and the language its chat preview is written in: until you take the link down or delete your account. The links of a guest workspace go when the workspace expires.
Student quotes: until you withdraw the quote or delete your account. A quote is shown only after we have approved it, and only while your rating of the site stays at 4 or 5 stars. To withdraw one, use the withdraw control under your quote in your account settings, or write to support@meduniexam.com and we delete it; deleting your account deletes it too.
Reports and blocks: the reports you sent, the students you blocked and any block of you are deleted with your account or guest workspace. A report another student sent on a set you shared stays for us to act on, with a copy of the set's title, its questions and the first name on the link. When your account or guest workspace is deleted, that copy is cleared, unless you took the link down yourself before then; in that case the report keeps it.
The times you agreed to the AI notice, the usage count or the rules for shared content: kept with the account or guest workspace and deleted with it. Withdrawing the AI notice or the usage count on the Account page clears its time at once.
Password reset tokens: one hour.
Payment records: six years, because tax law requires it.
Page view counters: kept as daily totals with no personal data, for 90 days. Conversion events: 90 days, and the account id on them is removed when you delete your account.
Usage records: one line for each upload, generation and exam start, with the time, the kind of action, the two-letter country of the network and, for a generation, the free or paid lane, the language and the number of questions asked. The line itself holds no account, name, document title or IP address, and is kept for 400 days. It points to the upload, job or exam record it counts, and only that record links it to your account. The record is deleted when you delete it, the document it belongs to or your account; after that, the line no longer links to you.

Your rights

Under the UK GDPR you can ask for a copy of your data, correct it, delete it, restrict or object to processing, and receive it in a portable form. Deleting the account does not need a request: the account page has a Delete account control, and the deletion page says what goes and what tax law makes us keep. You can also withdraw consent for analytics and advertising at any time without affecting anything done before. Write to support@meduniexam.com and we will respond within one month. You can delete any document in your library yourself, which removes its questions and results at once. If you think we have handled your data badly you can complain to the Information Commissioner’s Office at ico.org.uk.

Security

Passwords are stored as PBKDF2 hashes, never in readable form. Traffic is encrypted in transit. Session cookies are HTTP only, same site and secure. Access to a document is checked against its owner on every request. No system is perfect; tell us at support@meduniexam.com if you find a weakness and we will fix it.

Children

The service is not intended for anyone under 16 and we do not knowingly collect their data.

Changes

We update this page when the processing changes. The date at the top is the version in force, and material changes are announced in the app.

Published September 11, 2026, updated October 30, 2026.