Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

• Account Information: Email address, display name, and authentication credentials when you create an account.
• Profile Information: Training system preference, role, study goals, daily time goals, and onboarding responses.
• Uploaded Content: Documents, PDFs, examination papers, question papers, and other study materials you upload through the "My Paths" feature.
• Communications: Messages, feedback, support requests, and any other correspondence you send to us.

1.2 Information Collected Automatically

• Usage Data: Study progress, quiz responses, correct/incorrect answers, time spent on questions, mastery levels, experience points, streaks, and learning analytics.
• Device Information: Browser type and version, operating system, screen resolution, device type, and unique device identifiers.
• Log Data: IP address, access timestamps, pages visited, referring URLs, and interaction patterns with the Service.
• Cookies and Similar Technologies: Session cookies, authentication tokens, and similar local storage technologies necessary for the Service to function.

1.3 Information from Third Parties

• Authentication Providers: If you sign in via third-party services (e.g., Google, GitHub), we may receive your name, email, and profile picture from those providers.
• Payment Processors: Our payment processors may share transaction status, subscription status, and payment method type (but not full card numbers) with us.
• Billing and Refund Terms: Subscription refunds and cancellations are governed by our Terms of Service. Except where required by law, subscription fees are non-refundable; if you cancel, access continues until the end of your current paid billing period.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: To provide, maintain, operate, and improve the Rounds Study platform and its features.
• AI Processing: To process uploaded documents through AI models for question extraction, explanation generation, and content analysis.
• Personalization: To personalize your learning experience, including adaptive question selection, spaced repetition scheduling, and study recommendations.
• Analytics: To generate performance analytics, mastery tracking, and study progress reports for your benefit.
• Communication: To send important service updates, security alerts, account notifications, and transactional emails.
• Security: To detect, prevent, and address fraud, abuse, security incidents, and technical issues.
• Compliance: To comply with legal obligations, enforce our Terms of Service, and protect our rights.
• Improvement: To analyze usage patterns and improve the accuracy of our content and AI models.

3. AI Processing Disclosure

• Document Processing: When you upload documents through My Paths, the content is sent to third-party AI model providers (such as OpenAI) for processing, including text extraction, question identification, answer generation, and explanation creation.
• AI-Generated Explanations: Question explanations, clinical case content, and study recommendations may be generated or enhanced by AI models.
• Study Tool and Verification: Rounds is a study tool. AI outputs can be wrong, incomplete, or outdated. You should double-check important information before relying on it.
• Data Minimization: We send only the minimum necessary content to AI providers for processing. We do not send your personal account information (name, email) to AI models.
• Third-Party AI Providers: Our AI model providers process content under their own data processing agreements. We select providers that commit to not using your data for training their models. However, you acknowledge that by using the Service, your uploaded content will be transmitted to these third-party providers.
• Provider Privacy Policies: For current model providers, you can review OpenAI's Privacy Policy and Google's Privacy Policy. Provider list and policies may change over time.
• No Training Commitment: We do not use your personal data or User Content to train proprietary AI models without your explicit consent.

4. Data Sharing and Third Parties

We do not sell your personal information. We may share information in the following limited circumstances:

• Service Providers: We share data with trusted third-party service providers who assist in operating the Service, including cloud hosting (Vercel, Supabase), AI processing (OpenAI), payment processing (Creem), and email delivery services. These providers are contractually obligated to protect your data.
• Path Sharing: If you share a study path with other users, they will be able to access the questions and content in that path. Your email address may be visible to users you explicitly share paths with.
• Legal Requirements: We may disclose information when required by law, subpoena, court order, or other legal process, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In the event of a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred as part of the transaction. We will notify you of any such change.
• Aggregated Data: We may share aggregated, anonymized, or de-identified data that cannot reasonably identify you, for analytics, research, or marketing purposes.

5. Data Retention and Deletion

We retain your personal information for as long as your account is active or as needed to provide the Service. Specifically:

• Account Data: Retained for the lifetime of your account and for up to 30 days after account deletion to allow for recovery.
• Study Progress: Performance data is retained as long as your account is active to enable learning analytics and spaced repetition.
• Uploaded Documents: Processed documents are stored while your account is active. Original files may be retained for a limited period for processing and then deleted.
• Log Data: Server logs are retained for up to 90 days for security and debugging purposes.
• After Deletion: When you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law or for legitimate business purposes (e.g., fraud prevention, legal compliance).

6. Data Security

We implement industry-standard security measures to protect your data, including:

• Encryption of data in transit using TLS/SSL protocols
• Encryption of sensitive data at rest
• Row-level security (RLS) policies enforced at the database level to ensure users can only access their own data
• Secure authentication mechanisms with bcrypt-hashed passwords
• Regular security audits and vulnerability assessments
• Access controls limiting employee access to personal data on a need-to-know basis

No Absolute Security: While we strive to protect your personal information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data, and you use the Service at your own risk.

7. Children's Privacy

The Service is not intended for anyone under 18 years of age or the age of legal majority in their jurisdiction, whichever is higher. We do not knowingly collect personal information from users below this threshold. If we become aware that we have collected personal information from someone below this threshold, we will take steps to delete such information promptly. If you believe that someone below this threshold has provided us with personal information, please contact us at support@rounds.study.

8. International Data Transfers

Your information may be transferred to and processed in countries other than the country in which you reside. These countries may have data protection laws that are different from the laws of your country. By using the Service, you consent to the transfer of your information to these countries.

We take appropriate safeguards to ensure that your personal information remains protected in accordance with this Privacy Policy when transferred internationally, including the use of standard contractual clauses where applicable.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete personal data.
• Deletion: Request deletion of your personal data, subject to certain legal exceptions.
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to certain processing of your personal data.
• Restriction: Request restriction of processing of your personal data.
• Withdrawal of Consent: Where we rely on consent for processing, you may withdraw your consent at any time.

To exercise any of these rights, please contact us at support@rounds.study. We will respond to your request within 30 days or as required by applicable law.

California Residents (CCPA)

If you are a California resident, you have the right to: (a) know what personal information we collect, use, and disclose; (b) request deletion of your personal information; (c) opt out of the sale of your personal information (we do not sell personal information); and (d) not be discriminated against for exercising your privacy rights.

European Residents (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under GDPR, including the right to lodge a complaint with your local supervisory authority. Our legal basis for processing your data includes: performance of a contract, legitimate interests, consent, and compliance with legal obligations.

10. Cookies and Tracking Technologies

We use the following types of cookies and similar technologies:

• Essential Cookies: Required for the Service to function properly, including authentication, session management, and security tokens. These cannot be disabled.
• Functional Cookies: Used to remember your preferences, such as theme settings and language preferences.
• Analytics Cookies: Used to understand how you interact with the Service, including page views, feature usage, and performance metrics. We use this data to improve the Service.

We do not use third-party advertising or tracking cookies. We do not participate in cross-site tracking or targeted advertising.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by:

• Posting the updated policy on this page with a new "Last updated" date
• Sending an email notification to the address associated with your account
• Displaying a prominent notice within the Service

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised Privacy Policy. We encourage you to review this policy periodically.

12. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: