Privacy Policy

Last updated: 1 October 2026

This policy explains what data HealthITPrep collects, why, how we protect it, and your rights over it. We collect the least data needed to provide the service, we do not sell your data, and we use no advertising trackers.

Responsible for your data: Adel Moustafa, who runs HealthITPrep. You can write to hello@healthitprep.com.

1. Data we collect

• Account data: your name, email address, password (stored as a one-way hash that cannot be recovered), and preferences (site language, explanation language, theme).
• Study data: your answers and choices, flagged questions, simulation results, acronym card ratings, and the error reports you send.
• Payment data: for manual transfers, the method, amount, reference number, and the proof-of-transfer image you upload. For card payments, Paddle processes the payment; we never see or store your card number and only receive the transaction details (such as amount and status).
• How you found us: if you arrive through a campaign link (such as a LinkedIn post) or from another site, we keep the campaign or site name and the first page you opened in a cookie for 30 days, then with your account when you sign up, to learn which of our posts help. No third-party tracker is involved.
• Your exam date and email choices: if you enter your exam date on your account page, we keep it to send you a study plan and, after the date, to ask how it went. We send automatic emails tied to your account: welcome, your trial exam result, and reminders you can stop from a link in each one or on your account page. We send news or offers only if you agree to them. What you write in "How did your exam go?" is published only with your permission.
• What you choose to share: if you press "Share your result" or share your streak, we create a public page with a private link showing the card image and the result (or number of days), your first name only if you choose, and count its views. No questions and no e-mail are shown. You can stop sharing and delete the page at any time from the share window.
• Visit statistics: we record the page opened, where the visit came from, the device type and the site language, with an anonymous code that changes every day instead of your IP address, and no cookie. Nothing is recorded if your browser sends "Do Not Track" or Global Privacy Control.
• Technical data: IP address, browser type, and sign-in times, in server and session logs, for security and troubleshooting.
• Content protection data: a log of the questions, explanations, and acronyms opened (when, and from which IP address), and the devices registered to your account (browser and system type), to apply the daily limits and the device limit and to detect copying and account sharing.

2. Cookies and browser storage

We use only first-party cookies: a session cookie that keeps you signed in, a cookie that protects against forged requests, the site language, and one that remembers you closed the language and look bar. If you arrive through a campaign link (including our short links) or from another site, also the "how you found us" cookie described above, for 30 days. Your light or dark mode choice is saved in your browser. We use no advertising cookies and do not track you across other sites.

3. Why we use your data

• To provide the service: saving your progress, smart review, and statistics.
• To activate memberships and process payments and refunds.
• To send essential service emails, such as email confirmation, password resets, membership confirmation, and new-device sign-in alerts.
• To improve the content using aggregated statistics (such as the hardest questions) that do not identify anyone.
• To protect the site, prevent abuse, and comply with the law.

4. Who can see your data

• Authorized administrators only, and only as needed (for example, to review a proof of transfer). Transfer receipts are stored privately and only administrators can open them.
• Service providers working on our behalf: our server hosting company and our email delivery service@if ($paddle), and Paddle for payment processing@endif. They must protect the data and may not use it for other purposes.
• Authorities, when required by law.

Your data may be processed on servers outside your country, with the level of protection described here.

5. How long we keep data

We keep your data while your account is active. When you ask us to delete your account, we delete your data within 30 days, except payment records that the law requires us to keep for the period it sets. Technical server logs are deleted automatically after a short time.

6. Your rights

• Access and copy: you can download a copy of your study data from the Statistics page at any time.
• Correction: you can change your preferences on your account page and write to us to correct other data.
• Deletion: you can clear your study data from the Statistics page, or ask us by email to delete your whole account.
• Questions and objections: write to us about any question or objection regarding how we use your data.

7. Security

We use encrypted connections, password hashing, limited administrator permissions, and regular backups. No protection is perfect, but we handle any security incident quickly and notify affected users when needed.

8. Age

The site is intended for people aged 18 or older, and we do not knowingly collect data from anyone younger.

9. Changes to this policy

We may update this policy, will change the "Last updated" date above, and will notify you of material changes.

10. Contact

For privacy and deletion requests, write to us at hello@healthitprep.com from the email address on your account.