Privacy policy

1. Who we are

RadiologyQuizLab is the website at radiologyquizlab.com. It is run by two individuals — a radiologist and a tech entrepreneur — and is not, at this stage, incorporated as a company. There is no legal entity behind it beyond the people who build it.

For data-protection purposes, we are the controller of the personal data described on this page. You can reach us at any time at the address at the bottom of this page.

2. The information we collect

We keep personal data to the minimum the product actually needs. In practice, four things:

• Account data — your email address, a hashed version of your password, your interface language, your plan (free or paid) and your sign-up date. Passwords are hashed by our authentication provider; we never see or store them in readable form.
• Learning data — for each question you answer: which question it was, which body region it belongs to, whether you got it right, the points awarded and the date. This is what produces your progress figures.
• Billing data — if you subscribe: your Stripe customer identifier, the status of your subscription, its renewal date, and whether it is set to cancel. Your card number never reaches our servers — payment details are entered on Stripe's own hosted checkout page.
• Technical data — the usual data a browser generates when visiting a website: IP address, browser and device type, pages viewed, approximate country and timestamps.

3. Why we use it, and on what legal basis

We do not sell your data, we do not use it for advertising, and we do not build any profile of you beyond your own learning progress.

• To create and run your account, show your progress and give you the content you signed up for — necessary to perform our contract with you.
• To take payment and manage renewals, cancellations and receipts — necessary to perform our contract with you, and to meet tax and accounting obligations.
• To send service emails (confirming your address, resetting your password, changing your email) — necessary to perform our contract with you.
• To keep the service secure, prevent abuse and fix bugs — our legitimate interest in a service that works and is not abused.
• To measure how the site is used, through analytics — your consent, where consent is required.

4. How long we keep it

• Account and learning data: for as long as your account exists. If you delete your account, or ask us to, we delete it — normally within 30 days, apart from backups, which roll off within 90 days.
• Inactive accounts: an account unused for 3 years may be deleted, after we warn you by email.
• Billing records: kept for as long as tax and accounting law requires, typically 7 to 10 years. That is a legal obligation and a deletion request cannot override it.
• Server logs and analytics: short-lived, generally no more than 14 months.

5. Who we share it with

We use a small number of suppliers to run the service. They process data only on our instructions, and only for the purpose listed.

• Our hosting and database providers — they store your account, your answers and the site itself, and deliver our service emails.
• Stripe — payments, subscriptions, invoices and the billing portal.
• Google Analytics — audience measurement.

6. Where your data is stored

Our database is hosted in the European Union. Some of the suppliers above are established in, or transfer data to, the United States. When that happens the transfer is covered by the European Commission's standard contractual clauses and, where applicable, the EU–US Data Privacy Framework — the mechanisms designed to give your data an equivalent level of protection.

Beyond these suppliers, we share nothing with anyone, except where the law obliges us to — for example a valid request from a public authority.

7. Cookies

We use analytics cookies (Google Analytics) to understand how the site is used. They are not essential: where consent is required you can refuse them, and refusing will never limit your access to the service.

You can delete or block cookies from your browser settings at any time.

8. Your rights

Under the GDPR and equivalent laws, you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything inaccurate or out of date;
• delete your account and the data attached to it;
• export your data in a portable format;
• restrict or object to a particular use;
• withdraw a consent you have given, at any time, without affecting what was done beforehand.

9. How we keep it safe

No system is perfectly secure, but we treat this as part of building the product rather than an afterthought.

• Everything travels over HTTPS/TLS.
• Passwords are hashed, never stored in readable form.
• The database enforces row-level security: a logged-in user can only ever read their own profile and their own answers, and cannot change their own plan.
• The keys that can bypass those rules exist only on the server, never in the browser.
• Card data is handled entirely by Stripe and never touches our servers.

10. Children

The service is aimed at medical students and doctors. It is not intended for anyone under 16 and we do not knowingly collect data from children. If you believe a child has created an account, tell us and we will delete it.

11. Changes to this policy

If we change how we handle your data, we will update this page and change the date at the top. If the change is significant, we will tell active users by email before it takes effect.

12. Complaints and contact

For any question about this policy, or any request concerning your data, write to us — we answer within one month, free of charge.

If you believe we have mishandled your data, you can also lodge a complaint with the data protection authority of the country you live in.