The short version: you can practise without an account. If you create one, we keep your email address, your name if you sign in with Google, and your study progress. We never ask for your phone number, date of birth or ID. We do not sell your data, show ads or use tracking tools.
This notice explains what we collect and why, and your rights under India’s Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.
1. Who is responsible for your data
MedExams (medexams.in) is run by the founder of MedExams (name and address to be added before launch). For the personal data described here, we are the “Data Fiduciary” under the DPDP Act: we decide why and how it is used. You can contact us about privacy at the contact email that will be published on our Contact page before launch.
2. What we collect
If you use MedExams without an account, we do not ask who you are. Our servers handle the technical information every website receives, such as your IP address and browser type, to deliver pages and keep the site secure. We also count how many times each page is viewed each day, without cookies or anything that identifies you. Your browser may also remember where you stopped in a set (see section 5).
If you create an account, we collect:
- your email address, which you use to sign in;
- your name, if you choose “Continue with Google” (Google shares it with us);
- your study activity: the sets you start, your answers and results, time spent on questions, the questions you save, and your settings;
- anything you send us, such as a mistake report or a message.
Reviewers and authors who work on questions also have their role and a record of their edits kept, so every change to a question can be traced.
3. What we never ask for or do
- We never ask for your phone number, date of birth, address, Aadhaar or other ID, or payment details.
- We do not collect health information about you.
- We do not sell or rent personal data, and we do not show advertising.
- We do not use third-party analytics, advertising or tracking tools.
4. Why we use it
We use your data only to:
- sign you in and keep your account secure;
- save your progress, show your results and let you pick up where you stopped;
- look into the mistakes you report and improve our questions;
- send emails you need, such as sign-in codes (we send marketing emails only if you ask for them);
- protect the site from misuse, and meet our legal obligations.
We rely on the consent you give when you create an account, and on the limited “legitimate uses” the DPDP Act allows, such as complying with the law. You can withdraw your consent at any time by deleting your account (section 9).
6. Who processes data for us
We use a small number of service providers (“Data Processors”), only to run MedExams:
- Supabase, for our database and sign-in, with our data stored in its Mumbai (India) region;
- Google, only if you choose “Continue with Google”;
- an email delivery service, to send sign-in codes and links;
- our website hosting provider, which serves the pages.
They may only use your data to provide their service to us. Some of them may process limited data outside India, as the DPDP Act permits. We will share data with authorities only when the law requires it.
7. How long we keep data
- Account and study data: while your account is open.
- When you delete your account, your account and study data are deleted from our live systems straight away, and from backups within 30 days.
- Mistake reports may be kept after that to keep the question history accurate, but without anything that identifies you.
- Security and sign-in logs are kept for at least one year where the law requires it, and then deleted.
8. How we protect it
Data is encrypted in transit, access is limited to people who need it, and database rules stop accounts from reading each other’s data. If a personal data breach ever affects you, we will tell you and the Data Protection Board of India, as the law requires.
9. Your rights
Under the DPDP Act, you can:
- ask for a summary of the personal data we hold about you and how we use it;
- ask us to correct, complete or update it;
- ask us to erase it, or delete your account yourself in Settings, which also withdraws your consent;
- raise a grievance with us, and get an answer;
- nominate another person to act for you if you die or become unable to act.
To use any of these rights, write to us at the contact email that will be published on our Contact page before launch. We may need to confirm it is you. We aim to reply within 30 days, and always within the time the DPDP Rules allow. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
10. Children
Accounts are for people aged 18 and over. If you are under 18, you can use MedExams without signing in, and we will not know who you are. If we learn that an account belongs to someone under 18, we will delete it.
11. Changes to this notice
We may update this notice. When we make an important change, we will show a notice on the site, and ask for your consent again where the law requires it. The date at the top says when it last changed.
12. Contact and grievances
For privacy questions, requests and grievances, write to us at the contact email that will be published on our Contact page before launch. Our grievance contact is the founder of MedExams (name and address to be added before launch).