In short
- We collect what we need to run your account and show your progress. Nothing more.
- Today your account and study data live in your own browser. They are not on a Meddex server. If you clear your browser data, they are gone.
- We do not sell your data. We do not show ads. We do not want patient information.
- You can download your data, delete your account and manage cookies yourself in Settings, under Privacy and data.
This summary helps you read the document. The full text below is what applies.
Who we are
This policy covers the Meddex website and app. Meddex, Dubai, United Arab Emirates runs it ("Meddex", "we", "us").
Privacy questions go to our data protection contact: privacy@meddex.cc.
Meddex is for adults (18+) preparing for professional exams such as the DHA licensing exam and the EMREE residency exam. It is not a healthcare service and it is not for patients.
What we collect
We collect data only when you use the part of the service that needs it.
| What | Examples | Where it comes from |
|---|---|---|
| Account | Name, email address, a hashed password (we never keep your password in readable form), whether your email is verified, when you joined | You, when you sign up |
| Profile | Profession, specialty, country of qualification, exam date, exam track, plan and billing period | You, in onboarding and Settings |
| Study data | Your answers and timings, flags, bookmarks, notes, quiz sessions, mock exam attempts and scores, flashcard schedule, study plan, daily goal, achievements | How you use the service |
| Your agreements | Which version of the Terms and Privacy Policy you accepted and when, whether you opted in to marketing emails, your cookie choice | You, when you agree or choose |
| Messages and sign-ups | What you type in the contact form, and your email address if you subscribe to updates | You, when you send a form |
| Agency trial requests | Business contact details from the agency trial form: organisation name and type, your name, work email, country, approximate number of candidates, exams and any notes you add | You, when you send the form |
| Technical data | IP address, browser and device type, pages requested, date and time, kept in server logs by our hosting provider | Your browser, automatically |
| Payments | Once paid plans open: your plan, period, amount, payment status and a payment reference. You enter card details with the payment provider. We do not hold them | You and the payment provider |
What we do not collect
- Patient information. Please keep it out of your notes and messages. If it gets in by mistake, tell us and we will delete it.
- Official exam results, unless you type them into a note or message yourself.
- Emirates ID, passport, licence or registration numbers. We do not ask for them.
- Advertising or cross-site tracking data. We use no advertising cookies.
Meddex holds data about your studying, not health records about patients. So we do not expect the UAE rules on health data (such as Federal Law No. 2 of 2019 on ICT in health fields) to apply to it.
Why we use your data
The UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) covers people in the UAE. It rests mainly on consent, with exceptions such as data needed to carry out a contract with you or to meet a legal duty. If you are in the UK or EEA, GDPR or UK GDPR may also apply. It uses the legal bases below.
| What we do | Our legal basis |
|---|---|
| Create and secure your account, sign you in, verify your email | We need it to provide the service you asked for (contract) |
| Save your progress and show your analytics, readiness indicator and study plan | Contract |
| Answer your messages and give support | Contract and our legitimate interest in running support |
| Take payment, send receipts, handle refunds, keep accounts | Contract and legal obligation |
| Send service emails (verification codes, password resets, important changes) | Contract and our legitimate interest in keeping the service secure |
| Send marketing emails and exam updates | Your consent. You can withdraw it at any time |
| Remember optional preferences on your device | Your consent (the Preferences switch in the cookie banner) |
| Keep the service secure, stop abuse, fix faults | Our legitimate interest in a safe and reliable service |
| Record which Terms and Privacy Policy you accepted | Legal obligation and our legitimate interest in showing what you agreed to |
Where your data is kept
Today Meddex keeps your account, study data and settings in your browser's local storage, on the device you use. We do not upload them to a Meddex server. That means we cannot see them and cannot recover them for you. They also do not follow you to another browser or device. Clearing site data, using a private window or deleting your account in Settings removes them.
What you choose to send us, such as a contact message or a newsletter sign-up, goes to us over an encrypted connection through a form service.
Our hosting provider serves the website and keeps standard server logs (see Technical data above).
When Meddex adds server-side accounts, we will update this policy first. We will say what moves to our servers, who holds it and in which countries.
Transfers outside your country
Meddex is based in the UAE, but learners come from many countries and our providers may process data outside the UAE. When personal data leaves the UAE (or the UK or EEA, for people there), we use the safeguards the law allows. Examples are transfers to countries with adequate protection, standard contractual clauses, or your consent.
To find out where your data is processed, write to privacy@meddex.cc.
How long we keep data
- Account and study data on your device: until you delete your account, reset your progress or clear your browser data.
- Contact messages and agency trial requests: as long as we need to deal with them, and a short time after in case you write again. We aim to delete them within 24 months.
- Marketing email address: until you unsubscribe. We then keep a minimal record so we do not email you again.
- Payment and accounting records: as long as UAE tax and commercial law require.
- Server logs: a short time, set by our hosting provider.
- Verification codes and reset tokens: 30 minutes.
Security
We never store your password in readable form. It is hashed with a salted, standard, slow algorithm (PBKDF2 with SHA-256). The website uses HTTPS, and it sends security headers that limit which scripts can run.
Your data is saved in your browser, so anyone who can use your device and browser profile may be able to see it. Log out on shared computers, use a strong and unique password, and keep your device up to date. Before we hold learner data on our own servers, we will move sign-in and storage to server-side protection.
No system is perfectly secure, and we do not hold security certifications. If a personal data breach is likely to harm you, we will tell you, and the regulator where the law requires it, without undue delay. To report a concern, write to privacy@meddex.cc.
Your rights
Under the UAE PDPL you have rights, in the cases the law sets out, to be informed about how we use your data, to see it, to get a portable copy, to have it corrected or erased, to restrict or object to its use, and to withdraw consent. If GDPR or UK GDPR applies to you, you can also object to processing based on legitimate interests and complain to your local data protection authority.
Some things you can do yourself, right now:
- Download my data: Settings, Privacy and data. You get a JSON file with your profile, progress and history.
- Delete my account and data: Settings, Privacy and data. It removes your account and study data from this browser. You cannot undo it.
- Marketing emails: switch them off in Settings, or use the unsubscribe link in any email.
- Cookies and storage: use Cookie settings in the footer, or Settings.
For anything else, such as data we hold from a message you sent us, email privacy@meddex.cc. We may ask you to confirm who you are. We aim to reply within 30 days. If we cannot do what you ask, we will tell you why. For example, we may have to keep a record by law.
Marketing emails
We send marketing emails only if you tick the optional box when you sign up or subscribe to updates. The box starts unticked and you never need it to use the service. You can withdraw consent as easily as you gave it, with the link in any email or the switch in Settings. Service emails, such as verification codes, are not marketing.
Children
Meddex is for adults aged 18 and over. We do not knowingly collect data from anyone younger. If you think a child has an account, tell us at privacy@meddex.cc and we will delete it.
Automated calculations
Your readiness indicator, analytics and study plan are calculated from your own practice data to help you study. We do not use them to make decisions about you with legal or similar effects. They are not a prediction of an exam result. See the Medical and Educational Disclaimer.
Changes to this policy
If our practices change, we will update this page and its version and date. For a material change, signed-in users are asked to read and accept the new version. If our cookie practices change, the banner asks again.
Contact and complaints
Privacy: our data protection contact, Meddex, Dubai, United Arab Emirates, privacy@meddex.cc. Support: support@meddex.cc.
If we got something wrong, please tell us first so we can fix it. You can also complain to the UAE Data Office or, if you are in the UK or EEA, to your local data protection authority.