Privacy Policy

Who controls your data

Your institution is the controller of your account and exam data. MedForge processes that data on the institution's behalf. If you want your data accessed, corrected, or deleted, contact your institution, or email us at [email protected] and we will assist.

What we collect

• Account information: your username, name, email (if provided), and role, as set up by your institution.
• Exam activity: your answers, submissions, scores, feedback, and (for guest exam links) the name and ID number you enter to register.
• Exam-integrity signals: during a test, the app records whether you take screenshots or leave the app, so examiners can uphold exam conditions.
• Technical data: standard server logs (such as request times) needed to operate and secure the service.

What we do not do

• We do not sell your data.
• We do not use third-party advertising or tracking SDKs.
• We do not track you across other apps or websites.

On-device data

The mobile app stores your sign-in tokens securely in the device Keychain (bound to your device) and, if you enable it, can lock the app with Face ID or your passcode. Face ID is used only to unlock the app and is never transmitted. Exam content is not cached to disk.

Data storage & security

Data is stored on the institution's MedForge server. Sensitive fields such as API keys are encrypted at rest, passwords are hashed, and all traffic between the app and server uses HTTPS.

Retention

Account and exam data are retained for as long as your institution requires them for assessment and record-keeping, then deleted or anonymized in line with the institution's policy.

Children

MedForge is intended for use by candidates and staff of the institutions that license it and is not directed at children under 13.

Contact

Questions about this policy? Email [email protected].