Privacy Policy

AmbiusMed ("we", "us") provides a medical education platform (question bank and performance dashboard) for qualified medical professionals and students, accessible via the website at ambiusmed.in and the AmbiusMed Android app. This Policy explains what personal data we collect, why we collect it, and the choices you have. It should be read alongside our Terms & Conditions.

Account data, provided by you at registration:

• First and last name
• Email address
• Password (stored as a salted hash by our authentication provider — we never see or store it in plain text)
• Career stage / professional role (e.g. MBBS student, PG resident, consultant)

Learning activity data, generated as you use the Platform:

• Questions attempted, answers selected, and whether each attempt was correct
• Time taken per question
• Aggregated accuracy and streak statistics shown on your dashboard

Technical data, collected automatically:

• Standard server request logs (IP address, timestamp, request type) kept by our infrastructure provider for security and abuse prevention

We do not use third-party advertising or analytics trackers. We do not access your device contacts, location, camera, microphone, photos, or files, and the AmbiusMed Android app does not request any device permissions beyond internet access.

• To create and authenticate your account and keep it secure
• To operate the question bank and record your attempts so your dashboard, accuracy stats, and streaks work
• To communicate service-related information (e.g. email verification, password reset, significant Terms/Policy changes)
• To detect misuse, prevent abuse, and enforce our Terms & Conditions
• In aggregated, de-identified form, to improve question quality and platform features

We do not sell your personal data, and we do not use it for targeted advertising.

Account and learning-activity data is stored in a managed Postgres database (Supabase) with row-level security policies restricting each user to their own data. Data is encrypted in transit (TLS) between your device and our servers. On the Android app, your session is kept using the secure, sandboxed local storage provided by the operating system and is never shared with other apps.

We use Supabase (database, authentication, and hosting infrastructure) as a data processor to operate the Platform; they process data on our behalf under their own security and confidentiality obligations. We do not share your personal data with any other third party, and we do not sell it. We may disclose data if required to by law or to protect the rights, safety, or integrity of AmbiusMed and its users.

We retain your account and activity data for as long as your account is active, so that your dashboard and history remain available to you. If you request deletion (see below), we delete your account data within a reasonable period, except where retention is required to comply with a legal obligation or resolve a dispute.

You may request to access, correct, or delete your personal data at any time. To request account or data deletion, email support@ambiusmed.in from your registered email address with the subject "Delete my account". We will verify the request and permanently delete your account, profile information, and learning activity data within 30 days. This deletion request works the same way whether you use AmbiusMed on the web or via the Android app.

AmbiusMed is intended for qualified medical professionals and students and is not directed at, or intended for use by, children under 18. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. Material changes will be communicated to registered users by email. The "Last updated" date at the top of this page reflects the most recent revision.

For any questions about this Privacy Policy or how your data is handled, contact us at support@ambiusmed.in.