Privacy Policy

This policy explains what personal data MedSpirecollects, why, and what rights you have. It is written with Malaysia's Personal Data Protection Act 2010 (PDPA) in mind. By using the Service you consent to the handling of your data as described here.

1. Who we are

MedSpire operates getmedspire.com and is the party responsible for your personal data. Contact: aureatehather@gmail.com.

2. What we collect

• Account data — your email address and, if you sign in with Google, the basic profile Google shares (name, email). We do not receive your Google password.
• Study data — your quiz attempts, answers, confidence ratings, drill progress, and the resulting weak-spot analysis. This is the data that makes the Service work for you.
• Billing data — if you subscribe, our payment processor handles your card details. We never see or store your full card number. We keep a record that you have an active subscription.
• Technical data — basic logs (e.g. errors) needed to run and secure the Service.

3. Why we use it

• To provide the Service — sign you in, save progress, run reviews.
• To operate your subscription and process payment.
• To keep the Service secure and fix problems.
• To respond to you when you contact us.

We do not sell your personal data, and we do not use your study data for advertising.

4. Who we share it with

We share data only with the service providers that run the product on our behalf, and only as needed:

• Supabase — database, authentication, and storage.
• Vercel — application hosting.
• A payment processor — to take subscription payments (added when paid plans go live).
• An email provider — to send account emails such as sign-in confirmation and password resets.

These providers may process data outside Malaysia. We rely on them to protect it to an appropriate standard. We may also disclose data if required by law.

5. How long we keep it

We keep your data while your account is active. If you close your account, we delete or anonymise your personal data within a reasonable period, except where we must keep records (for example, basic billing records) to meet legal obligations.

6. Your rights

Under the PDPA you may, in respect of the data we hold about you:

• Ask for a copy of it.
• Ask us to correct anything inaccurate.
• Withdraw consent and ask us to delete your account and data.
• Limit how it is processed in certain cases.

To exercise any of these, email aureatehather@gmail.com. Closing your account also stops further processing for the Service.

7. Security

We use reputable providers and standard measures (encrypted connections, access controls, row-level security so you can only read your own data). No system is perfectly secure, but we take reasonable steps to protect your data.

8. Cookies

We use only the cookies needed to keep you signed in and to run the Service. We do not use advertising or third-party tracking cookies.

9. Children

The Service is intended for university-level students and is not directed at children under the age of digital consent in their country.

10. Changes

We may update this policy. If a change is material we will take reasonable steps to let you know.

11. Contact

Any privacy question or request: aureatehather@gmail.com.