Privacy Policy

This Privacy Policy explains how Examrix ("Examrix", "we", "us", or "our") collects, uses, stores, and discloses personal information when you visit our website, create an account, subscribe to our services, use our question banks, practice examinations, AI viva practice tools, progress tracking tools, peer comparison features, or otherwise communicate with us.

For the purposes of this Privacy Policy, "you" and "your" means any user of Examrix, including website visitors, registered users, subscribers, trial users, institutional users, and any other person whose personal information we process.

Please read this Privacy Policy carefully.

For the purposes of applicable data protection law, including the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Data Protection Act 2018, Examrix is the data controller of the personal information described in this Privacy Policy, unless stated otherwise.

Examrix is operated by Examrix Ltd., a company registered in Ireland under company number [insert CRO number].

1. About Examrix

Examrix is an online medical education and exam preparation platform. Our services may include:

• medical exam question banks;
• practice mode and timed examination mode;
• detailed explanations and educational content;
• user dashboards and progress tracking;
• performance analytics;
• anonymised peer comparison;
• subscription management;
• account management;
• AI-assisted viva practice, including Viva RealTalk Exams;
• customer support and service communications.

Examrix is intended for medical students, doctors, trainees, healthcare professionals, and other adult users preparing for medical examinations. Examrix is not intended to provide clinical advice, diagnosis, treatment recommendations, or patient-specific medical guidance.

2. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our services, technologies, legal obligations, third-party providers, or business operations.

When we update this Privacy Policy, we will post the revised version on our website and update the "Last updated" date above. Where required by law, we may also notify you by email, in-app notice, or another appropriate method.

3. Personal Information We Collect

The personal information we collect depends on how you interact with Examrix.

3.1 Information You Provide Directly

Account information

• name;
• email address;
• username or account identifier;
• password or authentication information;
• account preferences;
• exam interests, selected exams, or chosen question-bank products;
• country or region, where provided;
• professional role or training level, where provided voluntarily.

Subscription and billing information

• subscription plan;
• purchase history;
• billing address;
• payment status;
• invoice information;
• tax or VAT-related information, where applicable.

Payment card details are processed by our payment and subscription provider, Stripe, and are not stored directly by Examrix, except where limited payment information is provided to us for record-keeping, fraud prevention, accounting, subscription management, refund, or chargeback purposes.

Educational and performance information

• questions attempted;
• answers selected;
• correct and incorrect responses;
• time spent on questions or examinations;
• scores and percentages;
• exam mode usage;
• revision history;
• flagged, bookmarked, or saved questions;
• progress through topics, subtopics, and question banks;
• performance trends over time;
• comparative percentile or ranking data where peer comparison features are available.

AI viva practice and user-generated content

Examrix may use third-party artificial intelligence providers, including OpenAI, to power features such as Viva RealTalk Exams, AI viva practice, simulated oral examinations, automated questioning, answer analysis, feedback generation, and related educational tools.

When you use Viva RealTalk Exams or similar AI-powered features, the information you enter may be processed by OpenAI or another AI service provider in order to generate responses, feedback, follow-up questions, explanations, or performance analysis. This may include:

• prompts or questions you submit;
• answers you provide during simulated viva practice;
• free-text responses;
• educational context selected within the platform;
• AI-generated feedback and scoring outputs;
• technical information required to operate, secure, and monitor the feature.

You should not submit patient-identifiable information, confidential clinical information, special category personal data, or unnecessary personal information when using Viva RealTalk Exams or any AI-powered feature.

Examrix uses AI-powered tools for educational and examination preparation purposes only. AI-generated feedback may be incomplete, inaccurate, or unsuitable for clinical decision-making. You should not rely on AI-generated content as medical advice, clinical guidance, or a substitute for professional judgement.

Where AI service providers process personal information for Examrix, we will use appropriate contractual and technical safeguards. We do not intend to use Viva RealTalk Exam submissions to train Examrix-specific public models or to create publicly accessible user profiles.

Customer support and communications

• email correspondence;
• support requests;
• feedback;
• complaints;
• survey responses;
• information needed to investigate technical issues or account problems.

3.2 Information We Collect Automatically

• IP address;
• device type;
• browser type and version;
• operating system;
• referring URLs;
• pages viewed;
• features used;
• session times;
• log-in and log-out times;
• crash logs;
• diagnostic data;
• approximate location derived from IP address;
• cookie identifiers and similar tracking information;
• interactions with emails or service communications.

We use this information to operate, secure, analyse, personalise, and improve Examrix.

3.3 Information We Receive from Third Parties

• Stripe, for payment, subscription, tax/VAT, renewal, cancellation, refund, fraud prevention, and transaction information;
• Lovable, where used to provide authentication, database, storage, and backend infrastructure services;
• OpenAI or other AI service providers, where used to provide AI viva practice, Viva RealTalk Exams, automated feedback, or similar features;
• analytics providers;
• hosting and infrastructure providers;
• customer support tools;
• email delivery providers;
• institutional customers, where your access is provided through an organisation;
• marketing platforms, where permitted by law.

For example, if you purchase a subscription, Stripe may provide us with confirmation of payment, subscription status, billing details, tax/VAT information, renewal status, cancellation status, and limited payment information. If you access Examrix through an institution, we may receive information needed to create, verify, or manage your account.

4. How We Use Your Personal Information

4.1 To Provide and Manage the Services

• create and manage your account;
• provide access to question banks and revision tools;
• process subscriptions and payments;
• manage trials, renewals, cancellations, and account status;
• provide practice mode, timed examination mode, and other learning features;
• record your answers, scores, progress, and revision history;
• provide personalised dashboards and analytics;
• provide AI viva practice, Viva RealTalk Exams, or other interactive educational tools;
• deliver technical support;
• send service-related notifications;
• maintain the security and availability of Examrix.

Legal basis: performance of a contract with you; legitimate interests in operating and improving Examrix; compliance with legal obligations where applicable.

4.2 To Track Progress and Provide Educational Analytics

• score tracking;
• topic and subtopic performance analysis;
• progress dashboards;
• revision recommendations;
• question history;
• timed examination results;
• strengths and weaknesses analysis;
• longitudinal performance trends.

Legal basis: performance of a contract with you; legitimate interests in providing useful educational functionality and improving learning outcomes.

4.3 To Provide Anonymised Peer Comparison

Examrix may provide anonymised peer comparison features, such as average scores, percentile bands, question performance statistics, or comparison against other users preparing for the same examination. Where we provide peer comparison, we aim to use aggregated or anonymised data so that individual users are not directly identifiable to other users.

Legal basis: legitimate interests in providing educational benchmarking and improving the Examrix service.

4.4 To Improve Examrix

• improve question quality;
• identify difficult or poorly performing questions;
• monitor platform performance;
• fix bugs;
• improve user experience;
• develop new features;
• evaluate engagement and retention;
• improve educational explanations and revision tools;
• analyse demand for exams, topics, or question banks.

Where possible, we use aggregated, pseudonymised, or anonymised data for service improvement.

Legal basis: legitimate interests in improving and developing Examrix.

4.5 To Communicate with You

• account notifications;
• subscription confirmations;
• payment or renewal reminders;
• password reset emails;
• important service updates;
• security notices;
• customer support replies;
• policy update notices;
• administrative communications.

Legal basis: performance of a contract; legitimate interests in managing customer relationships; compliance with legal obligations where applicable.

4.6 Marketing and Promotional Communications

Where permitted by law, we may use your contact details to send you information about Examrix products, services, updates, offers, educational resources, or related content. You may opt out of marketing emails at any time by using the unsubscribe link in our emails or by contacting us. Even if you opt out of marketing, we may still send you non-marketing communications, such as account, payment, security, or service-related messages.

Legal basis: consent where required; legitimate interests in promoting Examrix to existing or prospective users, where permitted by law.

4.7 Security, Fraud Prevention, and Misuse Detection

• protect Examrix from misuse, fraud, scraping, unauthorised access, or abuse;
• detect suspicious account activity;
• enforce usage limits;
• prevent unauthorised sharing of accounts;
• protect intellectual property;
• investigate breaches of our Terms of Service;
• maintain platform integrity and security.

Legal basis: legitimate interests in protecting Examrix, our users, and our business; compliance with legal obligations where applicable.

4.8 Legal, Regulatory, and Accounting Purposes

• comply with tax, accounting, and company law obligations;
• maintain business records;
• respond to lawful requests from authorities;
• establish, exercise, or defend legal claims;
• comply with applicable regulatory obligations;
• enforce our Terms of Service and other policies.

Legal basis: compliance with legal obligations; legitimate interests in protecting our legal and commercial position.

4.9 Summary of Legal Bases

5. Cookies and Similar Technologies

Examrix may use cookies, pixels, local storage, software development kits, and similar technologies to operate and improve the platform. These technologies may include:

• Strictly necessary cookies, which are required for core functions such as login, authentication, security, subscription access, and account management;
• Preference cookies, which help remember settings and choices;
• Analytics cookies, which help us understand how users interact with Examrix and improve the platform;
• Marketing cookies, which may support promotional activity, attribution, or advertising where applicable and where permitted by law.

You can control cookies through your browser settings. Blocking or deleting cookies may affect the functionality of Examrix and may prevent some features from working correctly.

Where required by law, we will request your consent before placing non-essential cookies on your device. Non-essential cookies will only be used where we have obtained consent, where required by applicable law.

6. How We Share Personal Information

6.1 Service Providers and Processors

• website hosting providers;
• database and backend infrastructure providers, including Lovable where applicable;
• authentication providers;
• our Merchant of Record, Stripe, which acts as the reseller for all our orders and as a recipient of personal data for payments, subscription management, tax compliance, invoicing, and customer service;
• analytics providers;
• AI service providers, including OpenAI;
• email delivery providers;
• customer support platforms;
• error monitoring and logging tools;
• cloud storage providers;
• professional advisers.

These providers are authorised to process personal information only as necessary to provide services to us, under written data processing agreements, and are bound by confidentiality and security obligations.

A current list of our subprocessors, including what each provider does, where it processes data, and the transfer safeguard we rely on, is published on our Subprocessors page.

Examrix may use Lovable to provide database, authentication, storage, and backend infrastructure services. Personal information such as account details, authentication data, usage data, educational progress data, and related technical information may be stored or processed using Lovable infrastructure.

6.2 Payment and Subscription Processing

Our order process is conducted by our online reseller Stripe. Stripe is the Merchant of Record for all our orders and is a recipient of your personal data for payment, subscription, tax, invoicing, and customer service purposes.

When you purchase an Examrix subscription or paid product, Stripe may collect and process information necessary to complete the transaction, including your name, email address, billing address, payment method details, tax/VAT information, transaction details, subscription status, renewal information, and refund or cancellation information.

Stripe processes payments, manages applicable sales tax/VAT, handles invoices and receipts, and may assist with fraud prevention, chargebacks, refunds, and subscription administration.

Examrix does not directly store your full credit or debit card details. Payment information is processed by Stripe in accordance with Stripe's own privacy policy and terms.

We receive limited information from Stripe, such as confirmation of payment, subscription status, invoice details, billing information, transaction identifiers, renewal status, refund status, chargeback status, and cancellation status, so that we can manage your Examrix account and provide access to paid services.

6.3 Analytics and Product Improvement Providers

We may share limited technical, usage, and interaction data with analytics providers to understand how users engage with Examrix and to improve the platform. Where possible, we configure analytics tools to minimise the personal information collected.

6.4 AI Viva Practice and Viva RealTalk Exams

We may share relevant user inputs, outputs, and technical data with AI service providers, including OpenAI, where necessary to provide Viva RealTalk Exams, AI viva practice, automated feedback, or similar educational features.

These providers may process your information to generate simulated viva questions, responses, feedback, explanations, or performance analysis.

We do not intend Viva RealTalk Exams to be used for patient care, clinical decision-making, diagnosis, treatment, or the processing of patient-identifiable information.

6.5 Institutional Access

If your access to Examrix is provided through an institution, employer, training body, university, hospital, or other organisation, we may share limited information with that organisation where necessary to administer access, verify eligibility, manage licences, or provide agreed reporting.

Where institutional reporting is provided, we will seek to limit the information shared to what is necessary and appropriate. Depending on the arrangement, this may include account status, activation status, usage information, or aggregated performance information.

Unless expressly agreed and clearly notified to you, we do not provide institutions with your individual question-level answers or detailed personal performance history.

6.6 Business Transfers

If Examrix is involved in a merger, acquisition, investment, restructuring, sale of assets, financing, insolvency, or similar transaction, personal information may be transferred as part of that transaction, subject to appropriate safeguards.

6.7 Legal and Compliance Disclosures

• comply with applicable law;
• respond to lawful requests from courts, regulators, law enforcement, or public authorities;
• enforce our Terms of Service;
• protect our rights, property, users, or business;
• investigate suspected fraud, misuse, or security incidents;
• establish, exercise, or defend legal claims.

7. Categories of Personal Information and Recipients

We do not use or disclose sensitive personal information for the purpose of inferring characteristics about you.

8. Special Category Data and Patient Information

Examrix is not designed to collect or process patient-identifiable information, clinical records, or special category personal data. You must not upload, enter, or disclose patient-identifiable information, confidential clinical information, or unnecessary special category personal data when using Examrix, including AI-powered features such as Viva RealTalk Exams.

If you accidentally submit such information, you should contact us so that we can assess and, where appropriate, delete or restrict the information in accordance with applicable law and our technical capabilities.

9. Anonymised and Aggregated Data

We may create anonymised or aggregated data from personal information, including question performance statistics, usage trends, average scores, topic-level performance, and peer comparison metrics.

Once data has been properly anonymised so that it can no longer reasonably identify you, it may no longer be considered personal information under applicable data protection law. We may use anonymised or aggregated data for educational analytics, research, business intelligence, product development, marketing insights, and service improvement.

10. Third-Party Websites and Links

Examrix may contain links to third-party websites, resources, tools, or services. We are not responsible for the privacy practices, content, or security of third-party websites or services that we do not control.

You should review the privacy policies and terms of any third-party websites or services you access.

11. Children's Data

Examrix is not intended for children. Our services are intended for adult users, including medical students, doctors, healthcare professionals, and examination candidates.

We do not knowingly collect personal information from children. If you believe that a child has provided us with personal information, please contact us and we will take appropriate steps to delete the information where required.

12. Data Security

We use technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration, or disclosure.

These measures may include access controls, encryption, authentication safeguards, secure hosting, monitoring, logging, and restricted access to personal information.

However, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security.

You are responsible for keeping your account credentials secure. You should not share your password or account access with anyone else. If you believe your account has been compromised, please contact us immediately.

13. Data Retention

We retain personal information for as long as necessary for the purposes described in this Privacy Policy, including to provide Examrix, maintain your account, comply with legal obligations, resolve disputes, enforce agreements, and protect our legitimate interests.

Unless a longer period is required by law or is necessary to establish, exercise, or defend legal claims, we apply the following retention periods:

You may request deletion of your personal information at any time, and you can delete your account yourself from Profile → Account & Security. Deletion requests are honoured except where we are legally required to keep certain records, such as billing and tax records.

14. International Transfers

We may transfer, store, or process personal information outside your country of residence, including outside the European Economic Area ("EEA") or the United Kingdom, where our service providers, infrastructure providers, or business partners are located.

Where we transfer personal information outside the EEA or UK, we rely on an adequacy decision where one exists, or otherwise on the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, supported by technical measures including encryption in transit and at rest, access controls, and data minimisation.

The providers we use, the countries in which they process data, and the safeguard relied upon for each are listed on our Subprocessors page. You may request a copy of the relevant transfer safeguards by emailing privacy@examrix.com.

15. Your Rights

Depending on where you live and subject to applicable law, you may have some or all of the following rights in relation to your personal information:

Right of access: You may request confirmation of whether we process your personal information and request a copy of the personal information we hold about you.

Right to rectification: You may request that inaccurate or incomplete personal information be corrected or updated.

Right to erasure: You may request that we delete your personal information in certain circumstances.

Right to restriction of processing: You may request that we restrict the processing of your personal information in certain circumstances.

Right to data portability: You may request to receive certain personal information in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.

Right to object: You may object to certain processing based on our legitimate interests, including profiling based on legitimate interests, where applicable.

Right to withdraw consent: Where we rely on consent to process your personal information, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before it was withdrawn.

Right to object to direct marketing: You may opt out of direct marketing communications at any time.

Right to complain: You have the right to lodge a complaint with your local data protection authority. If you are based in Ireland, the relevant supervisory authority is the Data Protection Commission.

To exercise your rights, please contact us using the details in the "Contact Us" section below.

We may need to verify your identity before responding to your request. We will respond to requests within the time required by applicable law.

16. Marketing Preferences

You can opt out of receiving marketing emails by using the unsubscribe link in our emails or by contacting us.

If you opt out of marketing, we may still send you service-related messages, including account, security, billing, subscription, and policy-related communications.

17. Automated Decision-Making and Profiling

Examrix may use automated analysis to provide educational features such as progress tracking, score analysis, personalised dashboards, topic recommendations, and peer comparison.

These features are designed to support learning and revision. They are not intended to produce legal, employment, clinical, or similarly significant decisions about you.

We do not intend to use automated decision-making that produces legal or similarly significant effects concerning you without appropriate safeguards and a lawful basis.

18. Medical and Educational Disclaimer

Examrix is an educational platform. Content on Examrix, including question explanations, AI-generated feedback, and revision materials, is provided for exam preparation and educational purposes only.

Examrix does not provide medical advice, clinical decision support, diagnosis, treatment recommendations, or patient-specific guidance.

You should not upload patient-identifiable information or confidential clinical information to Examrix.

19. Contact Us

If you have questions about this Privacy Policy, our privacy practices, or your data protection rights, you can contact us at:

Examrix @ Examrix Ltd.
Email: support@examrix.com
Privacy contact: privacy@examrix.com

For the purposes of applicable data protection law, Examrix is the controller of your personal information unless stated otherwise.

Examrix has not appointed a Data Protection Officer at this time, as we do not currently consider that our processing activities require the appointment of a Data Protection Officer under applicable data protection law. Privacy-related queries may be directed to us using the contact details above. This position should be reviewed if Examrix's processing activities, scale, or legal obligations change.

20. Supervisory Authority

If you are located in Ireland, you may contact the Irish Data Protection Commission.

If you are located elsewhere in the EEA, UK, or another jurisdiction, you may have the right to contact your local data protection authority.