Privacy Policy

This version of the Service has a public reading sample, a waitlist, and an early-access purchase. Paid access uses a signed session cookie. There is no password. The public tutor demo is not open unless we turn it on.

You give us:

• Waitlist data: your email address, the exam you are preparing for, your medical school, the year you started, whether you are in China now, an optional exam month, your preferred language, an optional WhatsApp number, and your consent to receive launch emails. You are not on the list until you open the confirmation link. We also store the page source of that signup (campaign parameters and the referring site, without the query string).
• Purchase data: the email Creem returns after checkout, the plan (Basic or Pro), order id, amount, currency, and product id. We do not take the email from the browser's return link.
• Study data, if you have paid access: which questions you miss, whether you marked a mistake resolved, and saved mock scores. Pro explanations are sent to the AI provider. We store the score, not a transcript of the explanation.
• Tutor, only if a trial is open for you: the practice question you paste, and whether you asked for Simplified Chinese terminology. We send that text to our AI model provider to generate a reply. We do not store tutor conversations in our database in this version.
• Support: anything you email to hello@vaidova.com.

Collected automatically:

• Server logs that our host keeps while operating the site. Those logs can include IP address, browser type, the page requested and the time of the request.
• A first-party event log of the page path, the exam or plan named in the link, campaign parameters, and the referring site. We do not use a third-party analytics pixel, and we do not set an analytics cookie.

Creem is the merchant of record and processes payments. We do not receive or store full card details. Creem shares with us the email, product, order status, and the amount and currency needed to grant access. Creem shows its own privacy policy during checkout.

Please don't enter real patient information or other people's health data into the tutor or any form.

Your tutor messages are sent to the AI model provider configured for this deployment (DeepSeek by default) to generate a response. We do not use your conversations to train or fine-tune our own models. Where the provider offers a setting that keeps API data out of its own training, we use that setting.

We do not sell your personal data, and we do not use it for automated decisions with legal or similarly significant effects on you.

• Supabase, which stores waitlist signups and the first-party event log.
• Cloudflare Workers, which hosts the website.
• Resend, when email confirmation is configured, to send the confirmation and the unsubscribe link.
• Upstash, when rate limiting is configured, for short-lived counters. Those counters can include an IP address for the limit window. They do not include the question you paste.
• The configured AI model provider (DeepSeek by default) when you use an invited tutor trial.
• Creem, the merchant of record, for payments, tax, invoicing and refunds.
• Authorities where required by law, or to protect rights, safety and security.
• A successor if the business is sold or reorganised. We will tell you.

We do not use a third-party analytics pixel or an error-monitoring vendor in this version. Confirmation email uses Resend only when that service is configured. If we add another tool that receives personal data, we will update this page first.

We and our providers may process data in countries other than yours, including the countries where Cloudflare, Supabase, Resend, Upstash and the AI provider host the Service. Tutor requests to DeepSeek may be processed in mainland China. Where required, we use safeguards such as the European Commission's Standard Contractual Clauses and the UK Addendum.

If you do not want a practice question sent to the AI provider, do not use the tutor. If you are in mainland China, or if a tutor request is processed there, China's Personal Information Protection Law may also apply. Email hello@vaidova.com to exercise access or deletion rights.

• Waitlist records: until you unsubscribe or ask us to delete them. The unsubscribe link in a confirmation or launch email does this without a separate request. After we email you that your module has opened, we delete or anonymise the record within 24 months, unless a longer period is required by law.
• Tutor conversations: not stored in our database in this version. The AI provider may retain prompts under its own terms.
• Emails you send us: for as long as we need them to handle your request.
• Transaction records, once sales exist: as long as tax and accounting law requires. Creem keeps its own records as merchant of record.
• Server logs: according to the host's ordinary log retention.

Depending on where you live, you may have the right to access, correct, delete or port your data, to object to or restrict processing, to withdraw consent, and to complain to your data-protection authority. In India, under the DPDP Act, you may also nominate another person to exercise your rights.

Email hello@vaidova.com. We will respond within the time required by law, usually within one month. Paid access is a session cookie, not a password account. Email us to delete your study records.

We set one first-party session cookie after a verified purchase or a restore link. It is HttpOnly, SameSite=Lax, and lasts 30 days. It holds your user id, plan, and expiry, signed so we can check it. We do not set analytics or advertising cookies. Creem's checkout sets its own cookies for payment and fraud prevention.

We use HTTPS, access controls on the database, and server-side credentials kept in environment variables. No system is completely secure. If a breach affects you, we will notify you and the authorities as the law requires.

The Service is for university graduates and students aged 16 or over. We do not knowingly collect data from children under 16. If you think a child has given us data, contact us and we will delete it.

We may update this policy. For a material change we will post the new version here and, where we have your email and the change affects you, we will email you before it takes effect. The “Last updated” date shows the current version.

LI YINGJUN, Guangdong, China
Vaidova · hello@vaidova.com · vaidova.com

An EU or UK representative will be named here if one is required.