Privacy Policy

This Privacy Policy (“Policy”) applies to the SurgiTest websites, web applications, mobile applications, educational services, communications, and related features that link to it (collectively, the “Service”). SurgiTest LLC (“SurgiTest,” “we,” “us,” or “our”) is responsible for the personal data described here except where an institutional agreement makes an organization responsible for a specific processing activity.

This Policy does not govern an external website, publication, payment page, device service, or other third party that has its own privacy notice, although it explains when we use providers to operate SurgiTest.

SurgiTest is an adult professional-education and board-preparation service. It is not a healthcare provider, clinical record system, or patient-care platform. Do not submit protected health information (“PHI”), patient names, dates of birth, medical record numbers, identifiable patient images, or other information that could reasonably identify a real patient.

Unless SurgiTest has expressly signed a written business associate agreement that applies to a specific institutional workflow, the Service is not intended to receive or process PHI. Automated screening may help identify prohibited content but does not replace your responsibility to de-identify material before upload.

We use personal data to provide and secure the Service, personalize education, process authorized payments, support users, comply with law, and improve SurgiTest. We seek to collect the minimum data reasonably needed for those purposes, restrict internal access, and avoid placing private learning content in general analytics.

We collect information you provide when creating or managing an account, such as name, email address, authentication credentials or tokens, professional role, specialty, training status, location or time zone, notification preferences, and account settings. Firebase Authentication or another disclosed authentication provider may process credentials and login tokens on our behalf.

We may also maintain entitlement and eligibility data, including Readiness Pass activation, included-activity consumption, package type, specialty access, legacy access balances, feature flags, institutional seat status, and Board Group eligibility.

When you use SurgiTest, we may collect prompts presented to you, typed or transcribed answers, examiner turns, session and attempt identifiers, timing, completion status, scores, grading outputs, feedback, corrections, critical-error classifications, readiness snapshots, strengths, improvement areas, study history, content interactions, and related metadata.

Longitudinal features may combine current and prior learning records to show trends, recommend targeted practice, identify underrepresented domains, revisit earlier errors, and generate personalized educational plans.

If you use a voice-enabled feature, the Service processes candidate audio to produce a transcript through SurgiTest's MedASR pipeline and, where the existing fallback or corroboration policy applies, device speech-recognition services. The Service may record server-authorized transcript text, word or segment uncertainty, timestamps, correction status, and processing metadata needed to run and grade the session.

Raw candidate audio is not retained as part of the ordinary learning record and is not placed in general analytics. Depending on the workflow, it may be transient or retained temporarily to complete an interrupted upload, preserve a retryable attempt, finish grading, support an authorized review, investigate a security incident, or meet a legal obligation, and is then deleted under the applicable lifecycle.

We do not use candidate voice to identify you, create a voiceprint, infer identity, or perform biometric authentication.

For supported specialties and packages, you may submit de-identified case logs, notes, documents, images, spreadsheets, PDFs, or other educational materials. We collect the uploaded file, processing status, specialty and case metadata, de-identification or safety-screening results, and private derived artifacts such as structured cases, likely examiner targets, question plans, preparation checklists, case-mix classifications, complication or documentation signals, related learning, and portfolio insights.

Personal-case content is owner-scoped and is not placed in general analytics. You must have the right to upload the material and must remove patient identifiers and other prohibited information before submission.

We create educational inferences from your activity, such as simulated specialty and SurgiTest scores, readiness estimates, performance trends, strengths, improvement areas, critical-error categories, communication or prioritization patterns, case-mix coverage, documentation gaps, related-learning suggestions, and recommended next steps.

These inferences are for learning and product functionality. They are not official exam results, medical determinations, licensure decisions, employment decisions, credentialing decisions, or decisions that produce legal or similarly significant effects.

If you create, join, or interact with a Board Group, we collect the group name, owner, membership and invitation status, formation window, weekly commitments, completion status, candidate-safe verified activity summaries, encouragements, privacy and notification preferences, sharing actions, and Group Rate eligibility, payment, credit, refund, or award status.

For organization-sponsored accounts, we may receive or collect organization name, department or program, roster and seat data, affiliation, role, invitation and activation status, assignments, completion data, cohort membership, aggregate or individual readiness information, faculty-review permissions, administrative actions, audit history, and support or procurement records.

The precise data visible to an organization depends on its configuration and agreement. We describe that visibility in the invitation, in-product notice, institutional documentation, or other applicable terms.

When you purchase a package, Stripe or another disclosed payment processor receives payment-card and billing information directly. SurgiTest receives transaction identifiers, package, price, tax, billing period, payment status, limited payment-method details such as brand and last four digits, renewal date, cancellation status, refunds, disputes, and fraud or risk signals. We do not store your full payment-card number.

We collect messages and information you send to support, Help & Feedback, legal, billing, or other SurgiTest channels. Depending on the category, a submission may include a product suggestion, technical issue, clinical-content concern, score-review request, transcript-correction request, audio-review request, general feedback, optional screenshot, and permission to contact you.

To route and investigate a submission, the Service may attach your user identifier, specialty, current route, case or content version, session, attempt, turn or artifact identifier, app and device version, feature flags, non-sensitive error identifiers, and timestamp. We do not automatically attach full transcripts, candidate audio, personal-case uploads, or other sensitive artifacts. We request explicit permission before reviewing those materials when needed.

Morning Brief Delivery is currently available in app. If optional email, push, Smart delivery, cadence, reminder, or local-time controls are offered and you enable them, we may collect the selected channel, preferred address or device, delivery time, cadence, pause and reminder preferences, delivery, bounce, and unsubscribe events, and whether the brief was opened or completed where those measurements are enabled and lawful.

Email delivery is off by default. If offered and enabled, a Morning Brief email may include a retrieval question, high-yield points, an oral-board prompt, a deep link, and a high-level progress cue. It is designed to exclude personal-case titles or narratives, uploaded case information, transcripts, candidate audio, detailed scores, patient-like information, and sensitive billing data.

We automatically collect technical information such as IP address, approximate location derived from IP, browser and device type, operating system, app version, language, time zone, referral URL, network and request metadata, page and feature interactions, timestamps, crashes, latency, diagnostic events, authentication and security events, and identifiers used to prevent fraud or maintain sessions.

General analytics are designed not to include PHI, raw candidate audio, full private transcripts, or personal case content. We may use pseudonymous identifiers and aggregate metrics to understand adoption, reliability, and performance.

Our websites and web applications use cookies, local storage, SDKs, pixels, and similar technologies for authentication, security, preferences, performance, and analytics. Section 11 explains the categories and available controls.

SurgiTest uses OpenAI business and API services for authorized AI functions, which may include live examiner turns, grading, feedback, classification, Daily Brief generation, personal-case processing, and related learning. Depending on the feature, we may send the minimum necessary prompt context, server-authorized transcript, candidate answer, session state, rubric, specialty information, de-identified personal-case text, and prior learning context needed to return the requested output.

We do not send account passwords or complete payment-card information to AI providers. Raw candidate audio is not sent to the examiner or grader pathway. Under OpenAI's business and API terms, API inputs and outputs are not used to train OpenAI's general models by default unless the customer affirmatively opts in. Provider retention may vary by endpoint and SurgiTest configuration and may include limited short-term logs for service delivery, abuse prevention, security, or legal compliance.

Google Cloud and Firebase provide core infrastructure such as hosting, functions, databases, storage, authentication, security, and operational logs. Google Cloud text-to-speech or another disclosed voice provider may receive examiner text and voice settings to generate examiner audio. The provider does not need candidate audio, passwords, or complete payment details to synthesize examiner speech.

SurgiTest's MedASR pipeline is the primary speech-recognition path when available. Device speech recognition may be used only under the configured fallback or corroboration policy. The system preserves a server-owned transcript and uncertainty metadata for examiner and grader continuity. Candidate audio is handled as transient processing data as described in Sections 2.3 and 12.

AI and deterministic systems may analyze answers, transcripts, timing, content interactions, and prior results to produce scores, feedback, classifications, recommendations, and readiness insights. These processes support education and do not make decisions with legal or similarly significant effects. You may request review of a transcript, score, audio issue, or content concern through Help & Feedback.

We may analyze aggregate or de-identified patterns to improve SurgiTest content, prompts, rubrics, safety, and reliability. General analytics do not include PHI, personal-case content, raw candidate audio, or full private transcripts. We do not authorize a general-purpose third-party AI provider to train on your private User Content by default. A separate voluntary research or data-sharing program would require a clear notice and any consent required by law.

Providers process data under contracts and instructions appropriate to their role. Some providers may act as independent controllers for limited activities, such as payment compliance, fraud prevention, or legal obligations, as described in their own notices.

We disclose information when you deliberately share a result, join a Board Group, accept an institutional seat with disclosed visibility, connect an integration, ask us to send information to another person, or otherwise direct us to do so. Review the audience and content before using a sharing control.

We may disclose information when we reasonably believe it is necessary to comply with law, legal process, or a valid government request; protect the rights, property, safety, or security of SurgiTest, users, or others; investigate fraud or prohibited conduct; enforce agreements; or establish, exercise, or defend legal claims. We assess requests and disclose only what we reasonably believe is required or permitted.

Information may be disclosed during due diligence or transferred in connection with a financing, reorganization, merger, acquisition, sale of assets, joint venture, bankruptcy, or similar transaction. A recipient will be required to protect personal data consistently with applicable law and any commitments that continue to apply.

We may disclose aggregate or de-identified statistics that do not reasonably identify an individual, such as overall feature usage, cohort trends meeting applicable privacy thresholds, system performance, or educational patterns. We contractually or operationally restrict re-identification where required by law.

A Board Group member may see group membership, the group name, weekly commitments, completion status, candidate-safe verified activity summaries, and encouragements. The group owner can manage invitations and settings but cannot manage another member's subscription, payment method, cancellation, account security, or private learning record.

We do not expose exact scores, detailed feedback, full activity history, transcripts, candidate audio, personal-case content, uploaded materials, private readiness insights, or billing details to a Board Group by default. Those items are shared only if you deliberately use an available result-sharing control that shows the intended audience and content.

We use membership, formation-window, checkout attribution, payment, refund, dispute, and fraud data to determine and equalize Group Rate benefits. Other members may be shown whether a group has reached an eligible member count or rate tier, but they do not receive your payment-card details or complete transaction history.

An institution may sponsor seats, manage rosters, assign activities, review adoption, or enable faculty and department dashboards. Depending on the arrangement, SurgiTest may act as an independent controller for your direct account relationship, as a processor or service provider acting on the institution's instructions, or in both roles for different data.

Authorized administrators may be able to see seat status, affiliation, activation, assigned specialty, completion, high-level usage, aggregate cohort readiness, and audit history. If an institution enables individual coaching or faculty review, designated faculty may also receive the specific scores, feedback, transcript excerpts, session artifacts, or other information described in the institutional notice.

Raw candidate audio, personal-case uploads, complete private transcripts, and sensitive support submissions are not included in ordinary administrative analytics. Any broader faculty access must be specifically enabled, limited to authorized roles, and disclosed. Institutional agreements may impose additional privacy, security, retention, and access requirements.

Your institution may have its own privacy notice and may be responsible for requests concerning data it controls. You may contact SurgiTest or the institution's designated administrator to understand the configuration, request access, or raise a concern. We will route requests to the responsible party where appropriate.

We send messages necessary to operate and secure your account, such as verification emails, password resets, security alerts, receipts, renewal or price notices, legal notices, service-status updates, and responses to requests. These are not marketing messages and may continue while an account or transaction requires them.

Morning Brief email is off by default. Where optional delivery is available, you may opt in, select offered timing and cadence controls, pause delivery, enable an offered reminder, or return to in-app-only delivery. Each email includes a direct link to delivery preferences or a one-click unsubscribe control. We honor an unsubscribe through the available control without requiring continued email delivery.

We do not send a Morning Brief when no valid brief is available, do not intentionally resend the same brief because of a retry, and avoid sending a simultaneous push notification when the configured email has already been sent. Delivery and reminder behavior may be adjusted by your settings and completion status.

We do not send promotional marketing email without the permission or other lawful basis required where you live. You can unsubscribe from marketing without affecting required account, security, billing, or legal messages.

Support and review submissions are accessible only to personnel and providers who need them to route, investigate, resolve, audit, or secure the request. Product suggestions may be used to improve SurgiTest as described in the Terms. Case-specific review content remains governed by this Policy and is not published as product feedback.

Do not include PHI or patient identifiers in a message or screenshot. If a full transcript, candidate audio, or personal-case artifact is necessary, we will seek explicit permission and use the least information reasonably needed for the review.

SurgiTest does not use third-party advertising networks to serve targeted ads and does not use cookies to sell or share personal data for cross-context behavioral advertising.

You can use the SurgiTest cookie-preference tool where available, browser or device settings, and provider opt-out tools. Disabling necessary storage may prevent account or session features from working. We honor legally recognized browser-based opt-out signals, such as Global Privacy Control, to the extent required and applicable to our processing.

Review or change your analytics choice

Some browsers send a “Do Not Track” signal. Because there is no universal standard for that signal, our response may vary. Our no-sale and no-cross-context-advertising commitments apply regardless, and we process legally recognized opt-out signals where required.

A service provider may retain limited data under its own contract and configured service behavior. For example, an AI provider may keep short-term abuse-monitoring or application-state logs unless a different approved retention control applies. Payment processors maintain records required for financial compliance. We configure providers and endpoints with privacy and retention in mind and do not claim zero provider retention unless that control is actually enabled for the relevant workflow.

After deletion from active systems, residual encrypted copies may remain in restricted backups, caches, or logs until they expire through ordinary rotation. Those copies are not restored for ordinary use and remain subject to access controls. We may retain a minimal record of a deletion request, fraud event, legal hold, or transaction when required or permitted by law.

You may initiate account deletion through the account settings made available to you or by emailing support@surgitest.com. We may verify identity before completing the request. Account deletion is different from subscription cancellation, and the deletion flow will explain any billing step. Deleting an app from a device does not delete an account.

Use available account settings or email support@surgitest.com. Describe the request and identify the account email. We may verify identity and authority, ask for additional information reasonably needed to locate records, or use an authorized-agent process where required by law.

We will respond within the period required by applicable law. If we deny or limit a request, we will explain the reason and any appeal option where required. We do not discriminate against you for exercising a privacy right, although deleting or restricting data needed for the Service may prevent us from providing a feature.

You can manage profile information, available Morning Brief and notification settings, cookie preferences, Board Group sharing, and supported session or personal-case deletion through controls made available in the Service. Some records, such as tax or fraud-prevention data, cannot be removed through self-service controls.

SurgiTest has not sold personal data for money and does not share personal data for cross-context behavioral advertising or targeted advertising as those terms are defined by applicable state law. We do not offer a financial incentive in exchange for personal data. The Board Group Rate is based on eligible paid group membership, not on the sale or disclosure of member data.

Applicable law may give you rights to know, access, correct, delete, or obtain a portable copy of personal data; opt out of sale, targeted advertising, or certain profiling; limit use of sensitive personal information; and appeal a denied request. Because we do not sell or use personal data for targeted advertising, those opt-outs generally do not change our ordinary practices, but we honor them where legally applicable.

California residents may request the categories and specific pieces of personal information collected, categories of sources, business purposes, and categories of third parties to whom information was disclosed, subject to legal exceptions. California's “Shine the Light” law permits certain requests regarding disclosure for third-party direct marketing; SurgiTest does not disclose personal data for that purpose.