# Terms of Service

**Effective Date: August 18, 2026 · Last Updated: August 18, 2026**

Welcome to MedEdPrep. These Terms of Service ("Terms") govern your access to and use of the
MedEdPrep testing platform available at mededprep.com and student.mededprep.com, including all
associated features, content, and services (the "Service"), operated by MedEdPrep, LLC, a
Georgia limited liability company ("MedEdPrep," "we," "us," or "our").

By creating an account, signing in for the first time to an account provisioned for you by your
educational institution, or otherwise using the Service, you agree to these Terms and our
Privacy Policy. If you do not agree, do not use the Service.

> **Important:** MedEdPrep is a test preparation and exam delivery platform. Practice exams,
> study resources, and score reports are educational tools — they do not guarantee any
> certification, licensure, examination, or accreditation outcome, and MedEdPrep is not
> affiliated with any certifying or accrediting body unless expressly stated.

## 1. Eligibility and Definitions

You must be at least 13 years of age to use the Service. Minors may use the Service only when
authorized by their educational institution or with the consent of a parent or guardian;
institutions enrolling minors are responsible for obtaining any required parental or guardian
consent under applicable state law and institutional policy.

In these Terms:

- **"Customer"** or **"Institution"** refers to an educational institution, school district,
 agency, or program that has contracted with MedEdPrep — including by purchase order — to
 provide access to the Service for its students and personnel.
- **"Direct Purchase"** refers to a subscription or product you purchase directly from
 MedEdPrep for your own use.
- **"Institution-Administered Assessment"** refers to an exam, assignment, or other assessment
 administered to you through the Service under an Institution's engagement, such as unit
 exams, exit exams, and assigned homework.

An account may include both individually purchased products and institution-administered
assessments; these Terms apply to each according to its type. Where a provision addresses
Direct Purchases, it applies to your directly purchased products and subscriptions; where a
provision addresses Institution-Administered Assessments or institution-managed records, it
applies to activity and records under your Institution's engagement, and the Institution acts
as the Customer for that activity.

## 2. Description of Service

MedEdPrep is a test preparation and exam delivery platform for medical education. The Service
provides:

- Practice examinations and adaptive exams with scoring and domain-level performance reporting
- Delivery of institution-administered assessments, including end-of-pathway and program exams
- Study resources, including study guides and course video content
- Homework assignment and submission tools
- Progress reporting for students, instructors, and program administrators
- Exam accommodation support (such as extended testing time) as authorized by the Institution
- Administrative exports and reports for institutional customers

**Pricing:** Certain features are available by paid subscription or purchase; institutional
access is governed by the applicable agreement or purchase order. We will provide reasonable
advance notice of pricing changes that affect existing subscribers.

## 3. Accounts and Responsibilities

- You are responsible for maintaining the confidentiality of your account credentials. Do not
 share your credentials with any other person; the Service enforces a single active session
 per account.
- You must provide accurate information during registration, including your real name and a
 valid email address.
- You are responsible for all activity that occurs under your account, and you may not assign
 or transfer your account to any other person.
- Notify us promptly at [email protected] if you believe your account has been compromised.
- Institutions are responsible for managing access they provision, including promptly
 deactivating accounts for students no longer affiliated with the program. Deactivation of
 institution-provisioned access does not affect any active Direct Purchase on the same
 account.

## 4. Acceptable Use and Exam Integrity

The Service is provided exclusively for legitimate educational and test preparation purposes.
You agree NOT to:

- **Compromise exam integrity** — take an exam on another person's behalf, permit another
 person to take an exam on yours, or use unauthorized aids or assistance during any assessment
 administered through the Service.
- **Reproduce or share exam content** — copy, photograph, record, publish, or distribute exam
 questions, answers, or other assessment content in any form. Exam content is confidential
 and proprietary.
- **Misuse credentials** — share login credentials or access another user's account.
- **Scrape or harvest** — use automated scripts, bots, or other tools to extract data or
 content from the Service.
- **Interfere with the Service** — attempt to disrupt, overload, reverse engineer, or
 compromise the Service's infrastructure or security, or access any part of the Service not
 intentionally made available to you.
- **Resell or redistribute** — resell access to the Service or use it to build a competing
 product. MedEdPrep content is not for resale.
- **Violate applicable law** — use the Service in any way that violates federal, state, or
 local laws, including laws governing student educational records.

We reserve the right to investigate violations and take appropriate action, including
invalidating exam results obtained in violation of this section and suspending or terminating
accounts.

**Human review of integrity findings:** Before we take action against your account or your
results based on a suspected integrity violation, the finding will be reviewed by a human — we
do not take adverse action on automated flags alone. For Institution-Administered Assessments,
we report integrity findings to the Institution, and the final determination of any academic
consequence rests with the Institution under its own policies.

## 5. Purchases, Cancellation, and Refunds

This Section 5 applies to Direct Purchases. Access provided through your Institution is paid
for under the Institution's agreement, purchase order, or invoice terms, and nothing in this
section imposes any charge on you for institution-provisioned access.

Payments for Direct Purchases are processed by Stripe. By purchasing, you authorize the
applicable recurring or one-time charges. Paid subscriptions renew automatically at the end of
each subscription term (monthly, quarterly, or yearly, as selected at purchase) at the
then-current price, until you cancel.

You may cancel your subscription at any time from your account settings or by emailing
[email protected]. If you request a refund within 48 hours of purchase, you will receive a
full refund and your account will revert to free (non-paid) access. After 48 hours, the current
month is not refundable, but no future months will be charged. If you cancel a quarterly or
yearly subscription, completed months are charged at the regular full monthly (non-discounted)
price and the remainder is refunded.

## 6. Data Ownership and Educational Records

- **Institution-administered assessment records:** Records generated through
 Institution-Administered Assessments — including exam results, scores, and related progress
 data — are education records of the Institution. The Institution owns and controls these
 records, and MedEdPrep processes and stores them on the Institution's behalf as a service
 provider, as described in our Privacy Policy. Requests concerning these records (including
 access, correction, and deletion requests) are routed through the Institution. Institutions
 may request exports of their data while their engagement is active.
- **Your data:** You retain ownership of the personal information you provide, and of records
 generated through your Direct Purchases.
- **License to operate:** By submitting data to the Service, you grant MedEdPrep a
 non-exclusive, royalty-free license to host, store, process, and display that data solely for
 the purpose of operating and providing the Service. This license ends as to any data when
 that data is deleted from the Service.
- **Limited use:** MedEdPrep uses Customer and User data only to provide, maintain, and improve
 the Service. We do not sell student education records.

## 7. Intellectual Property

### Platform and Content Ownership

All software, exam content, question banks, study materials, designs, report formats,
interfaces, and other content within the Service are owned by MedEdPrep, LLC or its licensors
and are protected by copyright and other intellectual property laws. You are granted a limited,
non-exclusive, non-transferable, revocable license to use the Service and its content for your
personal educational use (or, for Institutions, the authorized educational use of your
program) only. You may not reproduce, distribute, modify, publicly display, reverse engineer,
or create derivative works from any platform content without prior written permission from
MedEdPrep.

### Feedback

If you provide feedback, suggestions, or ideas about the Service, you grant MedEdPrep a
non-exclusive, perpetual, irrevocable, royalty-free, worldwide license to use, modify, and
incorporate such feedback for any purpose, without obligation or compensation to you.

### Copyright and DMCA

MedEdPrep respects the intellectual property rights of others. If you believe content on the
Service infringes your copyright, send a written notice to our designated agent, registered
with the U.S. Copyright Office:

> **DMCA Agent**
> MedEdPrep, LLC
> 338 Leggett Rd
> Dallas, Georgia 30157
> Telephone: (470) 300-0090
> Email: [email protected]

Your notice must include: (1) identification of the copyrighted work; (2) identification of
the allegedly infringing material; (3) your contact information; (4) a statement of your good
faith belief that the use is not authorized; (5) a statement under penalty of perjury that the
information is accurate and you are authorized to act for the copyright owner; and (6) a
physical or electronic signature of the copyright owner or authorized agent. We will respond
to valid notices in accordance with the Digital Millennium Copyright Act, 17 U.S.C. § 512.
Repeat infringers may have their accounts terminated.

## 8. No Medical Advice

The contents of the Service — text, graphics, images, and other materials — are for
educational and informational purposes only. The content is not intended to be a substitute for
professional medical advice, diagnosis, or treatment. Always seek the advice of a physician or
other qualified health provider with any questions regarding a medical condition.

## 9. Privacy and Security

Our collection and use of personal information is described in our Privacy Policy, which is
incorporated into these Terms by reference. In brief: we collect what we need to operate the
Service, we do not sell personal information, and we do not use student data for advertising.

In the event of a confirmed security incident affecting your personal information, MedEdPrep
will provide notice without unreasonable delay and as required by applicable law. For
institution-managed records, MedEdPrep notifies the Institution and supports the Institution's
own notification duties; direct notice to you applies to personal information associated with
your individual consumer account. Institutional agreements may specify faster
institution-facing notice windows.

## 10. Service Availability

We strive to maintain consistent availability of the Service, but we do not guarantee
uninterrupted, error-free, or loss-free operation. The Service may be temporarily unavailable
due to scheduled maintenance, updates, or circumstances beyond our control. Any service levels
committed to an Institution are set out in that Institution's agreement.

**Force Majeure:** MedEdPrep shall not be liable for any failure or delay in performance due to
causes beyond its reasonable control, including but not limited to acts of God, natural
disasters, pandemics, cyberattacks, third-party service provider failures, government actions,
or interruptions in internet or telecommunications service.

## 11. Disclaimer of Warranties

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SERVICE IS PROVIDED "AS IS" AND "AS
AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
MEDEDPREP DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR FREE FROM
DATA LOSS, NOR THAT USE OF THE SERVICE WILL RESULT IN ANY PARTICULAR EXAMINATION, CERTIFICATION,
OR ACADEMIC OUTCOME.

## 12. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, MEDEDPREP AND ITS OFFICERS, DIRECTORS, EMPLOYEES, AND
AGENTS SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE
DAMAGES ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE, INCLUDING WITHOUT LIMITATION
LOSS OF DATA, EXAMINATION OR CERTIFICATION OUTCOMES, OR ANY DAMAGES RESULTING FROM RELIANCE ON
CONTENT PROVIDED THROUGH THE SERVICE.

OUR TOTAL LIABILITY FOR ANY CLAIM ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE
SHALL NOT EXCEED THE TOTAL AMOUNT PAID TO MEDEDPREP BY THE CLAIMANT FOR THE SERVICE IN THE
TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR ONE HUNDRED DOLLARS
($100 USD) IF GREATER.

Some jurisdictions do not allow the exclusion of certain warranties or the limitation of
liability for certain damages. In those jurisdictions, our liability is limited to the greatest
extent permitted by law. Nothing in these Terms limits liability for gross negligence or
willful misconduct, or any liability that cannot be limited under applicable law.

## 13. Indemnification

**Institution-provisioned access:** This section does not apply to your access to and use of
the Service provided through an Institution, including your participation in
Institution-Administered Assessments. Any indemnification relating to an Institution's
engagement is governed by the Institution's agreement with MedEdPrep.

**Direct Purchases:** With respect to your use of the Service under a Direct Purchase, you
agree to indemnify and hold harmless MedEdPrep, LLC, its officers, employees, and agents from
third-party claims, damages, losses, or expenses (including reasonable attorneys' fees) to the
extent arising from: (a) your willful misconduct; (b) your infringement of a third party's
intellectual property rights; or (c) your violation of applicable law.

**Mechanics:** MedEdPrep will provide you prompt written notice of any claim subject to this
section and reasonable cooperation in its defense, at your expense. You may not settle any
indemnified claim in a manner that imposes any obligation or admission on MedEdPrep without
MedEdPrep's prior written consent, and you have the right to participate in the defense of any
indemnified claim at your own expense.

This indemnification obligation does not apply to the extent a claim arises from MedEdPrep's
gross negligence, willful misconduct, or material breach of these Terms.

**Public institutions:** If you are a state or local government entity (including a public
school district or public college), your indemnification obligations apply only to the extent
permitted by the constitution and laws of your state, and nothing in these Terms waives any
sovereign or governmental immunity to which you are entitled.

## 14. Institutional Agreements; Order of Precedence

If your Institution has entered into a separate written agreement, purchase order, data
processing agreement, or data privacy agreement with MedEdPrep, the terms of that agreement
control over these Terms to the extent of any conflict, for the Institution and its authorized
Users.

## 15. Termination and Suspension

**By you or your Institution:** You may stop using the Service at any time. Institutions may
terminate by contacting [email protected]; institution-provisioned access may be
deactivated by the Institution at any time.

**By us — for cause:** For violations of these Terms that pose an immediate risk to the
Service, to exam integrity, or to other users, we may suspend or terminate accounts immediately
upon notice.

**By us — all other cases:** For all other terminations of institutional engagements, we will
provide at least 30 days' written notice to the email address on file.

**Effect of termination:** Upon termination, your right to use the Service ceases. For
institutional customers, MedEdPrep will provide a reasonable window of not less than 30 days to
request an export of the Institution's data before deletion, and personal information will
thereafter be handled in accordance with our Privacy Policy. Provisions that by their nature
should survive termination will survive, including Sections 4 (exam-integrity and
confidentiality obligations), 5 (as to amounts accrued before termination), 6 (except the
license to operate, which ends when the associated data is deleted), 7, 8, 11, 12, 13, 14, 16,
17, and 18.

## 16. Dispute Resolution

**Informal resolution:** Before either you or MedEdPrep initiates arbitration or a court
proceeding (other than a small claims action or a request for injunctive relief permitted by
this section), the party raising the dispute will send the other a written notice describing
the dispute — to [email protected] if to us, or to your email address on file if to you —
and both parties will attempt in good faith to resolve the dispute informally for at least 60
days. Most concerns can be resolved this way. Any applicable statute of limitations, and any
deadline for paying arbitration filing fees, is tolled during this informal resolution period.

**Binding arbitration:** If we cannot resolve a dispute informally, you and MedEdPrep agree to
resolve any disputes arising out of or relating to these Terms or the Service through final and
binding individual arbitration administered by the American Arbitration Association ("AAA").
Disputes brought by or against you as an individual will be administered under the AAA Consumer
Arbitration Rules. Disputes involving an Institution are resolved as provided in the
Institution's agreement with MedEdPrep or, if that agreement does not address dispute
resolution, under the AAA Commercial Arbitration Rules. The arbitration will be conducted
remotely to the extent possible, or in Georgia if an in-person hearing is required.

**Arbitration fees:** MedEdPrep will pay all AAA filing fees and arbitrator costs for claims
under $10,000. For claims above $10,000, fees and costs will be allocated in accordance with
AAA Consumer Arbitration Rules. MedEdPrep will not seek attorneys' fees from you in arbitration
unless the arbitrator determines your claim was frivolous.

**Exceptions to arbitration:** This arbitration agreement does not prevent: (a) either party
from bringing an individual action in small claims court for disputes within that court's
jurisdictional limits; (b) either party from seeking public injunctive relief in court where a
claim for such relief cannot lawfully be waived; or (c) either party from seeking injunctive
or other equitable relief in a court of competent jurisdiction for actual or threatened
infringement of intellectual property rights or breach of the exam-integrity and
exam-content-confidentiality obligations in Section 4.

**Class action waiver:** YOU AND MEDEDPREP AGREE THAT EACH MAY BRING CLAIMS AGAINST THE OTHER
ONLY IN YOUR OR ITS INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY
PURPORTED CLASS, CONSOLIDATED, OR REPRESENTATIVE PROCEEDING. This class action waiver is a
material and non-severable part of this arbitration agreement: if the waiver is found
unenforceable as to a particular claim or request for relief, then that claim or request for
relief (and only that claim or request) shall be severed from arbitration and proceed in court
in accordance with Section 17, and all remaining claims shall be resolved in arbitration.

**Opt-out right:** You may opt out of this arbitration agreement and class action waiver by
sending written notice within 30 days after you first accept these Terms, either by email to
[email protected] or by mail to MedEdPrep, LLC, 338 Leggett Rd, Dallas, Georgia 30157,
including your name, your email address, and a clear statement that you wish to opt out.
Opting out will not affect any other part of these Terms or your use of the Service. If you
opt out, disputes will be resolved in accordance with Section 17 (Governing Law).

**Students under 18:** If you are under 18 years of age, disputes concerning your use of the
Service are raised and resolved through your Institution or through your parent or guardian on
your behalf.

**Changes to this section:** Any changes to this Section 16 apply prospectively only; they do
not apply to disputes that arose before the change took effect.

**Public institutions:** This Section 16 (including the arbitration agreement and class action
waiver) applies to a state or local government entity only to the extent permitted by the
constitution and laws of its state. Disputes with such entities that cannot lawfully be
arbitrated will be resolved in accordance with Section 17, subject to any venue or forum
requirements applicable to that entity.

## 17. Governing Law and Venue

These Terms are governed by and construed in accordance with the laws of the State of Georgia,
United States, without regard to conflict of law principles. For disputes not subject to
arbitration, any legal action shall be brought exclusively in the state or federal courts
located in or serving Paulding County, Georgia, except as otherwise required by law for
government entities.

## 18. General Provisions; Contact

- **Entire agreement:** These Terms, together with our Privacy Policy and any applicable
 institutional agreement (see Section 14), constitute the entire agreement between you and
 MedEdPrep, LLC regarding the Service.
- **Severability:** If any provision is found unenforceable, it will be replaced by an
 enforceable provision that most closely matches its intent, and the remaining provisions
 remain in full force. This does not apply to the class action waiver in Section 16, which is
 non-severable from the arbitration agreement as described there.
- **No waiver:** Our failure to enforce any provision does not waive that provision.
- **Assignment:** You may not assign your rights or obligations under these Terms without our
 prior written consent. MedEdPrep may assign its rights and obligations in connection with a
 merger, acquisition, or sale of assets, with notice to affected customers.
- **Electronic communications:** You consent to receive communications from us electronically,
 and agree that such communications satisfy any legal requirement that they be in writing.
- **Notices:** We may provide notices via email to the address on file or via in-app notice.
 Notices to MedEdPrep must be sent to [email protected]; legal notices should also be sent
 by mail to MedEdPrep, LLC, Attn: Legal, 338 Leggett Rd, Dallas, Georgia 30157.
- **Changes to Terms:** We may update these Terms from time to time. For material changes, we
 will provide at least 14 days' advance notice by email or by prominent notice within the
 Service before the changes take effect, and we will update the Effective Date. Changes to
 Section 16 (Dispute Resolution) apply prospectively only. Material changes that affect an
 active institutional agreement will not degrade that agreement's terms without the
 Institution's consent. Continued use after changes become effective constitutes acceptance.
 Previous versions are available on request.

**MedEdPrep, LLC**
338 Leggett Rd, Dallas, Georgia 30157
Email: [email protected]
Telephone: (470) 300-0090

# Privacy Policy

**Effective Date: August 18, 2026 · Last Updated: August 18, 2026**

MedEdPrep, LLC, a Georgia limited liability company ("MedEdPrep," "we," "us," or "our") operates
the MedEdPrep student testing platform at student.mededprep.com (the "Service"). The Service is a
test preparation and exam delivery platform used by individual learners and by students of
educational institutions — including colleges, technical colleges, EMS education programs, and
high school career and technical education programs — to prepare for and take medical education
assessments.

An account may include both individually purchased products and institution-administered
assessments. This Privacy Policy applies to each record according to its type: records you create
through a direct purchase are your individual consumer records, and institution-administered
assessment records (such as unit exams, exit exams, and assigned homework) are education records
controlled by your institution (your "Institution"), which we process and store on the
Institution's behalf as a service provider.

This Privacy Policy explains what information we collect, why we collect it, how we use and
protect it, and what choices you have. We are committed to protecting the privacy of our users,
particularly students whose records are managed on behalf of an educational institution.

> **The short version:** We collect only what we need to run the Service — your account details,
> your exam and study activity, and (for paid individual accounts) billing handled by Stripe. We
> do not sell your data. We do not use student data for advertising. We do not send student
> personal information to third-party AI services or use it to train generative AI models. Exam
> sessions are monitored for integrity. We share your data only with your institution (if you use
> the Service through one), and with the service providers who help us operate the platform.

## Contents

1. Information We Collect
2. How We Use Your Information
3. How We Share Your Information
4. Educational Records and FERPA
5. Data Security
6. Children's Privacy
7. Cookies and Tracking
8. Data Retention
9. Your Rights
10. International Data Transfer
11. Governing Law
12. Changes to This Policy
13. Contact Us

## 1. Information We Collect

### Information you or your institution provide

- **Account information:** First and last name, email address, and — depending on how your
 account was created — mailing address, phone number, education level, and school or program
 affiliation.
- **Institution-provisioned accounts:** If your Institution or instructor created your account,
 they provide your name, email address, program or cohort assignment, and any exam
 accommodation settings (such as extended testing time) that your Institution has authorized
 for you. Accommodation settings are treated as confidential: they are visible only to
 personnel with a need to know and are used solely to deliver the accommodation your
 Institution has authorized.
- **Billing information (individual paid accounts):** If you purchase a subscription or product
 directly, payment is processed by Stripe. Card details are collected and stored by Stripe —
 we retain only a payment reference, not your card number.

### Information generated by your use of the Service

- **Exam and study activity:** Exam attempts, answers, scores, domain-level performance,
 adaptive exam progression, homework submissions, and survey or questionnaire responses.
- **Exam-session monitoring:** Exam sessions are monitored and analyzed for exam integrity,
 including session timing and interaction patterns. See Section 2 and Section 8.
- **Reports:** Score reports and progress reports generated from your activity, available to
 you and — for institution-managed accounts — to your instructors and program administrators.

### Information collected automatically

- **Device and browser information:** Browser type and version, device type, and operating
 system, used for compatibility and security.
- **Usage data:** Pages visited, features used, and interaction patterns (first-party click
 and usage logging used to operate and improve the Service).
- **Network information:** IP address, used for security and abuse prevention.

### Information we do not collect

- **Patient health information:** The Service holds education and assessment records, not
 patient records. It is not used to deliver, bill for, or document clinical care. We do not
 request or require patient information; do not submit it through the Service.
- **Card numbers:** Payment card details are held by Stripe, not by MedEdPrep.

## 2. How We Use Your Information

We use the information we collect to:

- **Provide the Service:** Deliver practice and certification-preparation exams, score and
 report results, track study progress, and apply institution-authorized exam accommodations.
- **Support your institution:** Make student progress and results available to the instructors
 and administrators of the program you are enrolled in.
- **Process payments:** Complete purchase transactions for individual paid accounts via Stripe.
- **Communicate with you:** Send account-related and transactional email such as registration
 confirmations, password resets, exam notifications, and receipts.
- **Improve the Service:** Analyze usage in aggregate to fix problems and improve features.
- **Maintain security and exam integrity:** Detect and prevent unauthorized access, and monitor
 and analyze exam sessions — including session timing and interaction patterns — to protect
 the integrity of assessments.

**Artificial intelligence and automated analysis:** We do not transmit student personal
information to third-party AI services, and we do not use it to train generative AI models.
AI-assisted analysis — including exam-integrity review and assessment analytics — runs on
systems under MedEdPrep's control. We use student responses to deliver and score assessments,
including statistical (psychometric) models that calibrate question difficulty, estimate
ability, and generate readiness indicators as part of the Service. Question and platform
improvement uses de-identified and aggregated data.

**Marketing communications:** We do not use student data managed on behalf of an educational
institution for marketing or advertising, and we do not advertise to students through the
Service. Individual consumer account holders may occasionally receive promotional email about
MedEdPrep products; you can opt out at any time using the unsubscribe link in any such email or
by contacting [email protected].

**Our role:** When you use the Service through an educational institution, we act as a service
provider on behalf of your Institution and use institution-managed records only for the
educational purposes the Institution has authorized. For individual purchases, we use your
information to provide the products and services you bought and to operate the platform, as
described in this Policy.

> **We do not use your data to build advertising profiles.** The Service does not serve ads,
> and we do not sell, rent, or trade your personal information to advertisers or data brokers.

## 3. How We Share Your Information

We share your information only in the following limited circumstances:

- **With your institution:** If you use the Service through an educational institution, your
 program administrators and instructors can view your exam results, progress, and related
 records as part of supervising your education. This is the core educational purpose of the
 Service.
- **With service providers (subprocessors):** We use a limited number of third-party services
 to operate the platform:
 - **Cloud infrastructure (AWS, US-East-1):** Application hosting, database, and file storage.
 - **Managed hosting and infrastructure services (Unified Infotech):** Platform infrastructure
   management, maintenance, and backup administration.
 - **Payment processing (Stripe):** Payment collection and subscription billing for individual
   paid accounts.
 - **Email delivery (SendGrid):** Transactional email delivery.
 - **Bot protection (Google reCAPTCHA):** Abuse prevention on public forms.
 - **Notifications (Google Firebase):** Application notifications.
 - **Image delivery (ImageKit):** Image hosting and transformation.
 - **Video hosting (Vimeo):** Course video content delivery.

 These providers access data only as needed to perform their services for us and are bound by
 contractual confidentiality obligations. Google reCAPTCHA and Vimeo process the data they
 receive through their embedded components under their own privacy policies. Survey and
 questionnaire pages are rendered using SurveyJS, a licensed software component that runs
 within the Service; SurveyJS is not a recipient of your data — your survey responses are
 stored by MedEdPrep.
- **When required by law:** We may disclose information in response to a valid legal process
 such as a subpoena, court order, or government request. Where the legal process concerns
 institution-managed education records, we will notify the Institution before complying unless
 we are legally prohibited from doing so.
- **In aggregated or de-identified form:** We may share aggregated statistical data (for
 example, pass rates or item performance) for research or reporting. We de-identify this data
 so that it is not reasonably capable of being linked to any individual, and we do not permit
 recipients to attempt re-identification.
- **Business transfers:** In the event of a merger, acquisition, or sale of substantially all
 assets, your data may be transferred. We will notify affected institutions and users as and
 when permitted and required by law before any such transfer takes effect, and any successor
 will be bound by this Privacy Policy with respect to previously collected information.

**We do not sell your personal information**, and we do not share it with third parties for
their own marketing or advertising purposes, including data brokers and cross-context
behavioral advertising.

## 4. Educational Records and FERPA

When the Service is used through an educational institution, student exam records, scores, and
progress data may constitute "education records" under the Family Educational Rights and
Privacy Act (FERPA). In that context:

- **Your institution controls its education records.** MedEdPrep processes and stores this data
 on the Institution's behalf as a service provider, under the Institution's direction.
- **School official exception:** MedEdPrep is prepared to operate as a "school official" with a
 legitimate educational interest under 34 CFR 99.31(a)(1), subject to the Institution's
 designation. We use education records only for the educational purposes authorized by the
 Institution and under the Institution's direct control.
- **Limited disclosure to subprocessors:** Education records may be disclosed to the
 subprocessors listed in Section 3 solely for the purpose of operating the Service and under
 written contractual restrictions prohibiting further re-disclosure.
- **No independent contact:** We do not independently market to students or use education
 records for purposes unrelated to the educational services we provide.
- **Who holds FERPA rights:** For students in K-12 programs (including high school career and
 technical education programs), FERPA rights — including the rights to inspect records and
 request amendments — belong to the student's parent or guardian until those rights transfer
 to the student under FERPA. For students in post-secondary programs, those rights belong to
 the student as an "eligible student." In both cases, FERPA rights are administered through
 your educational institution: contact your registrar or program director for FERPA-related
 requests.
- **Legal process:** If we receive a subpoena or other legal demand for institution-managed
 education records, we will notify the Institution before complying unless we are legally
 prohibited from doing so.
- **Surveys (PPRA):** For surveys administered by an Institution through the Service, the
 Institution is responsible for any notice and consent required under the Protection of Pupil
 Rights Amendment (PPRA) and applicable state law. MedEdPrep does not use survey responses for
 marketing.
- **Institutional agreements:** If your institution requires a FERPA compliance addendum, data
 processing agreement (DPA), or data-sharing agreement, contact us at [email protected].
 We are prepared to execute institutional agreements as needed.

**Order of precedence:** If MedEdPrep has signed a data processing agreement or other written
agreement with your Institution, that agreement controls over this Privacy Policy for that
Institution's data to the extent of any conflict.

## 5. Data Security

We implement technical and organizational safeguards appropriate to the data we hold, including:

- **Encryption in transit:** Data transmitted between your browser and our servers is encrypted
 using TLS (HTTPS).
- **Password security:** Passwords are stored using industry-standard salted password hashing.
 We never store or have access to your plain-text password.
- **Session protection:** Session cookies are encrypted and HTTP-only, requests are protected
 against cross-site request forgery, and each account is limited to a single active session at
 a time.
- **Role-based access:** Administrator, instructor, and student roles are enforced so users see
 only what their role requires; students cannot access other students' records.
- **Payment isolation:** Card data is tokenized and held by Stripe; MedEdPrep never stores card
 numbers.

No system is perfectly secure. If we confirm a security breach that affects your personal
information, we will provide notice without unreasonable delay and as required by applicable
law. For institution-managed records, we notify the affected Institution and support the
Institution's own notification duties to its students; direct notice from MedEdPrep applies to
individual consumer accounts. Institutional agreements may specify faster institution-facing
notification windows.

## 6. Children's Privacy

The Service is designed for adult learners and for students enrolled in authorized educational
programs, including high school career and technical education programs whose students may be
minors.

**The Service is not directed to children under the age of 13, and we do not knowingly collect
personal information from children under 13** in compliance with the Children's Online Privacy
Protection Act (COPPA). Minor students may use the Service only when authorized by their
educational institution; institutions enrolling minors are responsible for obtaining any
required parental or guardian consent under applicable state law and institutional policy.

If you believe we have inadvertently collected information from a child under 13, contact us at
[email protected]. We will promptly delete or de-identify it; where the information is part
of an institution-managed record, we will coordinate with the Institution to do so.

## 7. Cookies and Tracking

The Service uses:

- **Essential session cookies:** Secure, encrypted, HTTP-only cookies that keep you logged in.
 These are required for the platform to function.
- **Bot protection:** Google reCAPTCHA on public-facing forms.
- **First-party usage logging:** We log feature usage and page interactions within the Service
 to operate and improve it. This data stays with MedEdPrep.

We do not use advertising cookies and we do not sell usage data to advertisers.

**Do Not Track:** The Service does not track users across third-party websites and does not use
behavioral advertising. Because we do not engage in cross-site ad tracking, we do not respond to
Do Not Track (DNT) browser signals — there is no such tracking to disable.

## 8. Data Retention

- **Active accounts:** We retain your data for as long as your account is active and, for
 institution-managed accounts, as long as your institution maintains its relationship with
 MedEdPrep.
- **Generated export files:** Report and export files generated through the Service are
 automatically deleted 30 days after generation.
- **Exam-integrity records:** Records of exam-integrity investigations are retained for five
 (5) years, or as directed by the Institution for institution-administered exams.
- **Deletion requests:** On a verified deletion request, we will remove or de-identify your
 personal information in active systems, except for records your institution is required to
 retain for educational or accreditation purposes, records needed to comply with legal
 obligations, and data subject to legal holds. Assessment response data is retained in
 de-identified form to preserve the statistical validity of exam questions; once de-identified,
 it is no longer associated with you. See Section 9.
- **Backups:** Backup copies may persist for a limited period after deletion from active
 systems before being overwritten in the ordinary course.

**Institution-managed records:** For records submitted or managed by an institution, MedEdPrep
processes this data on the Institution's behalf. Requests regarding institution-managed records
are routed through the Institution, which controls the records it manages. See Section 9.

## 9. Your Rights

You have the right to:

- **Access:** Request a copy of the personal information we hold about you.
- **Correction:** Request correction of inaccurate or incomplete personal information.
- **Deletion:** Request deletion of your account and associated personal data, subject to the
 retention constraints described in Section 8. Deleted assessment response data is retained
 only in de-identified form, as described in Section 8.
- **Data portability:** Request your data in a commonly used, machine-readable format.

To exercise any of these rights, email [email protected]. We will respond to verified
requests within 30 days where practicable and in any event as required by applicable law.

**Institution-managed records:** If your request concerns education records managed by your
Institution, we will forward the request to the Institution within 5 business days and support
the Institution's response. We do not delete education records without the Institution's
authorization; FERPA access and amendment rights for those records are exercised through your
Institution as described in Section 4.

## 10. International Data Transfer

The Service is hosted in the United States (AWS US-East-1). If you access the Service from
outside the United States, your data will be transferred to and processed in the United States.
By using the Service, you acknowledge this transfer.

## 11. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the State of
Georgia, United States, without regard to conflict of law principles. Nothing in this section
limits your rights under applicable mandatory data protection laws in your jurisdiction.

## 12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or
legal requirements. If we make material changes, we will notify you at least 14 days before the
changes take effect, by email or through a prominent notice within the Service. Material changes
affecting an active institutional agreement do not degrade that agreement's terms without the
Institution's consent. Your continued use of the Service after a change takes effect constitutes
acceptance of the updated policy, except where applicable law requires additional consent before
materially different data practices take effect.

## 13. Contact Us

If you have questions about this Privacy Policy, need help exercising your rights, or want to
discuss FERPA compliance or a data processing agreement for your institution:

**MedEdPrep, LLC**
338 Leggett Rd, Dallas, Georgia 30157
Email: [email protected]
Telephone: (470) 300-0090

We aim to respond to all inquiries within 30 days.