Privacy Policy

MedGrades is an educational platform for medical students, interns and residents in India. This policy covers two separate things: the marketing website at https://medgrades.in, and the MedGrades application where students prepare cases. They collect different information and are described separately below.

This website records page views and a short list of clicks in two ways: on this site’s own server, and through Google Analytics and the Meta Pixel. Both of those run on this marketing website only. Neither runs inside the MedGrades application, where cases are prepared.

• Event names come from a fixed allowlist. A page view, a call-to-action click, an FAQ panel being opened. Anything not on that list is discarded by the server rather than stored.
• Properties are enum-like and length-capped. A handful of permitted keys with short values. Free text cannot be sent through this channel.
• Google Analytics and the Meta Pixel. Google Analytics tells us how many people visit, which pages they read and where they came from. The Meta Pixel tells Meta that someone who saw a MedGrades ad on Instagram or Facebook reached this site or clicked through to sign up, so our ads reach students who find them useful. Both set their own cookies and receive your IP address and browser details, as described in Google’s and Meta’s own privacy policies. They receive the same allowlisted event names described above and nothing you type. When you create an account or a payment is confirmed, the application briefly loads one invisible page from this website so that Google Analytics and Meta can count that sign-up or purchase. That page receives only the type of event and an order or sign-up reference, never your name, contact details or any case. No session recorder or social widget runs here.
• Nothing is sold. We do not sell or rent any information about visitors. You can block both tags with any standard content blocker, or opt out of Google Analytics with Google’s browser add-on, and the site works the same.
• Which campaign brought you. If the link you followed carries a campaign tag (for example utm_source=instagram) or a referral code, your browser remembers that tag for up to 30 days, and it is saved with your account if you sign up. It tells us which posts and ads bring students who find MedGrades useful. It is a label we wrote into the link, never anything you typed.
• Ad measurement, only if you came from a Meta ad. A link from an Instagram or Facebook ad carries a click identifier created by Meta. If you then create an account, and later if you pay, our server tells Meta that a sign-up or a purchase came from that click, sending only that identifier, your browser type and the time. No name, email, phone number, college, IP address or case content is sent from the application, and no Meta or Google script runs inside it.

Standard server logs, including an IP address, may be recorded by our hosting provider for security and abuse prevention. They are not used to build a profile of you and are kept only as long as they are useful for that purpose.

The contact form asks for four things: your name, your email address, the closest description of your role, and your message. Nothing else is requested and nothing else is recorded from the form.

We use it to reply to you. Submissions are held by Netlify, who host this website, so that an enquiry is not lost, and they are read only in order to answer you. The message body is not written to our application logs. Please do not include patient information in a message to us.

If you create a MedGrades account, the application holds the information it needs to be useful to you:

• Account details: your name, email address, mobile number, college, department and stage of training.
• Case information you enter: text you type, audio you record, photographs of case sheets or reports you upload, and the structured record built from them.
• Learning activity: presentations generated, practice sessions completed, questions answered, and the weak areas identified from them.
• Subscription status: whether you have a current paid year. Payment itself is handled by Razorpay.

Your email address is used to run your account: signing in, and a few short messages from the founder about getting started and about your subscription. Reply “stop” to any of them and they end. Your mobile number is used for account recovery, and for tips on WhatsApp only if you tick the box that asks for them.

Payment card, UPI and net banking details are entered on Razorpay and are never seen or stored by MedGrades.

MedGrades is a learning tool, not a medical record. It does not need to know which patient a case belongs to, and it is designed so that it never has to.

Do not enter any of the following into the application:

• Patient names, or the names of their relatives.
• Phone numbers or email addresses belonging to a patient.
• Home addresses or any other location that identifies a patient.
• Hospital registration numbers, unit record numbers, IP or OP numbers, or bed identifiers tied to a named patient.
• Government identifiers of any kind, including Aadhaar, PAN, ration card or insurance numbers.
• Photographs of faces, or of any image feature that identifies an individual.

Photograph the clinical content of a case sheet, not the header that names the patient. Everything MedGrades does clinically works from findings, not from identity.

Your institution’s rules on patient confidentiality continue to apply to you in full. This policy does not replace them and cannot loosen them.

Case data is stored so that it is available to you across your devices and across the days of an admission. It is transmitted over encrypted connections and held in access-controlled storage.

• Your cases are yours. They are not shown to other students, to faculty or to your college.
• You can delete an individual case from within the application, and you can request deletion of your entire account by writing to us.
• Deletion removes the case from the application. Backups age out on their own schedule, so a deleted case may persist briefly in a backup before it is overwritten.
• Your case content is not sold, and it is not used to advertise anything to you.

Where processing is carried out by service providers, such as hosting, storage or the language models that generate presentations and questions, those providers act on our instructions and are bound by contract.

This marketing website uses cookies set by Google Analytics and the Meta Pixel, described in section 2, to count visits and measure ads. Blocking them does not change how the site works. The campaign tag described in section 2 is kept in your browser's local storage for up to 30 days and never leaves your device unless you sign up.

The application uses cookies or equivalent browser storage that are strictly necessary to keep you signed in and to keep your session secure. Those cannot be switched off without signing you out.

You can ask what we hold about you, ask for it to be corrected, ask for your account and case data to be deleted, or withdraw from the service entirely. Write to hello@medgrades.in and say what you want done.

We acknowledge a request within seventy-two hours and complete it within thirty days. If a request would require us to delete something we are separately obliged to keep, such as a record that a deletion happened, we tell you what was kept and why. You may also nominate another person to exercise these rights on your behalf if you are unable to.

If you are not satisfied with how a request was handled, the grievance officer named in clause 12 is the next step, and the Data Protection Board of India is the statutory authority above that.

If this policy changes materially, the updated date at the top of the page changes with it and account holders are told. Continuing to use MedGrades after a change means the updated policy applies to you.

MedGrades is built for students already in the clinical years of an MBBS course, and an account is intended for a person aged eighteen or over. If you are under eighteen, do not create an account without a parent or guardian giving consent on your behalf, which the Digital Personal Data Protection Act, 2023 requires us to obtain and verify before processing your data.

If we learn that an account belongs to someone under eighteen without that consent, we close it and delete the data held under it. Tell us at privacy@medgrades.in if you believe this applies to an account.

Case data is stored in Google Cloud Firestore in the asia-south1 region, which is Mumbai. Authentication is handled by Google Firebase Authentication. Payments are handled by Razorpay, an Indian payment aggregator authorised by the Reserve Bank of India, and MedGrades never receives your card, UPI or net banking details.

Preparing a case sends the text you supplied to a language model provider for processing. That text is processed to return your preparation and is not used to train a model. Because that provider operates outside India, this is a cross-border transfer, and it is one more reason the application asks you never to enter anything that identifies a patient.

Under the Digital Personal Data Protection Act, 2023 and the Information Technology (Intermediary Guidelines) Rules, the following person answers privacy questions, consent withdrawals, correction requests and deletion requests for MedGrades.

• Grievance officer: Somesh, Founder
• Operated by: Leads Meister LLP
• Address: Belagavi, Karnataka, India
• Email: privacy@medgrades.in

We acknowledge a request within seventy-two hours and resolve it within thirty days. If you are not satisfied with the outcome, you may complain to the Data Protection Board of India, which is the statutory authority under that Act. Nothing in this policy limits that right.