Privacy Policy
Version 2026-10-25 · Last updated 25 October 2026 · Effective immediately
1. Who we are
MEDOST (medost.app) is an AI study companion for medical students, run by the MEDOST team in India. For your personal data we are the Data Fiduciary: we decide why and how it is used. Privacy and grievance contact: [email protected].
2. What we collect, and why
| Data | Why we use it |
|---|---|
| Email address; password (held only as a secure hash by our sign-in provider — we never see it); optional name | To create your account, sign you in and send account emails (receipts, renewal notices, replies to you). Study tips and offers only if you tick that separate, optional box |
| Study profile: target exam, year, preferences; optional display name and college | To fit answers to your exam; to show you on leaderboards and in the community (only if you choose a display name — never your email) |
| Your questions, chats and the answers; files, photos and voice you send | To answer you. Chats are saved to your account so they appear on your devices (you can switch this off). Attached files are read on your device; only the pages needed for an answer are sent. Photos and voice are processed to answer you and not kept by MEDOST |
| Practice results: quiz answers, marks, viva scores, revision cards | Your Readiness Score, revision plan and progress |
| Payments: plan, amount, date and Razorpay's payment reference | To give you your plan, send receipts and keep the accounts the law requires. Card, UPI and bank details go to Razorpay only; we never see them |
| Feedback, community posts and messages to support | To reply to you, improve MEDOST and run the community |
| When you last used the app; device type; network address (briefly, for security) | To keep the service safe (rate limits, abuse), and to know which features help |
| Notification subscription (only if you turn notifications on) | To send the notifications you asked for |
| Your consent choices: what you agreed to, which version, and when | To show what you agreed to and when, as the Act asks of us |
How we ask. You give consent with separate ticks, none of them ticked for you: one for the Terms of Service, one for this policy (both needed to use MEDOST), and an optional one for study tips and offers by email. Saying no to emails never limits the app. Each tick, and each time you withdraw, is recorded with its date and time.
We process this data on the basis of your consent, given when you sign up and accept this policy, and for the legitimate uses the Act allows (for example, keeping payment records that tax law requires). We do not use your data for advertising, and we do not sell or rent it to anyone.
3. AI processing — please read
Answers are written by AI models from these providers, who receive the text (and any image or file pages) needed for each answer:
- Google Gemini — writes most answers and reads attached files and photos; for questions about things that change, it also searches Google. While MEDOST uses Google's free tier, Google may use what is sent to improve its products, and it may be reviewed by people.
- Groq, OpenRouter and Cloudflare — backup AI models, voice-to-text (Groq).
- Tavily and other medical sources (Europe PMC, ClinicalTrials.gov, openFDA) — searched with a few topic words from your question (never your name or account) to cite current sources.
4. Who else handles your data
We use trusted service providers (Data Processors) who handle data only to run MEDOST for us:
| Provider | What for |
|---|---|
| Supabase | Database and sign-in |
| Render | MEDOST's server |
| Netlify | The website |
| Google, Groq, OpenRouter, Cloudflare, Tavily | AI answers, voice-to-text and search (section 3) |
| Razorpay | Payments |
| Resend | Emails (receipts, account messages, and study tips if you said yes) |
| Google, Apple and Mozilla push services | Delivering notifications, if you turn them on |
| GitHub | Encrypted backups of the database |
| Google (Fonts and site icons) | The website's lettering, and the small icons next to sources; your browser fetches these from Google, which sees your IP address |
Some of these providers process data outside India (for example in the United States or the EU), which the Act permits unless the Government restricts a country. We also share data when the law requires it, for example with courts or regulators.
5. How long we keep it
- While your account is active, we keep your data so MEDOST works for you.
- If you delete your account, your account, chats, notes, progress and posts are deleted straight away. Your consent record goes with them. Encrypted backups that may still contain them are replaced within 30 days.
- Unused accounts: if you don't use MEDOST for 24 months, we email you, and if you still don't sign in within 30 days, we delete the account.
- Payment records are kept, without the link to your account, for as long as tax law requires (up to 8 years).
- Security records (such as sign-in and error logs) are kept only as long as needed for security and as the law requires.
6. Your rights
Under the DPDP Act you have the right to:
- Access — a summary of your data and how it is used. Use Account → Data → Download my data, or write to us.
- Correction and updating — change your profile in the app, or ask us.
- Erasure — Account → Data → Delete my account, or ask us.
- Withdraw consent at any time, as easily as you gave it: switch off chat syncing or notifications in the app, turn off Account → Emails → Study tips and offers (or use the unsubscribe link in any of those emails), or delete your account. Withdrawing doesn't affect what was done before.
- Nominate someone to use these rights for you if you die or can't act yourself — write to us.
- Grievance redressal — write to [email protected]. We acknowledge within 24 hours and reply within 30 days at most.
- Complain to the Data Protection Board of India if you are not satisfied with our reply.
7. Children
MEDOST is for people aged 18 and over; you confirm this when you sign up. We do not knowingly process data of anyone under 18. If we learn that we have, we delete it.
8. Security
We protect your data with encrypted connections (HTTPS), access rules that let each student see only their own data, two-step sign-in for administrators, security headers, automatic checks for leaked keys and weak software, and encrypted backups. If a data breach ever affects you, we will tell you and the Data Protection Board without delay, with what happened and what you can do.
9. Cookies, storage and notifications
We don't use advertising or tracking cookies. Your browser stores your sign-in, settings and (if you choose) chats and attached files on your device. If we measure visits, we use a cookie-free tool that counts pages without identifying you. Notifications are sent only if you allow them, and you can turn them off in your browser or phone settings.
10. Changes to this policy
When we change this policy in a way that matters, we update the version above and ask you to accept it again in the app before you continue. Older versions are available on request.
11. Contact
Privacy, data requests and grievances: [email protected] (write "Privacy request" in the subject) · Help centre · Contact page