Privacy Policy

Effective Date: August 18, 2026 · Last Updated: August 18, 2026

MedEdPrep, LLC, a Georgia limited liability company (“MedEdPrep,” “we,” “us,” or “our”) operates the MedEdPrep student testing platform at student.mededprep.com (the “Service”). The Service is a test preparation and exam delivery platform used by individual learners and by students of educational institutions — including colleges, technical colleges, EMS education programs, and high school career and technical education programs — to prepare for and take medical education assessments.

An account may include both individually purchased products and institution-administered assessments. This Privacy Policy applies to each record according to its type: records you create through a direct purchase are your individual consumer records, and institution-administered assessment records (such as unit exams, exit exams, and assigned homework) are education records controlled by your institution (your “Institution”), which we process and store on the Institution’s behalf as a service provider.

This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and what choices you have. We are committed to protecting the privacy of our users, particularly students whose records are managed on behalf of an educational institution.

The short version: We collect only what we need to run the Service — your account details, your exam and study activity, and (for paid individual accounts) billing handled by Stripe. We do not sell your data. We do not use student data for advertising. We do not send student personal information to third-party AI services or use it to train generative AI models. Exam sessions are monitored for integrity. We share your data only with your institution (if you use the Service through one), and with the service providers who help us operate the platform.

Information We Collect
How We Use Your Information
How We Share Your Information
Educational Records and FERPA
Data Security
Children’s Privacy
Cookies and Tracking
Data Retention
Your Rights
International Data Transfer
Governing Law
Changes to This Policy
Contact Us

1. Information We Collect

Information you or your institution provide

Account information: First and last name, email address, and — depending on how your account was created — mailing address, phone number, education level, and school or program affiliation.
Institution-provisioned accounts: If your Institution or instructor created your account, they provide your name, email address, program or cohort assignment, and any exam accommodation settings (such as extended testing time) that your Institution has authorized for you. Accommodation settings are treated as confidential: they are visible only to personnel with a need to know and are used solely to deliver the accommodation your Institution has authorized.
Billing information (individual paid accounts): If you purchase a subscription or product directly, payment is processed by Stripe. Card details are collected and stored by Stripe — we retain only a payment reference, not your card number.

Information generated by your use of the Service

Exam and study activity: Exam attempts, answers, scores, domain-level performance, adaptive exam progression, homework submissions, and survey or questionnaire responses.
Exam-session monitoring: Exam sessions are monitored and analyzed for exam integrity, including session timing and interaction patterns. See Section 2 and Section 8.
Reports: Score reports and progress reports generated from your activity, available to you and — for institution-managed accounts — to your instructors and program administrators.

Information collected automatically

Device and browser information: Browser type and version, device type, and operating system, used for compatibility and security.
Usage data: Pages visited, features used, and interaction patterns (first-party click and usage logging used to operate and improve the Service).
Network information: IP address, used for security and abuse prevention.

Information we do not collect

Patient health information: The Service holds education and assessment records, not patient records. It is not used to deliver, bill for, or document clinical care. We do not request or require patient information; do not submit it through the Service.
Card numbers: Payment card details are held by Stripe, not by MedEdPrep.

2. How We Use Your Information

We use the information we collect to:

Provide the Service: Deliver practice and certification-preparation exams, score and report results, track study progress, and apply institution-authorized exam accommodations.
Support your institution: Make student progress and results available to the instructors and administrators of the program you are enrolled in.
Process payments: Complete purchase transactions for individual paid accounts via Stripe.
Communicate with you: Send account-related and transactional email such as registration confirmations, password resets, exam notifications, and receipts.
Improve the Service: Analyze usage in aggregate to fix problems and improve features.
Maintain security and exam integrity: Detect and prevent unauthorized access, and monitor and analyze exam sessions — including session timing and interaction patterns — to protect the integrity of assessments.

Artificial intelligence and automated analysis: We do not transmit student personal information to third-party AI services, and we do not use it to train generative AI models. AI-assisted analysis — including exam-integrity review and assessment analytics — runs on systems under MedEdPrep’s control. We use student responses to deliver and score assessments, including statistical (psychometric) models that calibrate question difficulty, estimate ability, and generate readiness indicators as part of the Service. Question and platform improvement uses de-identified and aggregated data.

Marketing communications: We do not use student data managed on behalf of an educational institution for marketing or advertising, and we do not advertise to students through the Service. Individual consumer account holders may occasionally receive promotional email about MedEdPrep products; you can opt out at any time using the unsubscribe link in any such email or by contacting [email protected].

Our role: When you use the Service through an educational institution, we act as a service provider on behalf of your Institution and use institution-managed records only for the educational purposes the Institution has authorized. For individual purchases, we use your information to provide the products and services you bought and to operate the platform, as described in this Policy.

We do not use your data to build advertising profiles. The Service does not serve ads, and we do not sell, rent, or trade your personal information to advertisers or data brokers.

3. How We Share Your Information

We share your information only in the following limited circumstances:

With your institution: If you use the Service through an educational institution, your program administrators and instructors can view your exam results, progress, and related records as part of supervising your education. This is the core educational purpose of the Service.
With service providers (subprocessors): We use a limited number of third-party services to operate the platform:
- Cloud infrastructure (AWS, US-East-1): Application hosting, database, and file storage.
- Managed hosting and infrastructure services (Unified Infotech): Platform infrastructure management, maintenance, and backup administration.
- Payment processing (Stripe): Payment collection and subscription billing for individual paid accounts.
- Email delivery (SendGrid): Transactional email delivery.
- Bot protection (Google reCAPTCHA): Abuse prevention on public forms.
- Notifications (Google Firebase): Application notifications.
- Image delivery (ImageKit): Image hosting and transformation.
- Video hosting (Vimeo): Course video content delivery.

These providers access data only as needed to perform their services for us and are bound by contractual confidentiality obligations. Google reCAPTCHA and Vimeo process the data they receive through their embedded components under their own privacy policies. Survey and questionnaire pages are rendered using SurveyJS, a licensed software component that runs within the Service; SurveyJS is not a recipient of your data — your survey responses are stored by MedEdPrep.

When required by law: We may disclose information in response to a valid legal process such as a subpoena, court order, or government request. Where the legal process concerns institution-managed education records, we will notify the Institution before complying unless we are legally prohibited from doing so.
In aggregated or de-identified form: We may share aggregated statistical data (for example, pass rates or item performance) for research or reporting. We de-identify this data so that it is not reasonably capable of being linked to any individual, and we do not permit recipients to attempt re-identification.
Business transfers: In the event of a merger, acquisition, or sale of substantially all assets, your data may be transferred. We will notify affected institutions and users as and when permitted and required by law before any such transfer takes effect, and any successor will be bound by this Privacy Policy with respect to previously collected information.

We do not sell your personal information, and we do not share it with third parties for their own marketing or advertising purposes, including data brokers and cross-context behavioral advertising.

4. Educational Records and FERPA

When the Service is used through an educational institution, student exam records, scores, and progress data may constitute “education records” under the Family Educational Rights and Privacy Act (FERPA). In that context:

Your institution controls its education records. MedEdPrep processes and stores this data on the Institution’s behalf as a service provider, under the Institution’s direction.
School official exception: MedEdPrep is prepared to operate as a “school official” with a legitimate educational interest under 34 CFR 99.31(a)(1), subject to the Institution’s designation. We use education records only for the educational purposes authorized by the Institution and under the Institution’s direct control.
Limited disclosure to subprocessors: Education records may be disclosed to the subprocessors listed in Section 3 solely for the purpose of operating the Service and under written contractual restrictions prohibiting further re-disclosure.
No independent contact: We do not independently market to students or use education records for purposes unrelated to the educational services we provide.
Who holds FERPA rights: For students in K-12 programs (including high school career and technical education programs), FERPA rights — including the rights to inspect records and request amendments — belong to the student’s parent or guardian until those rights transfer to the student under FERPA. For students in post-secondary programs, those rights belong to the student as an “eligible student.” In both cases, FERPA rights are administered through your educational institution: contact your registrar or program director for FERPA-related requests.
Legal process: If we receive a subpoena or other legal demand for institution-managed education records, we will notify the Institution before complying unless we are legally prohibited from doing so.
Surveys (PPRA): For surveys administered by an Institution through the Service, the Institution is responsible for any notice and consent required under the Protection of Pupil Rights Amendment (PPRA) and applicable state law. MedEdPrep does not use survey responses for marketing.
Institutional agreements: If your institution requires a FERPA compliance addendum, data processing agreement (DPA), or data-sharing agreement, contact us at [email protected]. We are prepared to execute institutional agreements as needed.

Order of precedence: If MedEdPrep has signed a data processing agreement or other written agreement with your Institution, that agreement controls over this Privacy Policy for that Institution’s data to the extent of any conflict.

5. Data Security

We implement technical and organizational safeguards appropriate to the data we hold, including:

Encryption in transit: Data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
Password security: Passwords are stored using industry-standard salted password hashing. We never store or have access to your plain-text password.
Session protection: Session cookies are encrypted and HTTP-only, requests are protected against cross-site request forgery, and each account is limited to a single active session at a time.
Role-based access: Administrator, instructor, and student roles are enforced so users see only what their role requires; students cannot access other students’ records.
Payment isolation: Card data is tokenized and held by Stripe; MedEdPrep never stores card numbers.

No system is perfectly secure. If we confirm a security breach that affects your personal information, we will provide notice without unreasonable delay and as required by applicable law. For institution-managed records, we notify the affected Institution and support the Institution’s own notification duties to its students; direct notice from MedEdPrep applies to individual consumer accounts. Institutional agreements may specify faster institution-facing notification windows.

6. Children’s Privacy

The Service is designed for adult learners and for students enrolled in authorized educational programs, including high school career and technical education programs whose students may be minors.

The Service is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13 in compliance with the Children’s Online Privacy Protection Act (COPPA). Minor students may use the Service only when authorized by their educational institution; institutions enrolling minors are responsible for obtaining any required parental or guardian consent under applicable state law and institutional policy.

If you believe we have inadvertently collected information from a child under 13, contact us at [email protected]. We will promptly delete or de-identify it; where the information is part of an institution-managed record, we will coordinate with the Institution to do so.

7. Cookies and Tracking

The Service uses:

Essential session cookies: Secure, encrypted, HTTP-only cookies that keep you logged in. These are required for the platform to function.
Bot protection: Google reCAPTCHA on public-facing forms.
First-party usage logging: We log feature usage and page interactions within the Service to operate and improve it. This data stays with MedEdPrep.

We do not use advertising cookies and we do not sell usage data to advertisers.

Do Not Track: The Service does not track users across third-party websites and does not use behavioral advertising. Because we do not engage in cross-site ad tracking, we do not respond to Do Not Track (DNT) browser signals — there is no such tracking to disable.

8. Data Retention

Active accounts: We retain your data for as long as your account is active and, for institution-managed accounts, as long as your institution maintains its relationship with MedEdPrep.
Generated export files: Report and export files generated through the Service are automatically deleted 30 days after generation.
Exam-integrity records: Records of exam-integrity investigations are retained for five (5) years, or as directed by the Institution for institution-administered exams.
Deletion requests: On a verified deletion request, we will remove or de-identify your personal information in active systems, except for records your institution is required to retain for educational or accreditation purposes, records needed to comply with legal obligations, and data subject to legal holds. Assessment response data is retained in de-identified form to preserve the statistical validity of exam questions; once de-identified, it is no longer associated with you. See Section 9.
Backups: Backup copies may persist for a limited period after deletion from active systems before being overwritten in the ordinary course.

Institution-managed records: For records submitted or managed by an institution, MedEdPrep processes this data on the Institution’s behalf. Requests regarding institution-managed records are routed through the Institution, which controls the records it manages. See Section 9.

9. Your Rights

You have the right to:

Access: Request a copy of the personal information we hold about you.
Correction: Request correction of inaccurate or incomplete personal information.
Deletion: Request deletion of your account and associated personal data, subject to the retention constraints described in Section 8. Deleted assessment response data is retained only in de-identified form, as described in Section 8.
Data portability: Request your data in a commonly used, machine-readable format.

To exercise any of these rights, email [email protected]. We will respond to verified requests within 30 days where practicable and in any event as required by applicable law.

Institution-managed records: If your request concerns education records managed by your Institution, we will forward the request to the Institution within 5 business days and support the Institution’s response. We do not delete education records without the Institution’s authorization; FERPA access and amendment rights for those records are exercised through your Institution as described in Section 4.

10. International Data Transfer

The Service is hosted in the United States (AWS US-East-1). If you access the Service from outside the United States, your data will be transferred to and processed in the United States. By using the Service, you acknowledge this transfer.

11. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the State of Georgia, United States, without regard to conflict of law principles. Nothing in this section limits your rights under applicable mandatory data protection laws in your jurisdiction.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. If we make material changes, we will notify you at least 14 days before the changes take effect, by email or through a prominent notice within the Service. Material changes affecting an active institutional agreement do not degrade that agreement’s terms without the Institution’s consent. Your continued use of the Service after a change takes effect constitutes acceptance of the updated policy, except where applicable law requires additional consent before materially different data practices take effect.

13. Contact Us

If you have questions about this Privacy Policy, need help exercising your rights, or want to discuss FERPA compliance or a data processing agreement for your institution:

MedEdPrep, LLC
338 Leggett Rd, Dallas, Georgia 30157
Email: [email protected]
Telephone: (470) 300-0090

We aim to respond to all inquiries within 30 days.