Legal
Privacy Policy
What we collect, why, and the control you have over it. Last updated 12 October 2026.
What changed on 12 October 2026
On 12 October 2026, this policy changed as follows.
- Study groups (section 2c): we keep which recent group activity you have viewed, while you are a member.
- Reports about your handle (section 7): if we restore your handle after review, the reports are kept but no longer count.
- Cookie Policy: the theme settings now name the Leaderboards tab, your study groups and the question of the day.
The update of 11 October 2026 is listed below.
What changed on 11 October 2026
On 11 October 2026, this policy changed as follows.
- Country leaderboards (sections 2b and 2d): only the “Country for leaderboards” you choose in Settings puts you on a country board, and that is the country others see.
- How we protect it (section 10): where our keys are kept.
- Cookie Policy: the email-change cookies are also cleared when you sign out or delete your account, and the unfinished-quiz item is tagged with your account.
The update of 9 October 2026 is listed below.
What changed on 9 October 2026
On 9 October 2026, this policy changed as follows.
- AWS security records (sections 7 and 9): AWS keeps its own record of account events (your account ID and the time; never your name, email or password) for 90 days, including after your account is erased.
- Sign-ups never activated (section 7): deleted automatically once 30 days have passed since you signed up.
- Deleting by email (section 9): if you ask us by email, we erase your account with no 30-day window to restore it.
- Two legal bases (section 3): counting your first answer to each question in the anonymous difficulty rates, and recording your rating of a UroBot answer, both based on our legitimate interests.
- What we collect (sections 2a and 2f): your account record includes when we recorded that you activated it, and the logs we keep are error and service logs, never with your name or email.
- How we protect it (section 10): our admin page for UroBot ratings and cached questions, the automatic retention jobs and the tools we run to maintain the Service and answer your requests are named among the exceptions to account-only access, and the build check is described as covering our account routes and account libraries.
- Smaller corrections (sections 7 and 8): backups last up to about 7 days, being removed from a group unlinks your challenges just as leaving it does, and a deck someone has already accepted stays with them.
- Terms of Use (section 15): one wording fix about restoring your account.
The update of 7 October 2026, on the community features and UroBot, is listed below.
What changed on 7 October 2026
On 7 October 2026, this policy changed as follows. The community features apply as each one becomes available.
- Community features (sections 2b and 2d): an optional display handle, leaderboards, study groups and share links, all off by default. Where they show who you are, they use your display handle, never your name, username or email address.
- Three new uses (section 3): showing your display handle and scores on the community features you use (legal basis: consent, which you can withdraw at any time), acting on reports about display handles and group names, and keeping leaderboards and group scoreboards fair (legal basis for both: legitimate interests).
- Legal bases (section 3): showing your comments to other users and sending a deck you share, with your email address, are based on your consent, and the anonymous answer distributions on our legitimate interests.
- Records of your choices (sections 2d, 3 and 7): from the day the community features become available, when you accept the Terms or turn a community feature on or off, we record what you chose, when, and which versions were in force.
- Study activity (section 2c) now lists XP, levels, Prestige, milestones, the milestone you choose to show on your emblem, the dates you finished or skipped the study-plan setup and the tour, the date you dismissed the study-plan prompt, the study plan’s two switches, and the Daily MCQ set picked for you each day.
- Community answer counts (sections 2c and 2d): question difficulty rates update only in steps of 20 first answers, answer distributions appear only once a question has 20 answers, the rating spread under a flashcard only once 20 people have rated it, and section 2d says when one person’s answer or rating could still be worked out.
- UroBot (sections 2e, 3, 4 and 5): a fuller account of what goes to Google with your question.
- Who processes your data (sections 4, 5 and 6): Google processes UroBot questions under its terms for paid API use and may keep them for up to about 55 days to detect abuse, during which Google staff may review a flagged question; Resend keeps account emails in the United States for 30 days; section 5 says our contact address is a Gmail account; and section 6 explains transfers out of Saudi Arabia.
- Sign-up attempts (section 2f): the email address you entered is recorded with your IP address, briefly, to rate-limit automated abuse.
- Keeping and deleting (sections 7 and 9): how long community data is kept, and what deleting your account does to it. When your account is erased, a group you own passes to another member or is deleted. Leaving a group takes your decks out of it. Section 7 also says how long we keep server logs (about 30 days), UroBot daily question counts, emails you send us about your data and sign-ups never activated.
- Sections 5, 9 and 10: section 5 lists the community features among the ways your data reaches other people, section 9 says your comments are erased with your account, and section 10 names the two exceptions to account-only access (the section 2d features and our moderation tools), describes the build check exactly, and says we tell you about a breach without undue delay if it could harm your data, rights or interests.
- Your rights (section 8): a right to compensation, and how to withdraw consent for leaderboards, groups and share links.
- Age (section 11): you must be at least 18 to hold an account, and we say what happens to an account of someone under 18.
- Changes to this policy (section 12): we tell you about a material change before we start using your data in the new way.
- Terms of Use: a new section on the community features, a line on the copies people make of decks you share or add to a study group, a line saying the readiness estimate is a study aid, not a prediction of any exam result, a minimum age of 18, and how we tell you about a change.
The update of 3 October 2026, on personalized practice and a readiness estimate, is listed below.
What changed on 3 October 2026
On 3 October 2026, this policy added the following, applied as each feature becomes available.
- Study activity (section 2) also includes:
- the time you spend answering each question or card;
- your study plan (exam date, daily targets, focus topics), if you set one;
- streaks and streak freezes, XP, levels and badges calculated from your activity;
- in-app reminders and their settings.
- Your time zone, which we already read from your browser for Daily Review, sets your study day across the Service.
- A new purpose (section 3): personalizing your study, meaning which questions come up, a labeled readiness estimate, and weak-topic views that build on the ones you see today, from your own activity and anonymous question difficulty rates. Legal basis: contract.
- Question difficulty rates: anonymous counts of each person’s first attempt at each question. They carry no identity, are never shown for fewer than 20 answers, and are kept after an account is erased. They are separate from the answer distribution in section 2d.
- Personalization stays inside the Service (sections 3 and 4): these sections no longer say we do not profile you, and the short version and section 4 now say “web analytics” where they used to say “analytics”. Instead, we analyze your own study history only to personalize your study inside the Service. It is never used for advertising, never shared or sold, and never produces decisions about you outside the Service.
- How long we keep it (section 7): this data is kept while your account exists and erased with it.
This policy explains what UroCompanion (the “Service”) collects about you, the legal basis for each use, who else touches it, how long we keep it, and the rights you can exercise. It sits alongside our Terms of Use and Cookie Policy. We have written it to be read, not to be survived — where a term has a legal meaning, we say what it means in plain words.
The short version
- You can read almost the entire Service without an account. Most of what follows applies only if you choose to sign up.
- We never sell or rent your personal data, never share it for advertising, and run no advertising, tracking, or web analytics of any kind.
- We collect what the study features need to work, and nothing we cannot justify to you in the table below.
- Leaderboards, study groups and share links are optional and off by default. Where they show who you are, they use a display handle you choose, never your name, username or email address.
- You can delete your account yourself from your settings, at any time, without asking us.
- We do not ask for, and you should never enter, information about real identifiable patients.
1. Who is responsible for your data
UroCompanion is provided by Mohammed Abunayan, operating from Saudi Arabia. Where data-protection law uses the word controller — meaning whoever decides why and how personal data is used — that is us, and we are accountable to you for everything described here.
For any privacy question or to exercise any right below, email urocompanion@gmail.com. A real person reads it.
UroCompanion is used by residents and students in many countries, so rather than granting the minimum any single jurisdiction requires, we apply the stronger EU/UK GDPR standard to everyone, wherever you live. Saudi Arabia’s Personal Data Protection Law (PDPL) also applies to us. Where the two differ, we follow whichever gives you more control.
2. What we collect
Everything below is either given to us by you or generated by your own use of the Service. We do not buy personal data, and we do not build profiles of you from outside sources.
a. Account details — required to sign up
Your name, a username, your email address, a password, and when we recorded that you activated your account. The password is handled by Amazon Cognito and is stored only as a cryptographic hash. We never store it or log it; it passes through our server only to be handed to Cognito. We cannot recover it either: a reset creates a new one.
b. Profile details — entirely optional
Training level, institution, country, city, and a profile photo. Leave any of them blank and the Service works the same. The country here never puts you on a leaderboard: that is the separate “Country for leaderboards” choice in Settings. Your photo is stored in private storage and served only back to you.
c. Study activity — created as you use the Service
Bookmarks and tagged items, in-text highlights, page notes and per-question notes, flashcards you write, your spaced-repetition schedule and review history, question attempts and which answer you chose, personal tests, decks, topic views, your progress statistics and daily review goal, which in-app notices you have dismissed or seen (for study groups, which recent group activity you have viewed, kept while you are a member), and your time zone, read from your browser to set your study day. This exists so the features work and follow you between devices.
It also includes:
- the time you spend answering each question or card;
- your study plan (exam date, daily targets, focus topics, and its two switches: Final review, and adding questions you get wrong to Need to review), if you set one;
- the Daily MCQ set picked for you each day;
- the date you finished or skipped the study-plan setup, and the date you finished or skipped the tour (for accounts made before these existed, the date we marked both done);
- the date you dismissed the study-plan prompt, if you did;
- streaks and streak freezes;
- XP, levels, Prestige and milestones, calculated from your activity, and the milestone you choose to show on your emblem;
- in-app reminders and their settings.
Question difficulty rates are anonymous counts of each person’s first attempt at each question. They carry no identity, are never shown for fewer than 20 answers, update only in steps of 20 first answers, and are kept after an account is erased. They are separate from the answer distribution in section 2d.
d. Things other people can see
These features are shared by design, and it is worth being explicit about each:
- Comments you post on a question or card are visible to other signed-in users and are shown next to your username.
- Answer distributions, the bars showing how others answered a question, count each person’s latest answer, yours included. They appear only once a question has 20 answers, and only ever as aggregate counts, never with your name. The “How others rated this” spread under a flashcard counts each person’s latest rating, also as aggregate counts never shown with your name, and appears only once 20 people have rated the card. Because the counts change as people answer and rate, someone who compares them before and after another person does may be able to work out how that person answered or rated.
- Sharing a deck sends the recipient the deck and your email address, so they can see who sent it. Only share with people you are happy to reveal that to. If that person later adds their copy to a study group, your email address is not shown to the group.
The community features below are optional and off by default, and apply as each one becomes available. Here is what each one shows to other people:
- Display handle. Leaderboards and study groups need a display handle, which you choose and which is separate from your username. They show your handle, never your name, username or email address. Wherever other people see your emblem, on leaderboards, in study groups or on a share card, it shows only your XP level and Prestige, never the milestone you chose for it, and never your training level or institution. Other users can report a display handle or a group name.
- Leaderboards, only if you choose to join them: other users see your display handle, emblem, XP level and Prestige, your board score and your rank, for this week and for all time. Your board score counts only points for correct answers to questions, up to 40 correct answers a day, and streak bonuses at 7, 30, 100 and 365 days. Your XP level and Prestige reflect your lifetime XP, but leaderboards never show the number itself, your accuracy or which milestones you have earned. You appear on the global board and, if you have chosen a country for leaderboards in Settings, on the board for that country, which shows others that country. Turning off “Show me on leaderboards” in Settings removes you within a few minutes.
- Study groups, only the ones you join: the group’s members see your display handle, emblem and XP level, your streak and whether you studied today, your board score this week and all time, how many questions you answered this week, your progress toward the group’s weekly challenges, when you joined, any weekly challenges you set, and any decks you add, which they can view and copy to their own library. From your board score and answer count, members can estimate how many of this week’s answers you got right. Streak freezes count toward the group’s streak, so members may be able to tell when you used one. Anyone with a group’s invite link or code can see the group’s name and how many members it has.
- Share links you create: anyone with the link sees only what is on the card, such as your streak, your readiness estimate or the topic of the day’s question, plus your display handle and emblem only if you choose to include them. You see a preview before you share. A card never shows a question or its answers. You can revoke a link in Settings at any time and it stops working at once, but copies or previews already shared, for example in a messaging app, may remain.
- Your profile photo is never shown to anyone else, on these features or anywhere else on the Service.
- Accounts pending deletion and hidden handles. While your account is pending deletion, you are hidden from leaderboards and study groups within a few minutes, the decks you added to groups are hidden, and your share links stop working. If your display handle is hidden, after reports or by us, you are left out of leaderboards and study groups while it stays hidden, and your share links are revoked; restoring the handle does not bring them back.
Records of your choices. From the day the community features become available, when you accept the Terms, turn leaderboards on or off, join or leave a study group, or create a share link that shows your handle, we record what you chose, when, and which versions of the Terms and of this policy were in force.
e. Questions you ask UroBot
The text of your question is sent to our AI provider to generate an answer, and is stored so we can serve the same answer faster next time. Two consequences you should know about:
- The cached question and answer are shared across all users and stored without any link to your account — the cache records the question, not who asked it.
- Because of that, a question you ask may be shown to other signed-in users in the “popular questions” suggestions, in the wording you typed. So please do not put anything personal, confidential, or patient-identifying into a question.
When you are signed in, up to eight of your own highlights and notes on the pages your question touches go with it, so the answer can build on them, and a follow-up also sends the earlier messages of that chat. Answers that use your notes are never cached or shown to anyone else.
If you rate an answer with the thumbs up/down control, that rating is linked to your account (so you cannot vote twice), together with the question it relates to. We also count how many questions you ask per day to keep the service affordable and to stop abuse.
f. Technical data
Error and service logs (timestamps and errors, never your name or email), generated automatically as the Service runs. We use these to keep the Service running and secure. We also record your IP address and the email address you entered, briefly, against sign-up attempts to rate-limit automated abuse.
g. Cookies and browser storage
Listed individually, with purpose and duration, in the Cookie Policy. There are no third-party cookies on this site. Change your choice at any time via .
h. What we deliberately do not collect
We do not ask for and have no wish to receive: patient-identifiable information, your own health data, payment card details (the Service is free and takes no payments), government ID numbers, or precise location. Please keep clinical notes you write on the Service de-identified.
3. Why we use it, and our legal basis
Under GDPR every use of personal data needs a lawful basis. Here is ours, purpose by purpose, with nothing held back into a catch-all.
| What we do | Data used | Legal basis |
|---|---|---|
| Create and run your account; authenticate you | Account details | Contract: we cannot provide an account without it |
| Save and sync your study work across devices | Study activity, profile | Contract |
| Schedule flashcards and show progress | Review history, attempts | Contract |
| Personalize your study: which questions come up, your weak topics and a labeled readiness estimate | Your own study activity and anonymous question difficulty rates | Contract |
| Answer your UroBot questions | Question text, site content, the earlier messages of that chat, and, when you are signed in, up to eight of your own highlights and notes on the pages your question touches | Contract |
| Cache answers so common questions are fast and cheap to serve | Question and answer text, not linked to you | Legitimate interests: keeping a free service sustainable |
| Show questions people ask as “popular questions” suggestions | Question text, not linked to you | Legitimate interests: helping everyone find common questions |
| Record your rating of a UroBot answer | Your rating and the question it relates to | Legitimate interests: improving answers and stopping repeat votes |
| Show your comments to other signed-in users | Comment text, username | Consent: you choose to post, and you can withdraw it by deleting the comment |
| Show answer distributions and the rating spread under flashcards to other users, as anonymous counts | Your latest answer to each question and your latest rating of each card | Legitimate interests: showing anonymous answer counts that help everyone study |
| Count your first answer to each question in anonymous difficulty rates | Whether your first answer was right, without your identity | Legitimate interests: question statistics that help everyone study |
| Send a deck you share, with your email address, to the person you choose | Deck, your email | Consent: you choose to share |
| Show your display handle and scores on leaderboards you join, in study groups you join, and on share links you create | Display handle, emblem, XP level and Prestige, board score, country (for its leaderboard), the study figures your groups see, decks you add to a group, and what your share cards show | Consent, which you give when you turn on leaderboards, join a study group or choose to show your handle on a share card. You can withdraw it at any time by turning leaderboards off, leaving the group or revoking the link. |
| Keep a record of what you accepted or turned on or off | What you chose, when, the screen used, and the versions in force | Legal obligation and legitimate interests: being able to show what you agreed to |
| Send account emails (activation, password reset, email change) | Email address | Contract |
| Keep the Service secure; prevent abuse and spam sign-ups | Logs, IP address, the email address entered at sign-up, usage counts | Legitimate interests: protecting the Service and its users |
| Moderate reported comments | Comment text, reporter and author account IDs | Legitimate interests: keeping the community usable |
| Act on reports about display handles and group names that break our Terms | The reported handle or group name, the reason given if any, the reporter’s account ID, and the reported account or group | Legitimate interests: keeping the community usable |
| Keep leaderboards and group scoreboards fair, for example by spotting automated answering | Board scores, and the timing and pattern of the answers behind them | Legitimate interests: fair scores for everyone who takes part |
| Fix faults and improve the Service | Error logs, aggregate usage | Legitimate interests |
| Store non-essential preferences on your device | Browser storage | Consent: you can withdraw it at any time |
| Comply with a legal obligation or respond to a lawful request | Whatever the law requires | Legal obligation |
Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights and concluded it is not — the uses are narrow and expected, none of them involve advertising, and the personalization in this section stays inside the Service. You can object to any of them (see section 8) and we will stop unless we have compelling grounds not to.
4. What we never do
- We do not sell, rent, or trade your personal data. Ever, to anyone.
- We do not share your data for anyone’s advertising, and we do not display advertising.
- We run no web analytics, tracking pixels, fingerprinting, or cross-site tracking.
- We make no automated decisions that produce legal or similarly significant effects about you. We analyze your own study history only to personalize your study inside the Service. It is never used for advertising, never shared or sold, and never produces decisions about you outside the Service.
- We do not use your notes, highlights, or questions to train any AI model of our own, and we do not give anyone your study data for that purpose. Answering a UroBot question does require sending it to our AI provider, Google, with the earlier messages of that chat and, when you are signed in, up to eight of your own highlights and notes on the pages it touches. Google processes it as our processor under its terms for paid API use, does not use it to improve its products, and may keep it for up to about 55 days to detect abuse, during which Google staff may review it if its systems flag it. This is the reason we ask you to keep questions free of personal or patient-identifying detail.
5. Who else processes your data
We keep the list of companies with access deliberately short. Each acts as our processor — they may only use the data to provide their service to us, under a written contract, and never for their own purposes.
| Provider | What they do | What reaches them | Where |
|---|---|---|---|
| Amazon Web Services (AWS) | Hosting, database, file storage, and the Cognito identity service that holds your login credentials. | Everything you store with us: account details, study activity, profile photo, and server logs. | Frankfurt, Germany (eu-central-1) |
| Google (Gemini API) | Generates UroBot's answers from UroCompanion's own content. Called from our server, never from your browser. | The text of the question you ask UroBot and the site content used to answer it. When you are signed in, up to eight of your own highlights and notes on the pages your question touches go with it, and a follow-up also sends the earlier messages of that chat. Your name, email, and account identifier are not sent. | Google Cloud infrastructure |
| Resend | Sends account emails — activation codes, password resets, and email-change verification. | Your email address and the contents of that email, kept by Resend for 30 days. | United States |
Our contact address is a Gmail account, governed by Google’s own terms; we delete a request’s emails and any export once it is dealt with.
Beyond those, we disclose personal data only when:
- you use a feature that shows something to other people, as section 2d describes, including share links, which anyone with the link can open;
- the law compels us — for example a valid court order. We will tell you unless legally barred from doing so, and we push back on requests that look overbroad;
- it is necessary to protect the rights, safety, or property of UroCompanion or its users, such as investigating abuse; or
- the Service is ever transferred to a new owner — in which case you will be told beforehand, this policy continues to apply to data already collected, and you can delete your account first if you prefer.
6. Where your data lives, and transfers abroad
Your account and study data are stored in Frankfurt, Germany (the European Union) on Amazon Web Services infrastructure. Because UroCompanion is operated from Saudi Arabia and two of our providers operate globally, your data may be accessed from or processed in countries outside the one you live in.
Where that involves moving personal data out of the EU/UK, the transfer is covered by the European Commission’s Standard Contractual Clauses (or the UK equivalent) in our agreements with those providers, which is the legal mechanism that keeps GDPR protections attached to your data after it leaves. You can ask us for details of a specific transfer.
For users in Saudi Arabia, storing your account in Germany and sending emails and UroBot questions through our providers are transfers outside the Kingdom under the PDPL. We make them because they are needed to provide the account you asked for, and each provider receives only what it needs.
7. How long we keep it
We do not keep personal data “just in case”. Each category has an end.
| Data | Kept for |
|---|---|
| Account and profile details | As long as your account is open. Deleted when you delete your account. |
| Sign-ups never activated | Deleted automatically once 30 days have passed since you signed up, if you have not activated the account, or sooner if you ask us. |
| All study activity — notes, highlights, cards, attempts, progress | As long as your account is open. If we retire the content it belongs to — for example when a question bank is replaced — the activity tied to that content is deleted with it. Deleted when you delete your account. |
| Personalization data: time zone, study plan, the Daily MCQ set picked for you each day, the dates you finished or skipped the study-plan setup and the tour, the date you dismissed the study-plan prompt, streaks and streak freezes, XP, levels, Prestige, milestones, the milestone you choose to show on your emblem, reminders and their settings | As long as your account is open. Deleted when you delete your account. |
| Public profile: display handle, your leaderboard setting, and your country for leaderboards | As long as your account is open. Deleted when you delete your account. |
| Study group memberships | Until you leave the group or are removed from it, or you delete your account. |
| Study groups you own, with their names | As long as you own them. When your account is erased, each group you still own passes to another member or is deleted. |
| Decks you add to a study group | Shown in the group until you or the group owner removes them, you leave the group or are removed from it, or you delete the deck or your account. Copies members made stay in their library. |
| Weekly challenges you set in a study group | Kept with the group while it exists. When you leave the group or are removed from it, or your account is erased, they stay in the group but are no longer linked to you. |
| Reports you make about a display handle or group name | Deleted when you delete your account, or earlier if the reported account or group is deleted. |
| Reports other people make about your display handle | Deleted when your account or the reporter’s account is deleted. If we restore your handle after review, the reports are kept but no longer count. |
| Share links you create | Until you delete your account. Revoking a link stops it at once. |
| Records of your choices | As long as your account is open. Deleted with it. |
| Profile photo | Until you replace or remove it, or delete your account. |
| An account you have asked to delete | Permanently erased once the 30 days after your request are up, unless you asked us by email (section 9). During those 30 days you can restore it by signing back in. |
| Your comments | Until you delete them or delete your account, or until the question or card they are attached to is retired. |
| Cached UroBot questions and answers (not linked to you) | Removed automatically after 180 days without use, unless we keep one deliberately as a suggested question. They carry no account identifier. |
| What UroBot sends to Google with a question (section 4) | Google may keep it for up to about 55 days to detect abuse, even after your account is erased. |
| Your UroBot answer ratings | As long as your account is open, or until the answer they rate is removed or rewritten. |
| UroBot daily question counts | As long as your account is open. Deleted when you delete your account. |
| Anti-abuse rate-limit records | Deleted automatically about 24 hours after the attempt. |
| Server and security logs | Deleted automatically after about 30 days. AWS also keeps its own security record of account events (your account ID and the time; never your name, email or password) for 90 days, including after your account is erased. |
| Emails you send us about your data | Until the request is dealt with, then deleted. |
| Backups | Deleted data can persist in encrypted backups for up to about 7 days before those backups cycle out. It is not restored to the live service. |
8. Your rights
These apply to everyone using UroCompanion, not only people in Europe.
- Access: get a copy of the personal data we hold about you.
- Correction: fix anything inaccurate. Most of it you can edit yourself in your account settings.
- Erasure: have your data deleted. You do not need to ask: delete your account from your settings and it happens automatically.
- Portability: receive your data in a structured, machine-readable format, or have us send it to another provider where technically feasible.
- Restriction: ask us to pause processing while a dispute about accuracy or legitimacy is resolved.
- Objection: object to any processing we base on legitimate interests.
- Withdraw consent: for anything based on consent, withdraw it at any time. For browser storage, use ; for leaderboards, groups and share links, use the same controls section 3 describes (turning leaderboards off, leaving the group or revoking the link); for a comment, delete it. Withdrawing does not undo processing that already lawfully happened, and a deck someone has already accepted stays with them.
- Compensation: ask a court for compensation if a breach of the PDPL causes you harm.
- Complain: to your local data-protection authority. In Saudi Arabia that is the Saudi Data & AI Authority (SDAIA); in the EU or UK, your national supervisory authority. We would rather you came to us first, but it is your right either way.
To exercise any of these, email urocompanion@gmail.com. We reply within 30 days and it costs you nothing. We may need to confirm you are the account holder before acting — a safeguard for you, not an obstacle. We will not treat you differently for exercising a right.
9. Deleting your account
You are in control of this and do not need our permission. In your account settings choose to delete your account and confirm with your password. Then:
- you are signed out on every device within the hour;
- within a few minutes you no longer appear on leaderboards or in study groups, and your share links stop working;
- for 30 days you can undo it by signing back in — a deliberate safety net against a mistaken or impulsive deletion;
- once the 30 days are up, everything is permanently erased: your login, profile, photo, and every note, highlight, card, deck, attempt, and progress record. This cannot be reversed.
Two things deliberately survive in our own systems, and neither identifies you: the anonymous question difficulty rates in section 2c (your answer in the answer distributions is removed), and cached UroBot answers, which were never linked to your account. Your comments are erased with your account. What UroBot has already sent to Google with your questions may stay with Google for up to about 55 days to detect abuse, as section 4 explains. AWS also keeps its own security record of account events, with your account ID but never your name, email or password, for 90 days, as section 7 explains.
Study groups and shared decks leave three more things behind, none of them linked to your account once it is erased: a group you own passes to another member if it has one, a weekly challenge you set stays with its group, and copies other people made of a deck you shared with them or added to a group stay in their library. Your group memberships, reports and share links are erased with everything else.
Prefer not to use the button? Email us and we will erase your account, with no 30-day window to restore it. Want your data first? Ask, and we will send you an export before it goes.
10. How we protect it
No online service can promise perfect security, and we will not pretend otherwise. What we can tell you is specifically what we do:
- Passwords are managed by Amazon Cognito and stored only as hashes — we never hold them.
- Session cookies are httpOnly and cannot be read by any script, so a scripting flaw cannot steal your session.
- Traffic runs over HTTPS, and the connection to the database is TLS-encrypted with certificate verification pinned to a trusted bundle.
- Profile photos live in private storage with no public access; they are streamed back only to the account that owns them.
- Every query for personal data is scoped to the signed-in account, except where a feature in section 2d shows something to other people by design, in the admin tools we use to review reported content and UroBot’s answer ratings and cached questions (shown without your account), in the automatic retention jobs section 7 describes, and in the tools we run ourselves to maintain the Service and answer your requests. An automated check runs on every deployment and refuses to build the site if it finds code in our account routes and account libraries that changes or deletes someone’s personal data without first checking whose account it belongs to, unless the code is an admin-only tool or we have reviewed it and marked it as intended.
- Credentials and API keys are never in the codebase or in anything sent to your browser. The live Service reads them from encrypted storage at our cloud provider (AWS), and our own working copies are kept in an encrypted keychain on our computer.
- Sign-up is rate-limited to blunt automated abuse.
If a breach ever affects your personal data, we will notify the relevant supervisory authority within 72 hours where the law requires it, and tell you directly and without undue delay if it could harm your data or your rights or interests, including what happened and what you should do.
11. Children
UroCompanion is built for medical professionals, trainees, and students, and is not directed at children. You must be at least 18 to hold an account. If we learn that an account belongs to someone under 18, we tell them, offer them a copy of their data, and delete the account within 30 days. If you believe a child has created an account, tell us at urocompanion@gmail.com.
12. Changes to this policy
We update this policy when the Service changes. The date at the top always reflects the current version. If a change is material (a new purpose, a new category of data, a new processor), we will tell you by email or a notice in the Service before we start using your data in the new way, and where the change affects anything you consented to we will ask you again rather than assume.
13. Contact
Questions, requests, or complaints about privacy go to urocompanion@gmail.com. If you are not satisfied with our answer you can complain to your data protection authority, as described in section 8.
UroCompanion is an educational study aid, not medical advice, and is not a clinical system. Do not enter patient-identifiable information anywhere on the Service.