Privacy Notice

Personal data we collect and why

• Account data (email address, password credentials handled by our auth provider, display name, sign-in provider such as Google) — to create and secure your account. Legal basis: performance of our contract with you.
• Application content (schools, deadlines, stages, priorities, secondary essay prompts and drafts, Brain Storm and advisor notes, MCAT/GPA figures and home state you choose to enter) — to provide the tracker, sync it across your devices and generate your analytics and match scores. Legal basis: contract performance.
• Community content (chat messages, reports you submit) — to run the chat room and moderate it. Legal basis: contract performance and our legitimate interest in a safe community.
• Connected Google data (calendar events we create, and metadata from secondary-application emails you ask us to scan) — only if you connect Google Calendar or Gmail, and only to create deadline reminders and suggestions. Legal basis: your consent, withdrawable by disconnecting the integration.
• Purchase and entitlement data (plan, purchase and expiry records, transaction identifiers from Paddle) — to give you what you paid for. Legal basis: contract performance and legal obligation.
• Technical and usage data (IP address, device and browser information, log and error data, basic usage events) — for security, abuse and spam prevention, troubleshooting and improving the product. Legal basis: legitimate interests.
• Support messages you send us — to answer you. Legal basis: legitimate interests.

Payment card details are collected and processed by Paddle, not by us; we never see or store your full card number.

Who we share data with

• Service providers / subprocessors: our hosting, database and authentication platform (Lovable Cloud, backed by Supabase infrastructure), and any error-logging or push-notification service we use to run the app.
• Merchant of Record: Paddle.com, which handles the sale of our products, subscription management, payments, invoicing, tax compliance and refunds.
• Google, where you have connected Calendar or Gmail, strictly to perform the actions you have authorised.
• Professional advisers (legal, accounting) and authorities where we are required to disclose by law.

We do not sell your personal data or your essays, and we do not use your essays to train AI models for other users.

AI and machine learning

Rounds Med App does not use your content to train, fine-tune or improve any artificial intelligence or machine-learning model — not ours, and not a third party's. This covers everything you store in the app, including personal statements, secondary essays and prompts, brainstorms, advisor and interview notes, to-do checklists, recommender details, school lists, deadlines and chat-room posts.

The app does not send the content you write to any AI model provider. Your writing is stored in your browser and in your private cloud backup so you can access it across devices, and it is transmitted only to deliver the features you ask for (for example, creating a calendar event or sharing a folder with a person you choose).

If we ever introduce an optional AI-powered feature, it will be clearly labelled, off by default, and will only process the specific content you submit to it for that request — we will still never allow your content to be used for model training.

Where your data is processed

Rounds Med App is operated from Utah, United States and your data is stored and processed there by our hosting and database providers. If you access Rounds Med App from outside the United States, you understand your data will be transferred to and processed in the US. Where a transfer out of the UK or EEA is involved, our providers rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

Google account integrations (Limited Use)

If you connect Google Calendar or Gmail, Rounds Med App's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Google Calendar access only to create and update the deadline, priority and action-item events you ask for, and Gmail access only to identify secondary-application messages so we can suggest schools to add. We never sell this data, use it for advertising, use it to train generalised AI models, or allow humans to read it except with your explicit consent, for security or abuse investigation, or where required by law. You can disconnect at any time in Rounds Med App settings or revoke access at myaccount.google.com/permissions; we then stop accessing your Google data and delete the stored credential.

Retention

We keep your account and application content for as long as your account is active. If you delete your account, we delete or anonymise your content within 30 days, except records we must keep longer for legal, tax or fraud-prevention reasons (purchase records are typically retained for up to 7 years). Chat messages and moderation records may be kept while needed to enforce our terms. Logs are kept for a short period, normally under 90 days.

Your rights

Depending on where you live, you have rights to access, correct, delete, restrict or object to our processing of your data, to portability (you can export your applications to Excel or PDF at any time inside the app), and to withdraw consent for optional integrations. If you are in the UK or EEA, you can also complain to your supervisory authority. To exercise any right, email contact@roundsmedapp.com — we respond within 45 days (or within one month if UK/EEA rules apply), and we will not discriminate against you for exercising a privacy right.

US state privacy rights (California and other states)

We do not sell your personal information and we do not share it for cross-context behavioural advertising as those terms are defined under the California Consumer Privacy Act and similar state laws, and we have not done so in the preceding 12 months. We also do not use or disclose sensitive personal information for any purpose other than providing the service you asked for.

If you are a resident of California, Colorado, Connecticut, Virginia, Texas, Oregon or another state with a comprehensive privacy law, you may request to know what personal information we hold, request a copy, request correction or deletion, and appeal a refused request. You may use an authorised agent. Email contact@roundsmedapp.com with the subject line "Privacy request"; we verify requests using the email address on your account.

Children

Rounds Med App is not directed to children. You must be at least 13 years old to create an account, and we do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has given us personal information, email contact@roundsmedapp.com and we will delete the account and its data.

Your data is private to you

No one outside of your own account can see your applications, secondary essay prompts and responses, Brain Storm and advisor notes, MCAT/GPA figures, deadlines, reminders or any other data you enter in Rounds Med App. Every record you create is stored against your user ID and protected by database row-level security rules that only ever return rows belonging to the signed-in owner. Signed-out visitors have no database access to this data at all, and other members — including moderators — cannot read it.

The only content other people can see is what you deliberately post in the public chat room, plus your display name there. Moderators can review reported chat messages only; their tooling gives them no access to your applications, essays or notes.

We do not sell your data, and we do not share your application content with schools, advisors, advertisers or any other third party. Sponsored placements in the free plan are static and are not targeted using your data.

Security

We use appropriate technical and organisational measures, including encryption in transit, encrypted storage of integration credentials, row-level access controls so your data is only readable by your own account, and role-restricted moderation tooling. No system is perfectly secure, so please use a strong, unique password.

If a breach affecting your personal data occurs, we will notify affected users and, where required, the relevant regulators without undue delay and in line with applicable law.

Cookies and local storage

We use strictly necessary cookies and browser local storage to keep you signed in, to remember your preferences and to hold an offline copy of your applications on your device. Our checkout provider sets cookies needed to process payments. We do not use advertising or cross-site tracking cookies; the ads shown to free users are not personalised. You can clear cookies and local storage through your browser settings, though this will sign you out.

In the Rounds iOS app we do not use advertising cookies, device identifiers or any other technology that tracks you across apps or websites, and no data is shared with data brokers or advertisers. Because we do not track you on Apple devices, the app shows no cookie prompt and does not request App Tracking Transparency permission.

Contact

Data controller: Rounds Med App, LLC — contact@roundsmedapp.com. Billing enquiries are handled by Paddle at paddle.net.