Privacy Policy

1. Who we are

The passmed.ca website is operated by Passmed Pte. Ltd. ("Passmed", "we", "us"). For all data protection matters, contact us at support@passmed.com.

This Privacy Policy is governed by Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Where applicable, we also comply with substantially similar provincial privacy legislation, including Alberta's Personal Information Protection Act (PIPA), British Columbia's Personal Information Protection Act (PIPA), and Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25 / Loi modernisant des dispositions législatives en matière de protection des renseignements personnels). For Ontario residents whose data we process in a personal-health context, we also follow the relevant requirements of the Personal Health Information Protection Act (PHIPA). "Personal information" has the meaning given to it in PIPEDA.

2. What we collect

When you create an account: your name, email address, password (stored hashed - we never see your actual password), and (optionally) profession, country of medical qualification, and target exam sitting date.

When you use the service: your question attempts, scores, time spent, flagged questions, performance analytics, and progress data. This is necessary for the platform to function.

When you subscribe: your billing email and subscription details. Your card details are collected and processed by Stripe (our payment processor); we never receive or store full card numbers.

Automatically: your IP address, browser type, device type, referring page, and pages visited on our site. We use this for security, fraud prevention, and to understand which features are used.

If you contact us: the contents of any email, message, or support ticket you send us.

3. Why we use it

To provide the service: serving questions, saving your progress, showing analytics, processing payments, sending transactional emails (account, subscription, refund).

To improve the service: anonymised, aggregated usage statistics to understand what's working and what isn't.

To communicate with you: transactional emails (account, subscription, trial ending, payment receipts) and, if you have opted in or purchased a paid plan, occasional product update emails about features and content. You can unsubscribe from product update emails at any time via the link in any email or from your account settings.

For security and fraud prevention: detecting unauthorised account access, credential sharing, or fraudulent payments.

To comply with legal obligations: including retention of payment and tax records under Canadian tax compliance requirements.

4. Fair Information Principles (PIPEDA Schedule 1)

We handle your personal information in accordance with the ten Fair Information Principles in Schedule 1 of PIPEDA:

(1) Accountability: We are responsible for personal information under our control. Our Privacy Officer can be reached at support@passmed.com.

(2) Identifying Purposes: We identify the purposes for which personal information is collected at or before the time of collection.

(3) Consent: We obtain your knowledge and consent before collecting, using, or disclosing personal information, except where permitted or required by law.

(4) Limiting Collection: We collect only personal information that is necessary for the purposes identified.

(5) Limiting Use, Disclosure, and Retention: Personal information is used or disclosed only for the purposes for which it was collected, except with your consent or as required by law. We retain personal information only as long as necessary.

(6) Accuracy: We keep personal information as accurate, complete, and up to date as is necessary for the purposes for which it is used.

(7) Safeguards: Personal information is protected by safeguards appropriate to its sensitivity. See section 9.

(8) Openness: Information about our policies and practices relating to the management of personal information is readily available - this Privacy Policy is our primary openness document.

(9) Individual Access: You can request access to your personal information and challenge its accuracy. See section 8.

(10) Challenging Compliance: You can challenge our compliance with these principles by contacting our Privacy Officer at support@passmed.com.

5. Who we share with

We share your personal information only with service providers necessary to operate Passmed, including:

(a) Stripe - payment processing
(b) Brevo - transactional email delivery
(c) Google Cloud / AWS - hosting and infrastructure
(d) Cloudflare - DDoS protection, CDN, and security
(e) Analytics providers - aggregated usage statistics (with IP anonymisation)

Each provider is bound by a data processing agreement and processes your data on our instructions only.

We may also disclose personal information where required by law, court order, or regulatory authority, or where reasonably necessary to protect our rights, your safety, or the safety of others.

We never sell your personal information to third parties.

6. Cross-border disclosures

Passmed is operated from Singapore, and our service providers are based in multiple countries including Singapore, the United States, the European Union, and Canada. Where we disclose personal information overseas, we comply with PIPEDA by using contractual safeguards (data processing agreements) to ensure the overseas recipient maintains an equivalent level of protection. Where data is transferred to a jurisdiction with materially different privacy laws, we will inform you and seek your consent where required.

7. How long we keep it

Account data: while your account is active, plus 12 months after closure (for support and legal purposes).
Question attempt data: while your account is active, plus 6 months.
Anonymised aggregate data: indefinitely.
Payment records: 5 years (in line with Canadian federal and provincial tax compliance requirements under the Income Tax Act (Canada) and Excise Tax Act (Canada)).
Support correspondence: 3 years from last contact.

8. Your rights under PIPEDA

You have the right to:

(a) request access to the personal information we hold about you;
(b) request correction of inaccurate, out-of-date, incomplete, or misleading personal information;
(c) opt out of direct marketing at any time;
(d) withdraw consent for the collection, use, or disclosure of your personal information (subject to legal or contractual restrictions and reasonable notice);
(e) lodge a complaint about how we have handled your personal information.

To exercise any of these rights, email support@passmed.com. We aim to respond within 30 days. We may need to verify your identity before acting on access or correction requests. In limited circumstances we may decline requests that are unlawful, frivolous, vexatious, unreasonably repetitive, or that would unreasonably impact the privacy of others.

If you are not satisfied with our handling of your personal information, you can lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca.

9. Security

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. These include encryption in transit (TLS 1.2+) and at rest, hashed password storage, access controls and audit logging on our systems, and ongoing security testing. However, transmission over the internet is not completely secure - we cannot guarantee absolute security and you transmit information at your own risk.

10. Notifiable data breaches

If a data breach occurs that is likely to result in serious harm to any data subject, we will notify the Office of the Privacy Commissioner of Canada (OPC) and affected individuals as required by section 10.1 of PIPEDA (Breach of Security Safeguards reporting). We will also keep a record of every breach of security safeguards as required by subsection 10.3(1).

11. Cookies & local storage

We use cookies and similar technologies for:

(a) Essential cookies - keeping you logged in, remembering your subscription state. These cannot be disabled without breaking the service.
(b) Functional cookies - remembering your preferences (theme, last-viewed topic).
(c) Analytics cookies - understanding aggregate site usage (via Google Analytics with IP anonymisation). Only set after you give consent.

You can manage your consent at any time via the cookie settings link in the footer. We may also use browser local storage to cache content for offline access.

12. Children

Our service is not directed at and we do not knowingly collect personal information from anyone under 18. By creating an account, you confirm you are 18 or older. If you believe we have collected information from someone under 18, please contact support@passmed.com immediately and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email to all account holders at least 30 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.

14. Contact us

Questions about your data, or to exercise any of your rights? Email us at support@passmed.com.