Privacy Policy

• Account details. Your email address, and a display name if you provide one. If you sign in with Google, we receive your email address, name and profile picture from Google, nothing else, and we never receive your Google password.
• Learning data. The cases you attempt, the answers and confidence ratings you give, where you clicked on an image, your scores, bookmarks and progress. This is what makes the dashboard and your streak work.
• AI tutor conversations. Stored only when you are signed in and have consented to conversation history. You can withdraw that consent at any time in your account settings.
• Technical data. Standard server logs, and error reports if error tracking is enabled. We do not use advertising cookies and we do not sell or share data with advertisers.

QSpace and AnkiGen deserve their own explanation, because uploading your notes is the most sensitive thing you can do here.

• Your files are opened and read in your browser. The file itself is never uploaded to our servers.
• To write questions or cards, short excerpts of your material are sent to our AI provider, processed, and used to generate the result. We do not store those excerpts afterwards, and we do not use your material to train any model.
• The generated question bank or deck lives in your browser for the session. Closing the tab discards it, which is why the tools offer an export.

Do not upload material containing patient-identifiable information. These tools are built for lecture notes, textbooks and your own summaries.

We use a small number of processors, and only to run the service:

• Supabase, authentication, database and file storage.
• Vercel, hosting and delivery.
• Google, only if you choose to sign in with Google.
• An AI model provider, for tutor replies and for generating questions and flashcards from the excerpts described above.

We do not sell your personal data. We disclose it otherwise only where we are legally required to.

No patient-identifiable information appears in our case libraries. Every published image passes a documented rights, privacy and medical-review workflow before it is visible, including metadata stripping and, for DICOM, header de-identification, and only approved, de-identified derivatives are ever served. Original files stay in private storage.

• See and correct your profile from your account settings.
• Withdraw AI conversation consent at any time, which stops new conversations being stored.
• Delete your account from your account settings. Deletion removes your personal learning data, attempts, bookmarks, progress and stored conversations, not only your login.
• Download everything we hold about you from your account settings, or email mediverse.space@gmail.com for anything the self-serve controls do not cover.

Depending on where you live you may have additional rights over your data, including access, correction, portability and erasure. Contact us and we will honour them.

We use Vercel Web Analytics to count page views and visitors. It sets no cookies, does not follow you across other websites, and does not build a profile of you. It records the page visited, the referring page, and coarse details such as country, browser and device type. It does not receive your email address, your study material, or anything you type.

We use it to see which parts of the platform are actually used. We do not sell it, and we do not run advertising anywhere on Mediverse.

Accounts, learning history and case content live in a Supabase Postgres database hosted in Canada (Montréal region). The websites themselves are served by Vercel from servers around the world, so a page request is handled near you, but the database it reads from stays in Canada.

Excerpts sent to the AI features are processed by our model provider outside Canada. If that matters to you, do not use QSpace, AnkiGen or the AI tutor, every other part of the platform works without them.

We set cookies for one purpose: keeping you signed in. There are no advertising cookies, no tracking pixels and no third-party marketing tags on any of our sites.

A short-lived cookie is also used when you move between Mediverse, RADSpace and OphthoSpace, so your session carries across without signing in again. It expires within a minute and is single-use.

Depending on where you live, you have the right to see the personal data we hold about you, correct it, delete it, take a copy elsewhere, or object to how we use it. Canadian (PIPEDA) and European (GDPR) users have these rights explicitly; we extend the same handling to everyone rather than sorting people by jurisdiction.

• See or correct it. Most of it is on your profile and dashboard pages. Email us for anything that is not.
• Delete your learning history. The reset control on your dashboard clears your attempts and progress immediately. It cannot be undone.
• Delete your account. Your account settings have a permanent delete. It removes the account and everything attached to it, immediately, and cannot be undone. You do not need to ask us.
• Get a copy. Your account settings have a download: profile, attempts, scores, bookmarks and any stored AI conversations, as a machine-readable JSON file. Worth doing before you delete anything.

We do not charge for any of this and we do not require a reason. If you think we have handled your data badly, you can complain to your national data protection authority, in Canada, the Office of the Privacy Commissioner.

We keep the least we can for the shortest time that still makes the product work. In detail:

• Account and profile. Until you delete your account, then removed immediately.
• Learning data, attempts, answers, confidence ratings, scores, bookmarks and progress. Until you delete your account, or sooner if you use the progress reset, which clears it straight away.
• AI tutor conversations. Stored only while you consent to it. Withdrawing consent stops new ones being kept; deleting your account removes the existing ones.
• Your uploaded study material. Never stored on our servers at all. It is read in your browser. The short excerpts sent to the model provider are processed and not retained by us.
• Server and security logs. Up to 30 days, kept to investigate abuse and outages, then discarded.
• Database backups. Roll off within 30 days. A deleted account is gone from the live database immediately and can survive in a backup for at most that long before it is gone permanently.

Where the law requires us to keep something longer, we keep only that, only for as long as required, and we do not use it for anything else.

Access is protected by row-level security policies in the database, so one account cannot read another’s data. Original uploads in the case libraries stay in private storage and are never served publicly; only approved, de-identified derivatives are. Server-side credentials are never sent to the browser. Sign-in, password reset and the other authentication endpoints are rate limited per network and per account, so a stolen password list cannot be tried at speed.

No system is perfectly secure, and we will not pretend otherwise. What we can say is that personal learning data is never public, there are no public profiles, rankings or leaderboards, and nothing here is sold or shared with advertisers. If we ever discover a breach affecting your personal data, we will tell you and the relevant regulator as quickly as the law requires and as plainly as we can.

Mediverse is intended for medical students and clinicians, and is not directed at children under 13. If you believe a child has created an account, contact us and we will remove it.

If this policy changes we will update the date at the top of this page. For anything privacy-related, email mediverse.space@gmail.com.

See also our Terms of Service.