Privacy Policy

Applies to NexGen Mastery (nursing examination preparation), Rescue (emergency medical services), Foundations (prerequisite sciences and mathematics), and the MyoMed Prep company website (collectively, the “Platforms”). RadMatrix is a local-first, separately subscribed product: your study library stays in your own browser and never reaches MyoMed Prep servers, and RadMatrix publishes its own account and privacy terms. Synapsis AI, the on-premises learner tutor and coach available across the Platforms, is covered by the Synapsis AI Privacy Policy. Where this policy and the Synapsis policy appear to conflict about a tutor or coach turn, the Synapsis policy controls. Last updated: 5 October 2026.

1. Who We Are

The Platforms are operated by MyoMed Prep LLC, a Montana limited liability company, with its mailing address at 1827 11th Ave, Unit #2170, Helena, Montana 59601, United States. For the purposes of applicable data protection law, MyoMed Prep LLC is the controller of the personal data collected through the Platforms. General and legal inquiries: contact.admin@myomedprep.org.

2. What We Collect

2.1 Account Data. Name, email address, and a salted, one-way hash of your password (we never store your password in readable form).

2.2 Learning Data. Question attempts and scores, adaptive ability estimates, case-study progress, flashcard scheduling data, readiness exam results, module completion records, and the Platform portal(s) you use (NexGen Mastery, Rescue, or Foundations). This data operates the adaptive engine and populates your progress dashboard. RadMatrix is different: its study library lives in your own browser and, by default, never reaches MyoMed Prep servers — see RadMatrix’s own in-app policy.

2.3 AI Tutor Conversations. The questions you type to the Synapsis AI Tutor and the replies it returns, stored with your account so you can return to a conversation and so we can review the tutor’s safety behavior. Full details are in the Synapsis AI Privacy Policy.

2.4 Subscription and Billing Data. If you subscribe to a paid plan on any Platform, your email address and payment details are collected by Stripe, Inc., our payment processor. Card numbers never reach MyoMed Prep systems and we never store them. Stripe is an independent controller for its own fraud-prevention and regulatory purposes.

2.5 Technical Data. Standard server logs: IP address, timestamps, requested pages, browser type, and referring URL. Kept briefly for security and troubleshooting.

2.6 Communications. If you contact us (support requests, error reports, privacy inquiries), we retain the content of that communication and your contact details for as long as needed to resolve the matter and for our records.

2.7 Information We Do Not Collect. We do not ask for, and you must not submit, real patient information or any protected health information (PHI) as defined by HIPAA. We do not collect Social Security numbers, driver’s license numbers, financial account numbers (other than through Stripe for billing), biometric data, precise geolocation, or data revealing race, ethnicity, religion, sexual orientation, or union membership.

3. Legal Bases for Processing

We process personal data on the following legal bases:

3.1 Contract. Processing account data, learning data, and billing data is necessary to perform our contract with you (the Terms of Service) and to provide the educational services you signed up for.

3.2 Legitimate Interest. Processing technical data for security, fraud prevention, and platform stability; storing AI Tutor conversations for safety review; analyzing aggregate usage to improve content and features. We balance these interests against your privacy rights, and you may object at any time (see Section 9).

3.3 Legal Obligation. Processing data as required to comply with applicable tax, record-keeping, or regulatory obligations.

3.4 Consent. Where required by applicable law, we obtain your consent before processing (for example, if we introduce optional features that collect new categories of data). You may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

4. How We Use Your Data

4.1 To operate your account and personalize your learning (adaptive difficulty, spaced repetition schedules, progress dashboards) across all Platforms you use.

4.2 To secure the Platforms, prevent abuse, investigate potential violations of our Terms of Service, and debug problems.

4.3 To communicate with you about your account, subscription status, or material changes to our policies.

4.4 To enforce our Terms of Service, Academic Integrity Policy, and other agreements.

4.5 To comply with legal obligations, respond to lawful requests from public authorities, and protect our rights.

4.6 We do not sell your personal information. We do not share it with advertisers or data brokers. We do not use it for targeted advertising. We do not use your data to train any artificial intelligence model.

5. Cookies and Local Storage

5.1 The Platforms use browser local storage to keep you signed in (a session token) and to remember interface preferences. These are strictly necessary for the Platforms to function.

5.2 We do not use third-party advertising cookies, cross-site tracking cookies, or analytics pixels. No Google Analytics. No advertising networks. Nothing on our pages tracks you across other sites.

5.3 Because we use only strictly necessary storage, no cookie consent banner is required. If we ever introduce non-essential cookies, we will update this section and obtain consent where required by law.

6. Where Your Data Lives

6.1 Self-Hosted Infrastructure. The Platforms are self-hosted by MyoMed Prep on our own server infrastructure. Account data, learning data, and AI Tutor conversations live on hardware we own and administer. We are not a public-cloud classroom host.

6.2 Origin Network Protection. A first-party perimeter sits in front of the application: an operator-managed next-generation firewall (Protectli Vault running OPNsense). Public traffic may also pass through Cloudflare for DNS, TLS termination, and (when the optional Cloudflare Tunnel is enabled) encrypted reachability. Cloudflare is not the origin firewall and is not the sole network perimeter.

6.3 AI Tutor. A tutor turn stays on MyoMed Prep hardware and is not sent to Ollama Cloud or any other hosted AI service. See the Synapsis AI Privacy Policy for full details.

6.4 Databases. Databases are encrypted at rest where supported. Encrypted backups are made regularly and stored securely.

6.5 Processing Location. Data is processed in the United States.

7. Sub-processors

The complete list of outside parties that process any personal data on our behalf is published on the Sub-processors page. That list is short because we self-host. Current sub-processors:

1. Cloudflare, Inc.: Public DNS, TLS termination, and optional Tunnel ingress. Processes traffic metadata and content in transit. Does not store learning data.
2. Stripe, Inc.: Payment processing and subscription billing. Receives email and payment details you enter on Stripe-hosted pages. Applies only if you subscribe to a paid plan on any Platform; free and trial accounts involve no payment processor.
3. Resend, Inc. (transactional email relay, United States): Delivery of account email (password resets, address verification, material policy notices). Receives your email address and the contents of that message. Not used for marketing.

There is no hosted AI provider for the learner tutor. No advertising or analytics networks. No cloud hosting provider for your learning data.

8. Data Retention

8.1 Account and learning data: Retained while your account is active and for thirty (30) days after account deletion to allow recovery from accidental deletion requests. After that period, data is removed from the live database and ages out of encrypted backups on a rolling schedule.

8.2 AI Tutor conversations: Retained with your account. Deleted when you delete your account or ask us to clear them.

8.3 Server logs: Rotated on a short cycle, not to exceed ninety (90) days.

8.4 Billing records: Retained as long as required by applicable tax and financial record-keeping law (generally seven years for U.S. federal tax purposes), then deleted.

8.5 Support communications: Retained for up to two (2) years after resolution for quality and legal purposes, then deleted.

8.6 Encrypted backups: Age out on a rolling schedule. No backup is retained longer than one hundred eighty (180) days.

9. Your Rights and Choices

Regardless of where you live, we honor the following requests from verified account holders:

9.1 Access and export: You may request a copy of the personal data we hold about you, delivered in a commonly used electronic format.

9.2 Correction: You may correct your name and email address in your account settings. For other corrections, contact us.

9.3 Deletion: You may request deletion of your account and its data. We will remove it from the live database within thirty (30) days and let it age out of encrypted backups per Section 8.6.

9.4 Objection and restriction: You may object to processing based on legitimate interest (Section 3.2). We will cease such processing unless we demonstrate compelling legitimate grounds that override your interests.

9.5 Withdrawal of consent: Where processing is based on your consent, you may withdraw it at any time.

9.6 How to exercise these rights: In NexGen Mastery, the Account page lets you download a copy of all of your data and delete your account yourself, at any time. You can also email contact.admin@myomedprep.org from the email address on your account with “Privacy request” in the subject line. We will verify your identity by confirming account details before processing any request. We respond within thirty (30) days.

9.7 No retaliation: We will not discriminate against you for exercising your privacy rights. You will not receive a different level of service or pricing for making a privacy request.

10. Montana Consumer Data Privacy Act (MCDPA)

If you are a Montana resident, the Montana Consumer Data Privacy Act (effective October 1, 2024, as amended by SB 297 effective October 1, 2025) provides you with additional rights:

10.1 Right to confirm and access: Confirm whether we are processing your personal data and access that data.

10.2 Right to correct: Correct inaccuracies in your personal data.

10.3 Right to delete: Delete personal data you have provided to us or that we have obtained about you.

10.4 Right to data portability: Obtain a copy of your personal data in a portable, readily usable format.

10.5 Right to opt out: Opt out of (i) the sale of personal data, (ii) targeted advertising, and (iii) profiling in furtherance of decisions that produce legal or similarly significant effects. We do not sell personal data, we do not engage in targeted advertising, and we do not profile users for decisions that produce legal or similarly significant effects. Accordingly, there is nothing to opt out of under these categories. If this changes, we will update this section and provide an opt-out mechanism.

10.6 Universal opt-out mechanisms: We recognize and will honor Universal Opt-Out Mechanism (UOOM) signals, such as the Global Privacy Control (GPC), as valid opt-out requests to the extent applicable.

10.7 Exercising your rights: Use the process in Section 9.6. We will respond within forty-five (45) days, with one forty-five (45) day extension if reasonably necessary (we will notify you of any extension and the reason).

10.8 Appeal: If we decline your request, you may appeal by replying to our response. We will respond to your appeal within sixty (60) days. If we deny your appeal, we will provide information on how to file a complaint with the Montana Attorney General.

10.9 Duty of care for minors: The Platforms are not directed to children under 16. We do not knowingly process personal data of individuals under 16 for purposes of targeted advertising or sale, and we do not knowingly profile minors in furtherance of automated decisions with legal or similarly significant effects.

11. California Consumer Privacy Act (CCPA/CPRA)

If you are a California resident, the CCPA (as amended by the CPRA) provides additional rights. This section supplements the rest of this Privacy Policy.

11.1 Categories of personal information collected in the preceding 12 months:

1. Identifiers: name, email address, IP address, account username.
2. Internet or other electronic network activity: server logs, pages visited, browser type, referring URL.
3. Education information: question attempts, scores, adaptive estimates, module completion, readiness exam results, flashcard scheduling.
4. Inferences: adaptive ability estimates drawn from your learning activity.

11.2 Categories we do NOT collect: Protected classification characteristics, commercial information (beyond subscription status), biometric information, geolocation data, sensory data, professional or employment information, or sensitive personal information as defined by the CPRA.

11.3 Sources: We collect personal information directly from you (account registration, platform use, communications).

11.4 Business purposes for collection: As described in Section 4.

11.5 Sale and sharing: We have not sold personal information in the preceding 12 months. We have not shared personal information for cross-context behavioral advertising in the preceding 12 months. We do not sell or share the personal information of consumers we know to be under 16 years of age.

11.6 Your CCPA/CPRA rights: Right to know, right to delete, right to correct, right to opt out of sale/sharing (not applicable as we do not sell or share), and right to non-discrimination. Exercise these rights per Section 9.6.

11.7 Authorized agents: You may designate an authorized agent to submit a request on your behalf. We may require the agent to provide proof of authorization and may verify your identity directly.

11.8 Financial incentives: We do not offer financial incentives related to personal information.

12. Other State Privacy Laws

If you are a resident of a state with a comprehensive consumer data privacy law (including but not limited to Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Delaware, Iowa, New Jersey, New Hampshire, Nebraska, Tennessee, Minnesota, Maryland, and Indiana), you may have rights substantially similar to those described in Sections 10 and 11. We honor verified requests from residents of all U.S. states consistent with applicable law. Use the process in Section 9.6.

13. International Users

13.1 The Platforms are operated from the United States. If you access the Platforms from outside the United States, your personal data will be transferred to, stored in, and processed in the United States. By using the Platforms, you acknowledge this transfer.

13.2 If you are located in the European Economic Area, United Kingdom, or Switzerland, we process your personal data on the legal bases described in Section 3. You have the rights described in Section 9, and you may also lodge a complaint with your local supervisory authority.

13.3 We do not currently appoint a representative in the EU or UK. If we begin systematically offering services to individuals in those regions, we will appoint a representative and update this section.

14. Children, Minors, and Institutional Use (FERPA)

14.1 The Platforms are not directed to children under 16, and we do not knowingly collect personal data from anyone under 16.

14.2 If you are between 16 and 18, you may use the Platforms with the involvement of a parent or guardian as described in the Terms of Service.

14.3 If you believe a child under 16 has created an account, contact us immediately at contact.admin@myomedprep.org and we will delete the account and associated data.

14.4 We do not knowingly sell or share the personal data of users under 16.

14.5 Institutional use. When a school, program, or clinical site creates a cohort or roster and asks learners to join, that institution is the education-records authority for its students. In that role MyoMed Prep acts as a school official with a legitimate educational interest under FERPA, and processes roster and progress data only to provide the assigned educational services the institution directs.

14.6 Institutional data. A roster contains the display name and email an instructor supplies. A learner's item-level progress, assignment completion, and readiness results are visible to the institution that rostered them, and institutional administrators can export cohort reports for accreditation or internal analysis. We do not use institutional student data for advertising, and we do not sell it.

14.7 Data-processing addendum. Institutions that require a signed Data Processing Addendum, a FERPA school-official statement, or a security questionnaire can request them at contact.admin@myomedprep.org. We will agree the FERPA and DPA terms in writing before an institution is onboarded.

15. Security

15.1 We protect your data with: HTTPS everywhere; salted, one-way password hashing; token-based sessions; encrypted databases at rest (where supported); encrypted backups; and a layered network design comprising an operator-managed next-generation firewall at the origin, application services bound to loopback on the self-hosted rack, and (when configured) optional public ingress via Cloudflare Tunnel or a local reverse proxy behind that firewall.

15.2 The operator dashboard is not published on the public internet.

15.3 No system is perfectly secure. We cannot guarantee absolute security. If a breach affecting your personal data occurs, we will notify affected users and applicable regulators as required by law, and in any event within the timeframes specified by the Montana Consumer Data Privacy Act, the CCPA, and any other applicable breach notification statute. Our goal is to provide notification within seventy-two (72) hours of confirming a breach that is likely to result in a risk to your rights.

16. Third-Party Links

The Platforms may contain links to third-party websites or resources (for example, cited clinical guidelines or professional organizations). We do not control these websites and are not responsible for their privacy practices. This Privacy Policy does not apply to any third-party website. We encourage you to review the privacy policy of any website you visit.

17. Do Not Track

Some browsers transmit a “Do Not Track” (DNT) signal. Because there is no industry consensus on how to respond to DNT, we do not currently respond to DNT signals. However, because we do not engage in cross-site tracking, advertising tracking, or profiling, the practical effect is the same regardless of your DNT setting.

18. Changes to This Policy

We may update this policy from time to time. The “Last updated” date above reflects the current version. Material changes will be announced on the Platforms and, for registered users, by email to the address on your account at least thirty (30) days before the changes take effect. Continued use of the Platforms after the effective date of a change constitutes acceptance of the updated policy.

19. Governing Law

This Privacy Policy is governed by the laws of the State of Montana, without regard to conflict-of-law rules, except to the extent superseded by applicable federal law or the mandatory privacy laws of your jurisdiction of residence.

20. Contact

Privacy questions, and access, export, correction, or deletion requests: contact.admin@myomedprep.org (please put “Privacy request” in the subject line so we can route and verify it promptly).

To report a data security concern: contact.admin@myomedprep.org (please put “Security concern” in the subject line).

Company details