Privacy Policy
Last updated: May 2025
Introduction
This Privacy Policy explains what data mneva.health collects, how it is used, and your rights regarding that data. We operate a medical education platform — not a healthcare provider — so no Protected Health Information (PHI) as defined by HIPAA is collected or processed.
Data We Collect
We collect the following categories of data: (1) Account information — your email address, hashed password, display name, and (if you connect via Discord OAuth) your Discord user ID; (2) Learning activity — questions answered, accuracy per topic, spaced-repetition card states, flashcard history, and annotations you write; (3) Device and session information — IP address, browser user-agent, locale, and session tokens needed to authenticate you; (4) Voluntary profile data — daily study goal, exam-stage preferences, and preferred language. We do not collect or infer your real name, physical address, or any health history about you as a patient.
How We Use Your Data
Your data is used to: deliver and personalise the learning experience (adaptive question ordering, spaced-repetition scheduling, daily missions); improve the platform by analysing aggregate accuracy trends and identifying content gaps; provide customer support; send transactional emails such as account verification or password-reset links; and fulfil billing obligations when you subscribe to a paid plan. We do not sell your personal data or use it for advertising.
AI Processing Disclosure
When you request an AI explanation or when our system classifies content, question stems and answer options may be sent to Anthropic's Claude API. We do not include your name, email, or any other directly identifying information in these requests. Anthropic's own privacy policy governs how they handle API request data. We cache explanations for up to 30 days to reduce the number of external calls.
Cookies
We use only two cookies: a session authentication cookie set by better-auth (essential — required for you to stay logged in) and a NEXT_LOCALE cookie that remembers your language preference (functional). We do not use advertising, analytics, or third-party tracking cookies. If you choose "Essential only" in the cookie banner, only the session cookie will be set.
Third Parties
We share data with the following service providers only to the extent necessary to operate the platform: Anthropic (AI explanation generation — question stems only, no personal data); Stripe (payment processing — billing data you provide directly); Amazon Web Services S3 (media file storage); and an optional email delivery provider (Resend, Postmark, or Amazon SES) for transactional email. All providers are required to handle data under their own published privacy policies.
Data Retention
Account data is retained for as long as your account is active. Learning activity logs are retained for up to three years to support long-term spaced-repetition scheduling. If you delete your account, personally identifiable data is deleted within 30 days; anonymised aggregate statistics may be retained indefinitely.
Your Rights
You have the right to: access the personal data we hold about you; request correction of inaccurate data; request deletion of your account and associated personal data; receive a machine-readable export of your learning activity (data portability); and object to or restrict certain types of processing. To exercise any of these rights, email privacy@mneva.health. We will respond within 30 days. If you are in the European Economic Area you may also lodge a complaint with your local data-protection authority.
Security
Passwords are stored as bcrypt hashes. Database connections use TLS. Access to production infrastructure is restricted to authenticated personnel. We conduct periodic security reviews, but no system is perfectly secure — please use a strong, unique password.
Children
mneva.health is not directed at children under 13. We do not knowingly collect personal data from anyone under 13. If we become aware that a user is under 13, we will delete their account and associated data promptly.
Updates to This Policy
We may update this Privacy Policy periodically. The "Last updated" date at the top of this page will be revised when we do. Material changes will be communicated by email or in-app notice. Continued use of the platform after the effective date constitutes acceptance.
Contact
For privacy questions or data requests, contact us at privacy@mneva.health.