Privacy Policy
Effective date: August 5, 2026
Controller: Reflex PMR LLC · Contact: support@reflexpmr.com
This Privacy Policy explains what we collect, how we use it, and who we share it with when you use Reflex PMR (the “Service”) — on the web at reflexpmr.com or through the Reflex iOS app.
1. Information we collect
- Account data (via Clerk): email address, optional name, and authentication identifiers.
- Billing data (via Stripe): purchase status and billing metadata. We do not store your full card number — card data is handled by Stripe.
- Study/usage data (in our database, hosted on Supabase): your progress, spaced-repetition (FSRS) state, answers, bookmarks, and settings.
- AI-feature inputs: text you submit to interactive features (e.g., “Explain-It” and oral-board practice), which is sent to our AI provider (Google Gemini) to generate or grade a response.
- Server & log data: our hosting and content-delivery providers (Vercel, Cloudflare) log IP addresses and request metadata as a normal part of serving and securing the Service.
- Diagnostics: crash and performance reports via Sentry, configured not to include your IP address or identity.
- Support communications: messages you send us.
The iOS app specifically
Neither the web app nor the iOS app runs an advertising or third-party analytics SDK. The iOS app collects only your email, optional name, user ID, and study-progress data — linked to your account and used solely for app functionality — plus crash and performance diagnostics that are not linked to your identity. Nothing collected on any platform is used for tracking across other companies’ apps or websites.
2. How we use information
To provide and personalize the Service; process payments; operate AI features; maintain security and prevent abuse; diagnose errors and improve the product; communicate with you; and comply with law.
3. Legal bases (GDPR/EEA users)
Performance of a contract (providing the Service); legitimate interests (security, improvement); consent (where required); and legal obligation.
4. Service providers / sub-processors
We share data with vendors who process it on our behalf:
| Provider | Purpose | Data involved |
|---|---|---|
| Clerk | Authentication & account management | Name, email, auth identifiers |
| Supabase | Database hosting | Study/usage data, account references |
| Stripe | Payment processing | Billing metadata (no full card # stored by us) |
| Google (Gemini) | “Explain-It” and oral-board grading | Text you submit to those features |
| Vercel | Web hosting | Request/IP logs |
| Cloudflare (R2/CDN) | Hosting & delivery of audio/figures/assets | Asset requests, IP/log data |
| Sentry | Crash & performance monitoring | Error reports (configured to exclude IP/identity) |
We also use AI tools (Google NotebookLM, Anthropic Claude) in our internal content-production pipeline; they process our source material, not your personal data. Transactional emails (sign-in, receipts) are sent by Clerk and Stripe as part of the services above; we do not operate a separate marketing-email provider.
We do not sell your personal information.
5. International transfers
Our providers may process data in the United States and other countries. Where required, transfers rely on appropriate safeguards (e.g., Standard Contractual Clauses).
6. Data retention
We keep personal data only as long as needed for the purposes above. You may request deletion at any time (see §7); the iOS app also offers account deletion in-app.
7. Your rights
Depending on where you live (GDPR, CCPA/CPRA, and similar laws), you may have the right to access, correct, delete, or export your data, to object to or restrict processing, and to opt out of the “sale” or “sharing” of personal information (we do not sell). To exercise these rights, contact support@reflexpmr.com. We will not discriminate against you for exercising them.
8. Children
The Service is intended for adults (medical professionals and trainees) and is not directed to children under 16. We do not knowingly collect data from children.
9. Security
We use reasonable technical and organizational measures (encryption in transit, access controls, reputable vendors). No system is perfectly secure.
10. Cookies
We use cookies and local storage for authentication and your preferences. We do not use advertising cookies or third-party analytics cookies.
11. Changes
We may update this Policy; material changes will be notified through the Service or by email.
12. Contact
Reflex PMR LLC — support@reflexpmr.com