MockUro — Privacy Policy

MockUro ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data. By using MockUro, you agree to the practices described in this policy.

1. Information We Collect

Information you provide directly

• Account information: When you create an account, we collect your name and email address. You may optionally provide your institution or hospital affiliation.

• Profile updates: Any changes you make to your name or institution in the Account screen are stored in your profile.

Information generated by your use of the app

• Study session data: We record each case you complete, including the case identifier, topic category, difficulty level, your score (0–10), and domain-level rubric scores (Workup, Treatment, Complications, Guidelines). This data powers your statistics, spaced repetition system, and Board Readiness score.

• Spaced repetition data: We store your SM-2 algorithm parameters for each case — ease factor, interval, repetition count, and next scheduled review date — to surface your weakest cases first.

• Marked cases: Cases you bookmark or mark for review are stored and synced to your account.

• Achievement data: Badges you unlock are stored locally and associated with your account to persist across devices.

• App preferences: Settings such as dark/light mode, audio preferences, and daily study goal are stored locally on your device using AsyncStorage.

Subscription and payment information

• Subscription status: We record your subscription plan (free or subscriber), subscription start/end dates, and renewal status. Payment transactions are processed exclusively by Apple via the App Store. We never receive, store, or have access to your credit card number, bank account information, or any other payment credentials.

Technical information

• Authentication tokens: Supabase authentication tokens are stored in your device's secure keychain (iOS Keychain via expo-secure-store). We do not store passwords in plain text.

• Error and usage logs: In production builds, error logs do not contain personally identifiable information.

2. How We Use Your Information

We use the information we collect to:

• Provide the service: Deliver the oral board simulation experience, score your responses, and maintain your study history across sessions and devices.

• Personalize your experience: Calculate your Board Readiness Score, surface weak topic areas, schedule spaced repetition reviews, and adapt difficulty based on your performance history.

• Manage your subscription: Verify your subscription status, enforce usage limits, and process subscription events (purchases, renewals, cancellations, and expirations) via RevenueCat and the App Store.

• Communicate with you: Send account confirmation and password reset emails via Supabase Auth. We do not send marketing emails unless you explicitly opt in.

• Improve the app: Use aggregated, de-identified usage patterns to understand which topics and case types are most used, and to guide future content development. We do not sell or share individual user data for this purpose.

• Ensure security and integrity: Detect and prevent unauthorized access, enforce role-based permissions, and maintain the integrity of user data stored in our database.

3. How We Share Your Information

We do not sell your personal information. We do not share your data with advertisers. We share information only in the following limited circumstances:

• Supabase (database and authentication): Your account data, study sessions, and SRS records are stored in a Supabase PostgreSQL database hosted on AWS infrastructure in the United States. Supabase acts as a data processor on our behalf and is subject to its own privacy and security policies (supabase.com/privacy).

• RevenueCat (subscription management): Your anonymized user ID and subscription events are shared with RevenueCat to process and verify subscription status. RevenueCat does not receive your name, email, or study data (revenuecat.com/privacy).

• Anthropic (AI grading): When you complete a case, your anonymized responses and a pre-scripted answer key are sent to Anthropic's API to generate your scorecard. No personally identifiable information (name, email, user ID) is included in these requests. Anthropic's API usage is subject to Anthropic's privacy policy (anthropic.com/privacy).

• Apple App Store: Subscription purchases are processed by Apple. Apple's privacy policy governs any data exchanged during the payment process (apple.com/legal/privacy).

• Legal requirements: We may disclose information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of MockUro, our users, or the public.

4. Data Retention

We retain your account information and study data for as long as your account is active. If you delete your account, all associated data — including your profile, study sessions, SRS records, and marked cases — is permanently and irreversibly deleted from our database within 30 days. Anonymized, aggregated data that cannot be linked to any individual may be retained indefinitely for product improvement purposes.

Local data stored on your device (app preferences, cached SRS data) is removed when you uninstall the app.

5. Your Rights and Choices

• Access and correction: You can view and update your name and institution at any time in the Account → Profile screen. Your email address is managed through Supabase Auth — contact us to request an email change.

• Account deletion: You can permanently delete your account and all associated data at any time from Account → Profile → Delete Account. This action is immediate and irreversible.

• Data portability: You may request an export of your study data (session history, SRS records) by contacting us at the email address below. We will provide data in a machine-readable format within 30 days.

• Opt-out of communications: You may opt out of any future marketing communications by contacting us. Transactional emails (account confirmation, password reset) are required for app functionality and cannot be opted out of while your account is active.

• California residents (CCPA): If you are a California resident, you have the right to know what personal information we collect, the right to delete your personal information, and the right to opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact us at the email below.

6. Data Security

We take reasonable and appropriate measures to protect your information from unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encrypted storage: Authentication tokens are stored in the iOS Keychain using expo-secure-store. All data transmission between the app and our servers uses TLS encryption.

• Row-level security: Our database enforces row-level security policies that ensure each user can only access their own data. Administrative operations require server-side verification.

• Limited access: Only the app developer has access to the production database. No third-party personnel have access to individual user study data.

No method of electronic transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

7. Children's Privacy

MockUro is intended for medical professionals, students, and trainees who are at minimum 18 years of age. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us immediately and we will delete it.

8. Third-Party Links

The app contains links to external websites including pubmed.ncbi.nlm.nih.gov (PubMed). These links are provided for reference and convenience. We are not responsible for the privacy practices or content of these external sites. We encourage you to review their respective privacy policies.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. When we make material changes, we will update the effective date at the top of this policy and, where appropriate, notify you via email or an in-app notice. Your continued use of MockUro after any changes constitutes your acceptance of the updated policy.