Privacy notice
Last updated: 13 November 2026
In short
- We keep only what we need to run your account: your profile, your study progress, your payments and how much AI you use.
- We do not keep the documents you upload or the questions you ask the AI tutor.
- Never put information that identifies a real patient into MedStudy Africa.
- You can download your data or delete your account at any time from My account. Payment records the law requires us to keep are kept with your name and account removed.
- We do not sell your data, show advertising or use tracking cookies.
Who we are
MedStudy Africa is operated by MelJ Collective Pty Ltd, a private company registered in South Africa (registration number 2026/580257/07), with its registered address at 16 Green Lane, Greenwood Park, Durban 4051, South Africa. MelJ Collective Pty Ltd is the responsible party (data controller) for your personal information. For privacy questions, write to medstudyafrica@outlook.com.
What we collect and why
| Data | Why | Kept until |
|---|---|---|
| Account: name, email, country, programme, year of study; optional mobile number, institution and student number; the date you accepted this notice | To run your account and tailor content to your programme | You delete your account |
| Study progress: answers, scores, Daily Challenge history, Clinical Lab results, revision timetable, language | To save your progress across devices and show your performance | You delete your account or clear your results |
| Payments: plan, amount, dates, payment method, your account reference and the PayPal transaction ID | To activate your plan and keep the company's accounting and tax records | Seven years after the end of the financial year in which you paid. If you delete your account, the record is kept for that period with your name, email and account link removed (see "Deleting your account") |
| AI usage: date and time, plan, model, number of words processed (tokens) and estimated cost of each AI request. Not the text of your questions or the answers. | To apply your plan's AI limits fairly and manage costs | Linked to you until you delete your account; then kept without any link to you, as a business cost record |
| Contact form messages: your name, email, role, topic, institution (optional) and message | To reply to you | Two years after the matter is closed, unless the law requires longer |
| Activity: the dates on which you used the platform (not what you did) | To measure how many students use the platform each month | You delete your account |
| Account security: for each registered device a label such as "Android phone (Chrome)", browser, operating system, a random device code stored in your browser, first and last use, IP address and approximate location (city and country from your network). For each sign-in: date and time, device, IP address, approximate location and browser details | To keep each subscription to one student (up to 2 devices, one active session), to warn you about sign-ins you do not recognise and to detect account sharing. Location and IP address are risk signals only: we never suspend an account on location alone | Devices: until you remove them or delete your account. Sign-in records: 12 months |
| AI Wallet: credit top-ups bought (pack, price, PayPal transaction ID), credits used per AI activity and remaining balance | To keep your balance accurate, show your transaction history and keep the company's accounting records | Purchases: seven years, like other payments. Credit usage: you delete your account |
| Questions you answered wrong and your examination results (score, time used and the performance indicators shown after each exam) | To bring those questions back in later revision and to show your progress | You delete your account or clear your results |
| Questions and Clinical Lab cases already completed (a short code for each) | So you never receive the same question or case twice | You delete your account or clear your results |
Uploaded documents and AI questions
- When you use Upload and Learn, your file is read inside your own browser. The extracted text, or the photo of your notes, is sent through our server to Anthropic, which produces your revision pack.
- We do not store the file, its text, your AI questions or the AI's answers on our servers. A revision pack and the text of your notes are kept only in this browser tab (so Ask My Notes can use them) and are gone when you close the tab. Copy anything you want to keep.
- Anthropic processes AI requests on our behalf. Under its commercial terms it does not use this content to train its models without permission, and it deletes API inputs and outputs within 30 days by default. Content flagged by its safety systems may be kept for up to 2 years. See Anthropic's retention policy.
Never upload identifiable patient information
MedStudy Africa is for learning, not patient care. Before you upload or type anything, remove every detail that could identify a real patient: names, initials, hospital or file numbers, dates of birth, addresses, phone numbers, photographs, and rare details that would let someone work out who the patient is. Uploading real patient information may breach patient confidentiality, your institution's rules and data protection law. Write case examples in general terms instead.
Who processes your data
- Supabase stores your account and progress and handles sign-in. Our database is hosted in the European Union (West EU, Ireland).
- Anthropic (Claude) produces AI answers and revision packs, as described above.
- PayPal processes card payments. You enter your card details on PayPal's own secure page; we never see or store your card number. PayPal tells us that the payment succeeded and gives us its transaction ID, the amount and the currency, which we record against your account reference to activate your plan. PayPal handles your payment data under its own privacy statement.
- Netlify hosts the website and receives contact form messages (Netlify Forms), which are emailed to us. Google Fonts supplies the typefaces, so your browser contacts Google when pages load.
Your data is therefore processed outside South Africa and outside your own country. These providers act on our instructions under their data processing terms. These providers process your data under data processing agreements that include standard contractual clauses, which require them to protect it to the standard of the Protection of Personal Information Act (POPIA) in South Africa and the Data Protection Act in Zambia.
Deleting your account
When you delete your account we permanently delete your profile, email address, study progress, activity dates and completed-question codes. We cannot delete your payment records straight away, because company and tax law requires us to keep accounting records: the South African Companies Act requires company records to be kept for seven years, and the Zambia Revenue Authority can review tax for up to six years. We therefore keep each payment's plan, amount, dates, payment method and transaction reference, with your name, email and account link removed, and delete them at the end of that period. The records of AI costs are kept the same way, without any link to you.
Cookies and storage on your device
We use your browser's storage to keep you signed in, to work offline and to remember your settings. We do not use advertising or tracking cookies.
Your rights
- Access and portability: My account, then Download my data, gives you a copy of everything we hold about you.
- Correction: edit your profile on My account.
- Deletion: My account, then Delete my account, permanently removes your profile and progress. Payment and AI cost records are kept without your name or account link for the legal retention period (see "Deleting your account"). It cannot be undone.
- Questions or objections: write to medstudyafrica@outlook.com. You may also complain to the Information Regulator of South Africa or, if you are in Zambia, the Office of the Data Protection Commissioner.
Security
Every table in our database has access rules, so a student can read only their own records. Only named administrators can see student lists and payments. AI keys and administrator keys are held on the server and never sent to your browser.
Education only
MedStudy Africa is a study tool. Its notes, simulations and AI answers are not clinical advice and must not be used to diagnose or treat real patients.
Changes
If we change this notice in a way that affects you, we will tell you on My account before the change takes effect.