Privacy Policy

Effective from: 20 September 2026

This Privacy Policy (the “Policy”) describes how Medical Tutor s.r.o. (the “Operator”) processes the personal data of users (the “User”) who use the Medical Tutor online educational service (the “Service”).

Capitalized terms used in this Policy have the same meaning as in the Medical Tutor Terms of Service.

1. Data Controller

• Medical Tutor s.r.o.
• Plzeňská 1270/97, Košíře, 150 00 Prague 5, Czech Republic
• Company ID No.: 29932777
• E-mail: tutor@memorix.cz
• Web: https://medicaltutor.ai

2. Personal Data We Process

Data Provided by the User

• first name, last name
• e-mail
• profile photo
• field of study, specialty, year of study and school
• country of study and preferred language, study goals, preferred features
• other optional profile information

The User must provide only information about themselves, register under their own name and must not share their account with other persons.

Data Obtained from Other Sources

• login information from providers (Google, Apple)
• identification data from a school where the account is created by an institution

Data Generated through Use of the Service

• queries submitted to AI, learning history, quiz results
• analytics data (IP address, browser, device, access time)

Technical Data and Cookies

• data from Google Analytics and Tag Manager
• server logs and security data

3. Purposes and Legal Bases for Processing

Performance of a contract (Article 6(1)(b) GDPR)

• enabling User registration
• operation and functioning of the Service
• generating responses using AI
• personalization of the environment and learning

Legitimate interests of the Operator (Article 6(1)(f) GDPR)

• security of the Service
• prevention of abuse
• handling breaches of the Terms
• internal analytics in anonymized form
• testing and improving features

User consent (Article 6(1)(a) GDPR)

• analytics and marketing cookies
• newsletters and marketing communications, marketing personalization
• research and improvement of AI models

Compliance with a legal obligation (Article 6(1)(c) GDPR)

• accounting and tax obligations, invoicing

4. Use of Artificial Intelligence (AI)

• The User’s data (e.g. a query) is processed by AI models for the purpose of generating a response.
• Outputs may be stored for debugging, security and functionality improvement purposes.
• AI does not replace medical advice, diagnosis or clinical decision-making
• The User must not submit medical records or other sensitive health data.
• We do not use data to train AI models beyond the necessary scope without your consent.

5. Recipients of Personal Data

Processors

• Google Cloud, Google Workspace, Google Analytics
• Vercel, Hetzner, Gigaserver
• PostgreSQL, OpenAI API
• Stripe, WorkOS
• Sentry, Linear
• Webflow, Cookiebot
• Meta Business Suite, Google Marketing Platform
• Ecomail, Resend
• N8N, GitHub, GitHub Actions

Partners

ANATOMYKA LLC, USA – integration of the Anatomyka 3D anatomical atlas and content collaboration

Other Recipients

• legal/accounting advisers
• public authorities (where required by law)

What We Never Do

• we do not sell personal data
• we do not share data with unauthorized entities
• we do not create user profiles for third parties without a legal basis
• we do not permit automated access, scraping or robotic tools

6. International Data Transfers

Where data is transferred outside the EU/EEA (e.g. to the USA):

• we use Standard Contractual Clauses (SCCs)
• we conduct transfer risk assessments
• we use supplementary technical measures

7. Personal Data Retention Period

• User Account: for the duration of the account
• inactive account: may be deleted after 24 months of inactivity (with prior notice)
• marketing: until consent is withdrawn
• analytics: according to tool settings (6–26 months)
• invoicing: as required by law (5–10 years)
• security logs: 12–36 months

After the retention period ends, we anonymize or delete the data.

8. User Rights

• right of access
• right to rectification
• right to erasure
• right to restriction of processing
• right to data portability
• right to object
• right to withdraw consent at any time
• right to lodge a complaint with the Czech Office for Personal Data Protection

We handle requests without undue delay, generally no later than within one month of receipt; in cases provided for by the GDPR, this period may be extended.

9. Data Security

• data encryption (TLS)
• hashed passwords
• access control
• regular backups
• access monitoring and audit logs

Nevertheless, absolute security of data transmission over the internet cannot be guaranteed.

10. Contact

For questions or to exercise your rights: tutor@memorix.cz

---

11. Consent to the Use of Personal Data for Marketing

This section supplements the Privacy Policy and sets out how the Operator processes the User’s personal data for marketing purposes on the basis of the User’s consent.

11.1. Purposes of Processing

By giving your consent, you allow us to:

1. send newsletters and commercial communications,
2. inform you about new features, events, competitions and discounts,
3. display personalized marketing and recommendations,
4. conduct remarketing through Google Ads, YouTube and Meta,
5. analyze campaign performance.

Marketing communications have no effect on the provision of the Service.

11.2. Data Processed

• E-mail
• name (if provided)
• profile and study settings
• analytics and cookie data (to the extent covered by consent)
• history of interactions with newsletters

11.3. Recipients

Data for marketing purposes may be processed by:

• Google Marketing Platform
• Meta Business Suite
• Ecomail / Resend
• other marketing processors listed in the list of processors

11.4. Voluntary Consent and Withdrawal

Consent is voluntary. You may withdraw it at any time:

• by clicking the unsubscribe link in an e-mail,
• by changing the settings in the application,
• by e-mail at: tutor@memorix.cz

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.