Legal
Privacy Policy
USMLE+ takes student privacy seriously. This policy explains what data we collect, why we collect it, how we use it, and the rights you have over your information.
Last updated: May 31, 2026
What We Collect
Account information (name, email, school), subscription and billing details, and study activity data (questions answered, time spent, scores) used to power performance analytics.
Mobile Apps (iOS & Android)
When you use our mobile apps we and our processors also collect diagnostics and crash data (Google Firebase Crashlytics), product-usage and anonymised session analytics including taps and interaction heatmaps (Google Firebase Analytics and Microsoft Clarity; session data is masked to avoid capturing sensitive input), a push notification token (Google Firebase Cloud Messaging), device information (model, OS and app version), and — only when you choose to use those features — a photo or microphone input. Signing in with Google or Apple shares your name, email and a user identifier. This data is used to run and improve the app and is not used for cross-app advertising or tracking. You can delete your account in the app (Profile → Delete account) or by emailing privacy@usmleplus.com.
How We Use Data
To provide the service, personalise your study experience, surface weak areas, generate self-assessments, and email you progress summaries. We never sell personal data to third parties.
Data Sharing
We share data with payment processors (Stripe), email providers (Postmark), and analytics tools — PostHog on the web, and Google Firebase (analytics, crash reporting and push) and Microsoft Clarity in our mobile apps — strictly to operate the service. All processors are bound by data-processing agreements.
Your Rights
You can request a copy of your data, correct inaccuracies, or request deletion at any time by emailing privacy@usmleplus.com. We respond within 30 days as required by GDPR and CCPA.
Data Retention
Account data is retained as long as your account is active. After account deletion, anonymised performance data may be retained for research; identifiable data is removed within 90 days.
Cookies
We use essential cookies for authentication and analytics cookies for product improvement. You can opt out of analytics cookies in account settings.