Privacy Policy

1. Who we are

Vettamed ("we", "us", "our") operates the Vettamed website, web workspace, and Vettamed Desktop application. This privacy policy explains how we collect, use, and protect your personal data when you use our services.

2. Data we collect

We collect the following personal data:

• Account data: Full name, email address, and encrypted password (created at purchase).
• Device data: Device-binding signals and hashed device identifiers used to authorise protected desktop sessions. These signals are not placed directly in forensic markers.
• Learning data: Practice responses, mock answers, scores, timing, confidence, mastery evidence, study-plan progress, assignment state, bookmarks, mistakes, and review schedules.
• Payment data: Payment information is processed by our payment providers (LemonSqueezy and Stripe). We store your order ID and customer ID but never your card details.
• Technical data: Operating system, platform architecture, application version, security mode, and minimal access logs needed for support, abuse prevention, and protected-content delivery.

3. How we use your data

• To create and manage your account.
• To verify authorised devices, entitlements, organisation access, and protected-session policy.
• To deliver study plans, protected practice, mock examinations, assignments, review, and progress analytics.
• To process payments and manage subscriptions.
• To provide customer support.
• To improve our examination content and application.

4. Data storage and security

Your data is stored securely on Supabase (PostgreSQL) infrastructure hosted within the European Union (eu-west-1). All data is transmitted over TLS encryption. Access to your data is protected by Row Level Security policies — you can only access your own account, devices, and exam results.

Vettamed Desktop does not write plaintext protected questions, answer keys, explanations, or decrypted session manifests to disk, IndexedDB, localStorage, logs, crash reports, or analytics. Protected content is decrypted in memory and cleared when the session ends. The app may store ordinary account, preference, update, or device-binding metadata needed to operate.

5. What Vettamed does not collect

We want to be explicit about what Vettamed Desktop does not do:

• No webcam access. We never request, capture, transmit, or store any image from your camera.
• No microphone access. We never request, capture, transmit, or store any audio from your microphone.
• No screen recording. We do not record or upload any portion of your screen during an exam.
• No keystroke logging. We do not record what you type outside of multiple-choice answer selections.
• No browsing history. The application is a self-contained kiosk and does not read any data from your other browsers or applications.

This is by design. Vettamed is an exam-simulation environment, not a proctoring system. If we ever introduce any feature that would change this, we will update this section, notify existing users by email, and require explicit opt-in consent before activation.

6. Third-party sub-processors

Vettamed uses the following sub-processors. Each handles a specific function and processes only the minimum data required for that function.

• Supabase (EU, eu-west-1): Database, authentication, file storage, edge functions.
• Vercel: Hosting for the Vettamed website and dashboard, plus first-party Web Analytics and Speed Insights.
• Resend: Transactional email delivery (purchase confirmations, password resets, support replies, expiry notices).
• GitHub: Hosting for the desktop application installers (download artifacts only; we do not share account data).
• LemonSqueezy: Primary payment processor and Merchant of Record. Handles tax, invoices, and refunds.
• Stripe: Alternative payment processor (where enabled).

We do not sell, rent, or share your personal data with any other third parties. We do not run any third-party advertising trackers on this site.

7. Cookies and analytics

The Vettamed website uses privacy-conscious analytics and performance monitoring through Vercel Web Analytics and Speed Insights so we can understand core flows and diagnose technical issues. Essential cookies may also be used for authentication, support workflows, and session management by our payment providers during checkout.

8. Support automation

We operate a unified support queue that combines website submissions, account-linked support requests, and messages sent to our support inbox. Some routine replies may be prepared or sent using automation for installation guidance, password recovery, authorised-device reset steps, subscription access, and similar low-risk operational topics. Refund disputes, abuse concerns, legal/privacy requests, and content quality disputes are escalated for human review.

9. Your rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the right to:

• Access: Request a copy of all personal data we hold about you.
• Rectification: Request correction of inaccurate personal data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Portability: Request your data in a machine-readable format.
• Restriction: Request restriction of processing in certain circumstances.
• Objection: Object to processing of your personal data.

To exercise any of these rights, contact us at support@vettamed.com. We will respond within 30 days.

10. Data retention

We retain your account and exam data for the duration of your subscription plus 12 months. After this period, your data will be permanently deleted unless you request earlier deletion. Payment records may be retained longer as required by tax and accounting regulations.

11. Changes to this policy

We may update this privacy policy from time to time. Material changes will be communicated via the email address associated with your account. The "last updated" date at the top of this page indicates when the policy was last revised.

12. Contact

For any privacy-related questions or requests, contact us at support@vettamed.com.