Privacy Policy

This Privacy Policy explains what personal information PrepXperts Online Academy collects, why we collect it, who we share it with, how long we keep it, and what rights you have over it.

1. About This Policy

PrepXperts Online Academy is the data controller responsible for the personal information described in this policy. We are an independent online education provider preparing doctors and postgraduate trainees for medical licensing and specialty examinations.

Contact details for privacy matters are in Section 21.

This policy covers prepxpertsonline.com, our learning management system, our live classes, our WhatsApp and Telegram community groups, and any communication you have with our team by email, telephone, or messaging app.

We are based in Pakistan and our students are located in many countries, including the United Kingdom, Ireland, Pakistan, and the Gulf states. Where the data protection law of your country gives you rights beyond those described here, we will honour those rights.

1.1 Language of this policy. We have written this in plain English rather than legal shorthand. Where a term has a specific legal meaning, we explain it in context.

2. Information You Give Us

We collect the following when you enquire, enrol, or study with us:

• Identity and professional information — your full name, medical qualification, current post or grade, specialty, the examination you are preparing for, and your country of practice.
• Contact information — email address, mobile number, and the WhatsApp number you contact us from.
• Account information — the username and password you use for our learning platform, and your account preferences.
• Payment information — the details you provide when paying, including proof of payment such as a bank transfer receipt or screenshot, and the name and reference on the sending account. See Section 8.
• Learning records — courses and diets you enrol in, attendance at live sessions, question bank and mock examination attempts and scores, progress through the course, and any certificate issued to you.
• Your communications with us — enquiries, support requests, feedback, and the content of WhatsApp, email, or Telegram messages you send us.
• Anything else you choose to share — including a profile photograph, if you upload one, and any information you volunteer in a testimonial or feedback form.

You do not have to give us everything listed above, but we cannot enrol you or give you access to a course without your name, contact details, and payment.

3. Information We Collect Automatically

When you use our website or learning platform, some technical information is recorded automatically:

• Device and connection information — IP address, browser type and version, operating system, and device identifiers.
• Usage information — pages and lectures viewed, time spent, question bank activity, login times, and the features you use.
• Approximate location — inferred from your IP address, at city or country level. We do not collect precise GPS location.
• Cookie data — see Section 17.

Some of this is collected by our learning platform provider and by analytics tools on our website rather than by us directly.

4. Information We Receive from Others

We may receive information about you from:

• Payment channels and banks, confirming that a payment has been made and the details of the sending account.
• Our learning platform provider, which reports your activity and progress back to us.
• Other students or mentors, where they refer you to us or report a concern about conduct.

We do not buy personal data from data brokers or marketing list vendors.

5. Enrolment and Messaging Apps

Most of our enrolments are completed over WhatsApp rather than through an automated checkout. This matters for your privacy, so we want to be clear about it.

5.1 What this means. When you message us on WhatsApp, your phone number, profile name, and profile photograph are visible to our team, and the content of your messages is stored in our WhatsApp account. WhatsApp is operated by Meta, and your use of it is governed by Meta's own privacy policy as well as this one. We do not control how Meta processes your data.

5.2 What we keep. We retain enrolment conversations as a record of what was agreed, what was paid, and what was promised. This protects both you and us if a question arises later.

5.3 Alternatives. If you would prefer not to use WhatsApp, you can enrol entirely by email. Please tell us and we will move the conversation.

6. Live Sessions and Recordings

Our courses are taught through live online classes, ordinarily on Zoom.

6.1 What is recorded. Live sessions are routinely recorded so that students who could not attend, or who wish to revise, can watch them later. A recording may capture your display name, your voice if your microphone is on, your image if your camera is on, and anything you type in the session chat.

6.2 Who can see recordings. Recordings are made available to other students enrolled in the same diet, through our learning platform. They are not published publicly.

6.3 How to avoid appearing in a recording. If you do not wish to be recorded, keep your camera and microphone switched off and use the text chat instead. You may also use an abbreviated display name. Please tell us at the start of a course if you have concerns and we will accommodate you.

6.4 Zoom's own processing. Zoom processes session data under its own privacy policy and may store recordings on its servers before we download them.

7. Community Groups

We run WhatsApp and Telegram groups for students enrolled in each diet.

7.1 Other students can see your number. In a WhatsApp group, your phone number and profile name are visible to every other member of that group, which may be several hundred people. This is a function of how WhatsApp works and we cannot change it. Telegram groups can be configured to show a username rather than a number.

7.2 If you would rather not join. Joining a community group is optional. You will not lose access to any course content, live session, or support if you choose not to join. Tell us and we will keep you updated by email instead.

7.3 Group content. Messages you post in a group are visible to all members and may be retained by them, including after you leave. We moderate groups but we cannot control what other members do with what you post. Please do not share clinical details of real patients, your own health information, or anything else you would not want circulated.

7.4 Leaving. You can leave a group at any time, or ask us to remove you.

8. Payments and Proof of Payment

8.1 How payment is taken. Most fees are paid by bank transfer or local payment service. Where you pay by bank transfer, we receive and hold the transfer receipt or screenshot you send us, which typically shows your name, the sending account details, the amount, and the date.

8.2 Card details. Where an online payment link is used, payment is handled by a third-party provider. We do not receive or store your full card number, expiry date, or security code.

8.3 What we retain. We keep payment records because tax and accounting law requires it, and because they evidence your enrolment. See Section 16.

8.4 Please do not send us more than we need. When sending proof of payment, you may redact your full account number and balance. We only need enough to match the payment to your enrolment.

9. How We Use Your Information

We use your personal information to:

• process your enquiry and enrol you in a course;
• create and administer your account on our learning platform;
• deliver classes, materials, question banks, and mock examinations;
• track your progress and, where relevant, discuss it with you or your mentor;
• take payment and keep accounting records;
• contact you about timetables, schedule changes, access credentials, and academic reminders;
• answer your questions and provide support;
• operate and moderate our community groups;
• send you information about our other courses, offers, and events, subject to Section 12;
• protect our course material from unauthorised copying and distribution, as described in Section 11;
• understand how our platform is used so that we can improve it; and
• comply with our legal obligations and enforce our Terms and Conditions.

9.1 No automated decision-making. We do not make decisions about you by automated means alone, and we do not carry out profiling that produces legal or similarly significant effects.

10. Our Legal Bases for Processing

Where the law requires us to identify a legal basis for processing your data, we rely on the following:

• Performance of a contract — to enrol you, deliver your course, take payment, and provide support. Without this we cannot provide the service you have paid for.
• Legitimate interests — to secure our platform, protect our course material from piracy, understand how our services are used, keep records of what was agreed, and tell existing students about relevant courses. We balance these interests against your rights, and you may object at any time.
• Consent — for optional processing such as publishing your testimonial or examination result, and for non-essential cookies. You may withdraw consent at any time.
• Legal obligation — to keep tax and accounting records and to respond to lawful requests from authorities.

Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

11. Account Monitoring and Content Protection

Our course material is our livelihood, and unauthorised sharing directly harms us and the students who paid for access. To protect it, we do the following, and we want you to know about it.

11.1 Access monitoring. We and our learning platform provider record login times, IP addresses, and device information, and we review this where there is reason to suspect that an account is being shared or credentials have been distributed.

11.2 Content identifiers. Course material may carry visible or embedded identifiers linking a copy to the account it was accessed from. If material traceable to your account is found circulating without authorisation, we will use that information to investigate.

11.3 What we do not do. We do not read the content of your private messages to other students, we do not access your device beyond what your browser or our platform's app reports, and we do not track your activity outside our own platform.

11.4 Consequences. Where monitoring indicates a breach of our Terms and Conditions, we may suspend or terminate access. See our Terms and Conditions for the full position.

12. Testimonials, Results and Marketing

12.1 Publishing your result. We publish student results, rankings, and testimonials on our website and social media. We do this only where you have given us permission, and we will tell you what we intend to publish — typically your name, photograph, country, and examination outcome.

12.2 Withdrawing permission. You may withdraw permission at any time by contacting us. We will remove the material from our own website and social media channels within a reasonable period. We cannot recall material that others have already downloaded, screenshotted, or reshared.

12.3 Marketing messages. We may send you information about our courses by email, WhatsApp, or SMS, including through WhatsApp broadcast lists. You can opt out at any time by telling us or by using any unsubscribe link provided.

12.4 Messages you cannot opt out of. While your enrolment is active, we will still send you essential messages about your course — timetables, access credentials, schedule changes, and similar. These are part of the service, not marketing.

13. Who We Share Your Information With

We do not sell, rent, or trade your personal information. We share it only in the following circumstances:

• Service providers — our website host, our learning management system provider, our video-conferencing provider, email and messaging services, and analytics providers. These organisations process data on our instructions and are bound by their own contractual and legal obligations.
• Mentors — your name, progress, and question bank performance may be shared with the mentor teaching your course, so that they can support you.
• Other students — through community groups, as described in Section 7, and through live session recordings, as described in Section 6.
• Payment channels and banks — as necessary to receive and verify payment.
• Professional advisers — our accountant or legal advisers, where necessary and under a duty of confidentiality.
• Authorities — where we are required to disclose by law, court order, or a lawful request, or where necessary to protect the rights, safety, or property of PrepXperts, our students, or others.
• A successor organisation — if PrepXperts is ever sold, merged, or restructured, in which case we will tell you and ensure equivalent protection applies.

14. International Data Transfers

We are based in Pakistan. Our service providers are located in a number of countries, including the United States and the European Union, and their servers may be located outside your country of residence.

This means that if you are in the United Kingdom, the European Economic Area, or another jurisdiction with data transfer restrictions, your personal data will be transferred outside that jurisdiction when you use our services.

Where we transfer data internationally, we rely on the contractual protections offered by our service providers, which typically include standard contractual clauses or equivalent commitments. You may contact us for further information about the safeguards that apply.

15. How We Protect Your Information

We take the security of your information seriously and apply measures proportionate to the size of our operation:

• our website and learning platform are served over encrypted HTTPS connections;
• account passwords are stored in hashed form by our learning platform provider, and are not visible to us in plain text;
• access to student records is limited to the small number of people who need it to do their job;
• we select established third-party providers who maintain their own security programmes and certifications;
• we review who has access to what on a periodic basis; and
• we keep the software underlying our website updated.

15.1 What we do not claim. We are a small organisation, not a large enterprise with a dedicated security team. We do not want to give you a false impression, so we will say plainly: we do not currently run formal penetration testing or independent security audits. We rely substantially on the security measures of the established platforms we use.

15.2 Your part. Please use a strong and unique password, do not share your login with anyone, and log out on shared devices.

15.3 If something goes wrong. If a breach occurs that is likely to affect your rights, we will notify you and any relevant authority as required by applicable law, and we will tell you what happened and what you should do.

16. How Long We Keep Your Information

We keep personal data only as long as we need it:

• Enquiry records where you did not enrol — up to 12 months, then deleted.
• Account and learning records — for the duration of your enrolment and for 3 years afterwards, so that we can verify your participation if you or a regulator asks.
• Payment and accounting records — for the period required by applicable tax and accounting law, which is generally at least 6 years.
• Live session recordings — for the duration of the diet and for a limited archive period afterwards, after which they are deleted or retained only where they have ongoing teaching value.
• Enrolment and support messages — for the duration of your enrolment and for 3 years afterwards.
• Community group messages — these remain in the group and on the devices of members until the group is deleted. We delete diet groups once they are no longer active.

If you ask us to delete your data, we will do so within 90 days, except where we are legally required to keep it. We will tell you what we have kept and why.

17. Cookies and Similar Technologies

Our website and learning platform use cookies and similar technologies.

17.1 Types we use.

• Essential cookies — needed for the site and platform to work, including keeping you logged in. These cannot be switched off.
• Functional cookies — remember your preferences, such as which course you last viewed.
• Analytics cookies — help us understand how the site is used, in aggregate. We use Google Analytics for this.

17.2 Managing cookies. You can block or delete cookies through your browser settings. Blocking essential cookies will prevent parts of the platform from working.

17.3 Consent. Where the law of your country requires your consent before non-essential cookies are set, we will ask for it before setting them.

17.4 Do Not Track. Browsers vary in how they signal tracking preferences and there is no agreed standard. We do not currently respond to Do Not Track signals.

18. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights:

• Access — ask for a copy of the personal data we hold about you.
• Rectification — ask us to correct anything inaccurate or incomplete.
• Erasure — ask us to delete your data, subject to any legal obligation to keep it.
• Portability — receive your data in a structured, commonly used, machine-readable format.
• Objection — object to processing we carry out on the basis of legitimate interests, including direct marketing.
• Restriction — ask us to limit how we use your data while a question is resolved.
• Withdraw consent — where processing is based on consent.

18.1 How to exercise them. Contact us using the details in Section 21. We may ask you to confirm your identity before we act, to make sure we are not disclosing your data to someone else.

18.2 Our response time. We will acknowledge your request promptly and respond within 30 calendar days. If your request is complex, we may extend this and will tell you why before the initial period expires.

18.3 Cost. We do not charge for exercising these rights. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or decline, and we will explain why.

18.4 No penalty. We will not treat you differently, restrict your access, or degrade your service because you exercised a privacy right.

18.5 Complaints. If you are unhappy with how we have handled your data, please tell us first so that we can put it right. You also have the right to complain to the data protection authority in your country. Students in the United Kingdom may complain to the Information Commissioner's Office.

19. Children and Age Requirements

Our courses are for qualified doctors, postgraduate trainees, and final-year medical students. Our platform is not directed at anyone under 18 and we do not knowingly collect data from minors.

If we become aware that someone under 18 has enrolled, we will close the account and delete the associated data. If you believe a minor has provided us with personal information, contact us and we will act promptly.

20. Changes to This Policy

We may update this policy to reflect changes in our practices, our providers, or the law.

• The revised policy will appear on this page with a new "Last Updated" date.
• Where a change materially affects your rights, we will give you notice by email or a prominent notice on the platform before it takes effect.
• Continuing to use our services after a change takes effect means you accept the updated policy.

21. Contact Us and How to Complain

For any question, request, or complaint about your personal data:

• Organisation: PrepXperts Online Academy
• Email: info@prepxpertsonline.com
• WhatsApp: +92 3164500454
• Address: 545-B Gulberg Colony, Kasur, Lahore Division, Pakistan
• Response hours: Monday to Saturday, 9:00 AM to 9:00 PM (PKT)

Please put "Privacy request" in your subject line or first message so that it reaches the right person quickly.

This Privacy Policy should be read alongside our Terms and Conditions and our Refund and Cancellation Policy.