Privacy Policy

1. Who we are

The passmed.co.za website is operated by Passmed Pte. Ltd. ("Passmed", "we", "us"), a company registered in Singapore. We are the responsible party under POPIA for the personal information you provide on this site. Our Information Officer, responsible for POPIA and PAIA compliance, can be contacted at support@passmed.com; a copy of our PAIA manual is available on request from the same address.

2. What we collect

When you create an account: your name, email address, and password (stored hashed - we never see your actual password).

When you use the service: your question attempts, scores, time spent, flagged questions, and progress data. This is necessary for the service to work - without it we can\'t show you analytics or save your progress.

When you subscribe: your billing details are collected and processed by Stripe (our payment processor). We store your subscription status, plan, and billing email - never your full card number.

Automatically: your IP address, browser type, device type, and pages visited. We use this for service security, fraud prevention, and to understand which features are used.

3. Why we use it

To provide the service: serving questions, saving your progress, showing analytics, processing payments.

To improve the service: anonymised, aggregated usage statistics to understand what\'s working and what isn\'t.

To communicate with you: transactional emails (account, subscription, trial ending) and, if you have subscribed to a paid plan, occasional product update emails about features and content similar to what you\'ve purchased. You can unsubscribe from product update emails at any time using the link in any email or from your account settings.

For institutional users: cohort-level reporting to your faculty as part of your institutional licence (see section 5 on joint responsibility).

4. Lawful basis for processing (POPIA)

We process your personal information under the following POPIA conditions:

Contract - to provide the service you\'ve signed up for, process your payment, and deliver the question banks and analytics features (section 11(1)(b) POPIA).

Legitimate interests - for service security, fraud prevention, product improvement, and direct marketing to existing customers about similar products under section 69(3)(a) POPIA. You can object to direct marketing at any time.

Legal obligation - for retention of payment and tax records.

5. Who we share with

We share your personal information only with operators (processors) necessary to operate Passmed: Stripe (payments), Brevo (transactional email), Vercel (hosting), Sentry (error monitoring), Google Analytics (usage analytics), and Cloudflare (DDoS protection and CDN). Each is bound by an operator agreement and processes your data on our instructions only.

Institutional users - joint responsibility. If you access Passmed through an institutional licence (for example, your medical school, registrar training programme, or provincial health department), Passmed and your institution may each be a responsible party for cohort reporting and account management. Both parties may view and manage your account in connection with the institutional licence. Your statutory rights under sections 7 and 8 below can be exercised against either party. Contact support@passmed.com for the joint-responsibility arrangement in full.

We never sell your personal information to third parties.

6. Cross-border transfers

Passmed is operated from Singapore. Some of our operators are based outside South Africa. Where personal information is transferred outside South Africa, we comply with section 72 of POPIA - we will only transfer personal information to a foreign country with adequate protection or where the data subject has consented, or where the transfer is necessary for the performance of a contract.

7. How long we keep it

Account data: while your account is active, plus 12 months after closure (for legal and accounting purposes). Question attempt data: while your account is active, plus 6 months. Anonymised aggregate data: indefinitely. Payment records: 5 years (in line with South African tax compliance requirements).

8. Your rights

Under POPIA you have the right to:

(a) request confirmation of whether we hold personal information about you;
(b) request access to the personal information we hold about you;
(c) request correction or deletion of inaccurate personal information;
(d) object to the processing of your personal information on reasonable grounds;
(e) object to direct marketing at any time;
(f) lodge a complaint with the Information Regulator.

To exercise any of these rights, email support@passmed.com. We\'ll respond within 30 days.

You also have the right to complain to the Information Regulator (South Africa) at inforegulator.org.za if you\'re not satisfied with our handling of your personal information.

9. Security compromises

In the event of a security compromise where there are reasonable grounds to believe that the personal information of a data subject has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected data subjects as required by section 22 of POPIA.

10. Cookies

We use cookies for: keeping you logged in (essential), remembering your preferences (functional), and understanding aggregate site usage (analytics, via Google Analytics with IP anonymisation). Non-essential cookies are only set after you give consent via our cookie banner. You can manage your consent at any time via the cookie settings link in the footer; disabling essential cookies will mean you can\'t log in.

11. Children

Our service is not directed at and we do not knowingly process personal information of anyone under 18. Under POPIA section 34, processing of personal information of children requires the consent of a competent person. By creating an account, you confirm you are 18 or older. If you believe we have collected information from someone under 18, please contact support@passmed.com immediately and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email to all account holders at least 30 days before they take effect.

13. Contact

Questions about your data, or to exercise any of your rights? Email our privacy team at support@passmed.com.