Privacy Policy

Medkit is an educational project whose data controller is Matias Nahuel Merayo, domiciled in San Clemente del Tuyú, Province of Buenos Aires, Argentina. Data processing is carried out in accordance with Argentina's Personal Data Protection Act (Law 25.326) and its supplementary regulations.

For any question related to this policy or to your personal data, you can write to medkitarg@gmail.com.

Account data you provide when registering or editing your profile: username, email address, password (stored encrypted, never in plain text), and a profile picture if you choose to upload one. If you sign in with Google, instead of a password we receive from your Google account your email address, whether it is verified, and your first and last name.

Content you create within the platform: decks, cards, associated images, comments, and any material you upload voluntarily.

Study and usage data: review history, ratings, session times, progress, and statistics required by the spaced-repetition algorithm and to track your progress.

Technical data generated during use: IP address, browser and device type, access logs, technical error logs (which may include your user identifier), and app usage statistics (for example, how many times you use each action while studying), which we use for security, maintenance, diagnostics, support, and to improve the platform, and which we keep for a limited time.

We process your data to provide the service you request: enabling sign-in, saving your progress, organizing your material, showing statistics, and supporting Medkit's study features.

The legal basis for processing is the performance of the relationship created when you set up your account and use the platform and, where applicable, your consent, which you can withdraw at any time by deleting your account or the associated data.

We also use technical and usage information to maintain the platform, improve it, resolve problems, and prevent abusive or fraudulent use.

We keep your data while your account remains active. If you delete your account, we remove your personal information and associated content according to the platform's deletion process.

We may retain certain information for as long as necessary to comply with legal obligations, resolve disputes, or enforce these terms, even after the account is deleted.

We keep periodic database backups for disaster recovery. They are stored on GitHub, where they are deleted automatically after 60 days, and on Google Drive, where they are kept as a historical archive.

Medkit relies on infrastructure providers that support its operation and may process data on our behalf: Supabase (database), Vercel (application hosting and usage metrics), Cloudinary (image storage), Resend (email delivery), Google (Sign in with Google, if you choose that option), and GitHub and Google Drive (backups). These providers may store data on servers located outside Argentina.

We do not sell your personal data or share it with third parties for commercial purposes unrelated to the operation of the service. We only share information when it is necessary to run the platform, when required by a legal obligation, or by a request from a competent authority.

We use strictly necessary cookies and session tokens to keep your account authenticated, remember basic preferences, and protect access to the platform's private areas.

We do not use cookies for advertising or third-party tracking: the platform's usage and performance metrics are provided by Vercel and work without cookies. If you block the necessary cookies, you may not be able to sign in or use features that require an account.

We apply reasonable technical and organizational measures to protect your information against unauthorized access, loss, alteration, or improper disclosure, such as password encryption and access control to private areas.

No system is completely infallible. Although we work to protect your data, we cannot guarantee absolute security. In the event of any significant incident affecting your data, we will act in accordance with applicable regulations.

As the data subject, you may request access, rectification, updating, and deletion of your personal information at any time, and object to certain processing, in accordance with Law 25.326.

You can exercise several of these rights directly from the platform (by editing your profile or deleting your account) or by writing to medkitarg@gmail.com. We will respond to your request within the timeframes set by applicable regulations.

The Agency for Access to Public Information (AAIP) is the supervisory authority for Law 25.326, and you may file complaints with it regarding the processing of your personal data.

If you live outside Argentina, this policy does not affect the rights that the data protection rules of your country of residence grant you.

Medkit is intended for students. Registration by minors must be done with the knowledge and authorization of those who hold parental responsibility or legal guardianship.

If we become aware that a minor's account was created without proper authorization, we may suspend or delete it. If you are a parent or guardian and want to review or delete the data of a minor in your care, write to us at medkitarg@gmail.com.

We may update this policy to reflect changes in the platform or in applicable regulations. The version in force will always be the one published on this page.

When changes are significant, we will try to communicate them through appropriate means within the platform. Continued use of Medkit after an update implies acceptance of the policy in force.

For inquiries, requests about your data, or any matter related to this privacy policy, you can write to us at medkitarg@gmail.com.