MyelinMed Privacy Policy
Last updated: 28 September 2026
Many of the students who use MyelinMed are under 18, and parents often read this page too. We've written it to be clear for both. In short: we collect what we need to run a study platform, we don't sell data, we don't show ads, and we don't use tracking or advertising cookies.
MyelinMed is a sole trader business based in Queensland, Australia (ABN 18 590 380 772). We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). For users in New Zealand, we also follow the Information Privacy Principles in the Privacy Act 2020 (NZ).
Questions or requests: support@myelinmed.com.au
1. What we collect
Information you give us
| What | When | Why |
|---|---|---|
| Email address and password | When you sign up | To create and secure your account. Your password is stored only in scrambled (hashed) form, and we can never see it. |
| First name (optional) | When the app asks what to call you | To address you in the app and in progress reports. Other students never see it. |
| The year you're sitting the UCAT, and optionally your exam date and time zone | Signup, pricing page or account settings | To show the right plans and countdown, and to group you with your cohort in leagues and anonymous statistics. |
| Neuron name and appearance choices | If you customise your neuron | To show your avatar. Your neuron's name is shown to other students only if you turn that on. |
| Referral code you entered | Signup | To apply a discount and credit your friend. |
| Progress-report recipients' email addresses, and their role (such as parent or tutor) | If you turn on progress reports | To send the reports you asked for. See section 4. |
| Anything you write to us | When you email support | To help you. |
| Question reports, and any note you add | If you report a question from a practice or mock review | To find and fix faulty questions. Only we read them; other students never see them. |
Information created when you use MyelinMed
- Your practice and mock exam activity: which questions you answered, your final answers, whether they were correct, time spent per question, the practice mode you used (timed or untimed, calculator or scratchpad used), and a general device type (for example "desktop" or "mobile").
- Game features: streaks, myelin (points), achievements, quests, league results, study links with friends, and your generated display name (pseudonym).
- Purchases: which plan you bought, when, the price, any discount, and when your access ends. Stripe handles your card details. We never see or store your card number. We receive only a payment reference and confirmation.
- Sign-in and security data: a session token (so only one device is logged in at a time), sign-in times, and the IP address and browser details recorded in our hosting providers' standard server logs.
We don't ask for your date of birth, school, address, phone number, gender or any health information, and we'd rather you didn't send them to us.
2. How we use it
- To run your account and give you access to what you've paid for.
- To show your progress, analytics and game features.
- To send the emails you need: account confirmation, password resets, receipts, important service notices and (if you turn them on) progress reports.
- To produce anonymous, combined statistics, such as how many students chose each option on a question, or where a score sits among other MyelinMed users. These are shown only when enough students are included that no individual can be identified (for example, at least 8 students for a question and at least 30 for a percentile), and they never name anyone. We also use them to find and fix questions that are confusing or wrongly marked.
- To keep MyelinMed secure, including preventing account sharing, abuse and fraud.
- To answer your questions and complaints, and to meet our legal obligations (for example, tax record-keeping).
We don't sell or rent personal information, use it for advertising, build advertising profiles, or send marketing emails without your consent. If we ever want to send you marketing (for example, news about a new feature), we'll ask first, and you can unsubscribe at any time.
We don't use your personal information to train AI models.
3. What other students can see
In leagues and study links, other students see only your generated display name (or your neuron's name, if you choose to show it), your neuron, and your league activity. They never see your real name, email address, school, location, or individual answers. You can leave leagues at any time in your account settings.
4. Progress reports and the people who receive them
If you hold a cohort plan, you can choose to have progress reports emailed to yourself and to others, such as a parent, guardian or tutor. This is off by default.
- Each person you add gets a confirmation email and receives nothing until they confirm. Every report includes a one-click unsubscribe.
- A report contains your first name, your question counts, accuracy and trends, and your mock exam results. It contains no game data.
- We keep a copy of each report as sent, so that we can answer questions about it (for example, if a parent queries a figure).
- If you receive reports: we hold your email address, the role the student gave you, and your confirmation or unsubscribe status. We use them only to send the reports you agreed to. You can unsubscribe at any time from the link in any report, or by emailing us. If you've unsubscribed and the student invites you again, you'll get another confirmation request, never a report.
5. Students under 18
We designed MyelinMed knowing that most UCAT candidates are 16 to 18 years old.
- You must be at least 13 to have an account. Students under 18 need a parent or guardian's permission to use MyelinMed.
- We collect the minimum we need. We don't ask for age, school or contact details beyond an email address.
- Nothing a student writes is shared with other students, except a neuron name they choose to show (which we filter).
- Leagues use generated display names, never real names.
- A parent or guardian can ask us about their child's account. Before we share anything or make changes, we'll take reasonable steps to confirm who they are, and we'll usually involve the student. The student's own login is always the account holder.
6. Who we share information with
We share personal information only with the service providers we need to run MyelinMed, and only what each needs:
| Provider | What they do | Where the data is held |
|---|---|---|
| Supabase | Our database and sign-in system | Sydney, Australia. Supabase, Inc. is based in the United States, and its staff may access data to provide support. |
| Vercel | Hosts the website and processes each page request | United States and other locations in its global network |
| Stripe | Processes payments | Australia, the United States and other countries |
| VentraIP | Email hosting and sending (our support mailbox, account emails and progress reports) | Australia |
Each provider handles data under its own privacy and security terms, and we take reasonable steps to make sure they protect it. Where information is held or accessed overseas (mainly the United States), we rely on those providers' contractual commitments and security practices.
We may also disclose information if the law requires it (for example, a court order), to protect someone's safety, or to a buyer of the business if MyelinMed is ever sold. In that case this policy would continue to apply, and we'd tell you.
7. Cookies
We use only essential cookies: the ones that keep you signed in, enforce one login at a time, and remember small settings (such as a prompt you dismissed). We don't use analytics, advertising or tracking cookies, or any third-party trackers. Because every cookie we use is needed for the site to work, we don't show a cookie banner. If you block cookies, you won't be able to sign in.
8. How we protect it
- Data is encrypted in transit (HTTPS) and at rest by our hosting providers.
- Database access is restricted so that each account can read only its own data. The few shared features (leagues, anonymous statistics) go through narrow, audited paths that return display names and totals only.
- Passwords are hashed, and card details never reach us.
- Access to production systems is limited to the founder.
No system is perfectly secure. If a data breach is likely to cause serious harm, we'll notify the people affected and the Office of the Australian Information Commissioner as quickly as we can, and tell you what to do.
9. How long we keep it
- Your account and study history: kept while you use MyelinMed. If you haven't logged in for 2 years, we delete your account and everything linked to it. We'll email you 30 days before this happens, so you can log in to keep it.
- If you ask us to delete your account: we delete it, your study history, game data, question reports, progress-report settings, saved reports and recipient details within 30 days.
- Purchase records: kept for 5 years after the purchase, because Australian tax law requires it. Stripe also keeps its own records under its own policy.
- Anonymous statistics: once combined with other students' data, they can't identify you, so they may be kept after your account is deleted.
- Support emails: kept for up to 2 years after your last message, unless we need them longer to resolve a dispute.
- Server logs held by our hosting providers are kept for their standard (short) periods.
10. Your choices and rights
You can:
- See and correct your details in your account settings, or ask us for a copy of the personal information we hold about you.
- Reset your study history from your account settings.
- Turn off progress reports, remove recipients, leave leagues, or stop showing your neuron's name, at any time.
- Delete your account by emailing support@myelinmed.com.au from your account email address. We'll confirm, then delete it as described in section 9.
- Stay anonymous or use a pseudonym wherever that's practical. You don't need to give us your real name at all.
We'll respond to requests within 30 days. We don't charge for them.
11. Complaints
If you're concerned about how we've handled your personal information, email support@myelinmed.com.au and we'll respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992) or, in New Zealand, the Office of the Privacy Commissioner (privacy.org.nz).
12. Changes to this policy
We'll update this policy when our practices change. If a change significantly affects how we use your information, we'll email you before it takes effect. The date at the top shows the latest version.