The short version
Promises we make in plain words.
- No advertising pixels
No ad trackers, no social-media pixels, no session replay.
- We never sell your data
Not to advertisers, not to anyone.
- No visit analytics at launch
Some things still happen before you choose anything: Google's quick sign-in (One Tap) can contact Google on some pages, some forms run Cloudflare's security check, and we store a few cookies and notes in your browser, like your time zone and a visit count for reminders.
1. Data Controller
Ari Horesh, trading as EnterMedSchool in Pavia, Italy, is the data controller. That means he decides why and how we use the personal information covered here. Our VAT number is IT02865360180. Our business address is Via Francesco Orsi 27, 27100 Pavia (PV), Italy.
For privacy questions or requests, contact Ari at ari@entermedschool.com. You do not need an account to contact us.
This notice covers the new website. Existing course purchases and the old website have separate records, described below. The new website starts with an empty account database; creating a new account does not transfer your old account or cancel your existing course rights.
2. What Data We Collect
We collect information you give us, information your browser sends when it connects, and limited information from the providers you use. Required account fields let us create and protect your account. Without them, we cannot provide an account. Optional profile details and notification choices are your choice; leaving them blank does not stop you reading public pages.
2.1 Account Information
For an account, we use your name, email address, account identifier, password verifier if you choose a password, date of birth, and a record of the terms and notice version shown to you. We store a password hash, not your readable password. Security records include sessions, verification and recovery attempts, and any second-factor settings you enable.
If you choose Google sign-in, Google gives us your Google account identifier, name and verified email address. We do not receive your Google password. We do not use a Google profile photo as your EnterMedSchool avatar. One Tap also contacts Google before you choose an account, as explained in section 5.
2.2 Profile and Onboarding Information
Your profile can include your study stage, exam goals, dates, university or school choices, study year, countries or citizenship, language preferences and display choices. We use these to provide the account features you choose. Your date of birth helps apply age restrictions. A separate age-control record can contain the date and time you turn 18; that record is not the same encrypted field as your profile date of birth.
2.3 Student Status Verification
If you request student verification, we use your university email, a verification challenge, your enrollment declaration and the result. Confirming control of an email address does not independently prove every statement about your student status. These records remain associated with your account until changed or removed under our retention rules.
2.4 Learning Activity and Study Content
We save the planner tasks, exam dates, focus choices and personal schedules you ask us to keep. Where an available private study feature lets you save notes, imports, decks or reading material, we process that content to store it for you. Browser drafts may help recover an unfinished action.
The official question bank and flashcards are closed at launch. There is no daily question or flashcard allowance. The library, books, lesson study and social features also remain closed unless separately released. Their presence in older descriptions does not mean we collect new activity through them now.
We also remember account setup and tutorial completion so you can resume where you left off.
2.5 Community Content and Messages
Community posts and messaging are closed on the new website at launch. The contribution system has been removed. We do not treat private study material as a public contribution. Existing conversations on a separate course or community service remain subject to that service and its notice.
2.6 Public Profile and Leaderboards
The new website does not publish a social profile or leaderboard at launch. Your account name and study choices are used for your own account features. We will explain any future sharing controls before opening a feature that makes them public.
2.7 Technical Information
A connection to the website discloses technical information such as an IP address, requested address, browser information and time to our hosting provider. Security checks use limited counters, challenge results and purpose-specific identifiers. Our application logs use fixed event codes and bounded counts rather than passwords, tokens or private study text. Provider access logs are separate and can contain request metadata.
We do not run visit analytics or advertising trackers at launch. Local browser preferences and reminders are described in section 6; no analytics does not mean no cookies or technical requests.
2.8 Payment Information
Courses and BootCamp use Stripe Payment Links. Stripe collects payment-card and billing information on its checkout. We receive purchase, payment-status and contact information needed to fulfill the order, handle a refund and keep required records. A parent buying for a learner may have different billing details from that learner. The new website does not store full payment-card details. EnterMedSchool+ is coming soon; it has no checkout, subscription charges or renewal processing at launch.
2.9 Course Platform, Device Binding & Anti-Piracy Data
Existing course access continues through the existing course service, including alpha.entermedschool.com where applicable. Course progress, access and purchase records there do not automatically become new-website records. Ask us about the records for your particular course.
The new website has ordinary authentication and abuse controls. It does not run the proposed account-speed anti-scraping review system at launch, and this notice does not describe proposed 90-day review records as existing data. Any later collection needs an updated notice before it begins.
2.10 Content Reports and Ratings
If an available content item offers a rating, an issue report or a Which is better? comparison, we use the choice, relevant content reference and any account association to improve that item and handle the report. These are separate from the removed contribution system. We do not ask for patient information.
2.11 AI Study Features
We do not offer a new-website AI tutor at launch. This notice does not authorize sending your private study content to an external AI service. We will explain the provider, information used and choices before opening an AI feature. Please do not include confidential or patient information in support messages.
2.12 Push Notifications (Mobile App)
Browser push is closed on the new website at launch. In-account service notices and your notification settings are separate from device push subscriptions. Existing mobile apps are not automatically connected to your new account.
2.13 Emails We Send and Email Engagement
Account verification, recovery and security emails support the service you request. Optional news and product messages need the relevant choice; creating an account does not subscribe you to all marketing.
For Notify me, we use your email, optional name, selected feature or exam, source page, and consent time and version. Guest requests first receive a confirmation link valid for 48 hours. The selected list receives a confirmed entry after confirmation. A signed-in user with a verified email can join directly. The confirmation email itself already processes personal information, even before an entry is confirmed.
Joining a list requests an opening notification for that feature, such as questions, flashcards, membership or BootCamp. It is not a purchase, a reservation, or permission for unrelated marketing. The 48-hour link limit does not delete a confirmed subscription. See section 7 for retention and section 8 for leaving a list.
SMTP2GO delivers our website mail and processes message content, recipient details and delivery events. We use delivery outcomes, bounces, complaints and suppression records to avoid repeated or unwanted sends. We do not use email opens or link clicks for marketing profiling at launch. Provider diagnostic and retention practices are described in section 5.
2.14 Support and Applications
Email ari@entermedschool.com for support or a privacy request. Ari handles these requests and uses your address and what you send to respond. The new website contact form is not a working delivery channel at launch.
If you choose to open chat, Chatway receives connection and browser information and the messages, contact details or attachments you provide. Chat loads only after you click to open it. Once loaded, it may continue operating while you navigate the site in that tab. Do not send passwords, payment-card details or patient information. Email is available if you prefer not to use chat.
3. How We Use Your Data
3.1 Service Provision
We use account and profile information to provide the requested account, save your choices and study work, verify eligibility for a requested feature, and administer courses you buy.
3.2 Communication
We send necessary account messages, answer support and rights requests, and send optional announcements only within your choices. Withdrawing optional email consent does not stop a necessary security or purchase message.
3.3 Security and Anti-Piracy
We protect accounts, prevent fraudulent requests and excessive traffic, and investigate reported misuse using information needed for that purpose. Existing rate limits can refuse or delay a request. They are not proof that someone scraped content.
3.4 Improvement
We use submitted feedback and reports to correct content and improve the service. We do not use launch visit analytics, advertising profiles or private answers for a new anti-scraping score.
4. Legal Basis for Processing (GDPR)
Under the GDPR, each purpose needs a legal basis. Accepting the terms is not blanket consent to every use of your information.
| Purpose | Legal basis and limits |
|---|---|
| Requested account, profile, planner, verification and private storage; course delivery and purchase support | Contract or steps you ask us to take before a contract, under Article 6(1)(b), where necessary for that service. Optional information is not made mandatory just by putting it in these terms. |
| Requested public pages and files; general email and chat inquiries | Legitimate interests under Article 6(1)(f) in delivering the resources you request and answering your inquiry. Contract applies where support is necessary for an account or purchase. Extra optional tracking requires its own lawful basis and consent where required. |
| Account security, abuse prevention and necessary delivery logs | Legitimate interests under Article 6(1)(f): protecting users, our content and service availability. We assess necessity and your rights, with particular care for minors. You can object. |
| Voluntary content ratings, comparison votes and issue reports | Legitimate interests under Article 6(1)(f): responding to submitted feedback and correcting educational content. This does not authorize monitoring closed study features. |
| Optional opening notifications and marketing | Consent under Article 6(1)(a), limited to the messages requested and withdrawable at any time. |
| Optional browser storage or outside-service tracking | Prior consent where required by cookie and privacy law. Necessary storage is limited to providing a service or preference you request. Legitimate interests do not replace required storage consent. |
| Required financial records and privacy requests | Legal obligations under Article 6(1)(c), including applicable Italian accounting duties and GDPR rights duties. |
| Limited deletion evidence, suppression records and legal claims | Legal obligations to honor rights and withdrawals; legitimate interests in preventing restoration of erased accounts and establishing or defending a specific claim. We keep only what is needed. |
| Restricted old-site archive | Legitimate interests in handling transition support and old-record requests during the limited retention period. Required financial records have their own legal basis. This is not permission to keep unnecessary data or restart marketing. |
4.1 Automated Security Decisions
Protective checks may automatically reject a request, limit repeated attempts or require verification. We do not use a solely automated decision to permanently close an account for suspected scraping. A person reviews a disputed restriction. Contact us if a check stops you using the service; we do not treat a bot score as proof of wrongdoing.
5. Third-Party Services
We share information only as needed for the purposes described here. A processor works on our instructions. Some providers also decide how to use certain data for their own services, fraud prevention or legal duties and act as separate controllers. We do not sell your personal information.
| Recipient | Purpose, information and role | Retention and transfer information |
|---|---|---|
| Vercel Inc. | Website hosting and delivery. Receives request addresses, IP and browser information and processes application data in transit. Processor for hosted customer data; some operational data has separate controller uses. | Request logs follow the applicable service settings; account data follows section 7. Its customer DPA provides EU Standard Contractual Clauses for relevant transfers. Delivery and support can involve countries outside the EEA. Vercel DPA. |
| Neon database service, under Databricks, Inc. / Neon, LLC public terms | Processor for the application database, stored in Frankfurt, including account, profile, study and interest records. The contract applicable to our project determines the recipient entity. | Active records and restore history have different retention rules; see section 7. Frankfurt storage does not exclude overseas support or subprocessors. Relevant restricted transfers use the applicable Databricks DPA and EU Standard Contractual Clauses. Neon terms; Databricks DPA. |
| Cloudflare, Inc. | DNS, requested file delivery through R2, and Turnstile on protected forms. Turnstile receives connection, browser and device signals, including IP, User-Agent and TLS information, and the site origin. Processor for our protection; separate controller for improving its bot detection. | Challenge validity is not the lifetime of provider records. Retention follows the applicable security service purpose and settings. Covered US transfers can use the EU-US Data Privacy Framework; the DPA supplies Standard Contractual Clauses where applicable. Turnstile notice; Cloudflare DPA. |
| Google Ireland Limited / Google LLC | Google Identity, One Tap and requested YouTube playback. On pages that show a One Tap invitation, it can contact Google before you select an account. Google receives connection and browser information then. Choosing sign-in separately shares the identity fields in section 2. Google has its own controller responsibilities. | Google retention and user controls depend on its service and account settings. Google LLC describes covered EU-US Data Privacy Framework transfers and Standard Contractual Clauses where needed. Google privacy; transfer safeguards. |
| SMTP2GO, operated by Sand Dune Mail Ltd, New Zealand | Processor for delivery of account, security and requested notification mail. Receives recipient addresses, message content and delivery information. | Its public notice describes 35-day retention of email headers and sampled messages, subject to its account options. Our own mail records are separate. New Zealand has an EU adequacy decision; onward transfers need applicable safeguards, including Standard Contractual Clauses where required. SMTP2GO privacy. |
| Chatway, operated by Poptin LTD, Israel | Requested support chat. Processes messages, supplied contact details and attachments, and technical or visitor information after activation. Processor for our support records, with separate uses identified in its own notice. | Chat history follows the support purpose in section 7 and the retention chosen for our service. Israel has an EU adequacy decision; that does not cover all onward transfers. Those require the safeguards in the applicable DPA. Chatway privacy; Chatway data protection. |
| Stripe Payments Europe, Limited and applicable Stripe affiliates | Stripe Payment Links for courses and BootCamp. Processes payment, billing, purchase and fraud information. Processor for some activities and independent controller for others, including compliance and fraud prevention. | Purchase records follow applicable financial duties; Stripe keeps its own records under its notice. Covered Stripe, LLC US transfers can use the EU-US Data Privacy Framework, with applicable Standard Contractual Clauses for other restricted transfers. Stripe privacy; Stripe DPA. |
Google One Tap is optional. You can choose email sign-in instead. Our prompt rules suppress One Tap for signed-in visitors, certain account flows, and browsers signaling Global Privacy Control or Do Not Track. These signals are not a general consent mechanism and do not undo requests already made to Google. Dismissing the prompt pauses further invitations as described below.
YouTube interview players connect to Google when you press play. A privacy-enhanced player still sends connection data. Opening a Stripe checkout or downloading a file from files.entermedschool.com also contacts its provider. An outside link, such as WhatsApp support, sends information to that service if you choose it. Its own privacy notice applies to its separate uses.
Our authorized team can access records needed for support, rights requests and administration. Account exports downloaded by you or an authorized operator create separate copies. Existing courses, live sessions and the support mailbox can involve additional providers outside the new website; ask us for the recipients for your request. We disclose information to an authority or adviser only where a lawful obligation or justified legal need requires it, not automatically because a request looks unusual.
6. Cookies and Consent
Cookies and browser storage remember sign-in, security steps, preferences and unfinished actions. No analytics at launch does not make every storage item essential. Optional storage needs a valid choice where the law requires one. We do not treat scrolling, continuing to browse, or the absence of a privacy signal as consent.
On your first visit to pages using the account shell, including as a guest, ems-tz stores your browser time-zone name for up to one year. It supports local dates and times, not a daily study allowance. It is renewed when the zone changes.
6.1 Essential Cookies (Required)
The table includes authentication cookies and other functional cookies so you can find them in one place. It does not classify the pre-choice One Tap cookie or first-visit time-zone cookie as essential. Those flows require a separate assessment of necessity and consent.
| Cookie | When and why | Browser lifetime |
|---|---|---|
| __Host-ems2027.session_token | After sign-in, proves the requested session. | Up to 24 hours; revocation can end access sooner. |
| __Host-ems2027.registration | During email registration, binds its steps. | Up to 10 minutes. |
| __Host-ems2027.protection | When a protected form starts a human check. | Up to 10 minutes. |
| __Host-ems2027.recovery | During password recovery. | Up to 10 minutes. |
| __Host-ems2027.second_factor | During a second-factor sign-in step. | Up to 5 minutes. |
| __Host-ems-oauth-google | After choosing Google, binds the sign-in return. | Up to 10 minutes. |
| __Host-ems-oauth-signup | When Google signup needs account details or terms acceptance. | Up to 15 minutes. |
| __Host-ems-onetap-google | When an eligible One Tap invitation starts, before account selection; prevents replay. | Up to 10 minutes. A security purpose does not itself justify starting an optional invitation. |
| __Host-ems-erasure-{request-id} | After a deletion request is accepted, lets you check its private status. | Up to 1 hour. |
| ems-theme, ems-calm, ems-text | When you choose a display preference, or a saved non-default account choice is applied. | Up to one year. Turning calm display off removes its cookie. |
| ems-session-hint | After sign-in is detected, helps the menu request account details. The cookie contains no account identity and does not authorize access. | Up to 30 days; cleared on sign-out. |
| ems-tz | First account-shell visit or time-zone change; remembers the browser zone. | Up to one year. |
The old next-auth and consent-manager cookies are not the new authentication system. Closed library meters are not launch cookie purposes. Our code does not set an analytics, advertising or cart cookie. Providers may set their own storage during the interactions described in section 5. For example, Google documents g_state, and Cloudflare can set cf_clearance if pre-clearance is enabled; these are provider-dependent, not confirmed first-visit cookies.
6.2 Analytics and Optional Storage
We do not use Plausible or another visit analytics service at launch. There is no analytics-consent switch to enable one. Optional browser memory is a separate issue from analytics.
| Browser key or family | Purpose and trigger | Lifetime or removal |
|---|---|---|
| ems:google-one-tap:session; ems:google-one-tap:snoozed-until | An attempt marker before the invitation; a timestamp when you dismiss it. | Attempt marker: tab session. Dismissal pauses invitations for 24 hours, but the local key has no automatic expiry. |
| ems:guest-nudges | Guest-page visits and reminder choices; can contain visit counts, timestamps, exam/focus choices and dismissal history. | Local storage has no automatic expiry. This is optional behavioral memory, not required authentication. |
| ems:navigation:history:<access> | Recent recognized destinations for navigation convenience. | Up to 12 entries in session storage. |
| ems-loader-last:crisp; ems-loader-last:pixel; ems-loader-roasts | Remembers recently shown loader jokes. | Session storage; optional, not necessary to read a page. |
| ems:navigation:pins:<account-id-or-guest>; ems:updates-popup; ems:study-exams:not-mine:<account-id> | Menu pins, update dismissal or popup choice, and hidden exam-date choices you save. | Local storage until cleared or changed; no automatic expiry. |
| ems2027:isolated-signup:v1:<origin>; ems.native-erasure-recovery.v1 | Recovering an uncertain signup or deletion request. | Session storage; not an email password or verification code store. |
| ems.account-rights-google.v1 | Remembers the requested export or deletion action while you confirm with Google, with a hashed account reference, a random verification value and the start time. | Valid for 10 minutes; removed when consumed or canceled. Otherwise it remains in session storage until the tab session ends. |
| ems-ai-note-seen | Remembers on this device that you clicked play on the AI disclosure, so its invitation is not repeated. | Local storage until cleared; no automatic expiry. |
| ems:books:reader:v1 | Your place in each book you read on the website (chapter, position, printed page number and the time), how far you have read in each section of a chapter, your text size, and whether you chose to hide your notes from the text. Written only after you use the page (a scroll, a press or a key), change the text size or switch your notes in the text off or on, never just by opening it. | Local storage until cleared; no automatic expiry. |
| ems:books:notes:v1 | The highlights and notes you make in a book you read on the website: the highlighted words with a few words around them, where they are in the chapter, the color, the printed page number, the note you type and when you made or changed it; and your notes on a section. Written only when you highlight words, change a highlight's color, write or delete a note, remove a highlight or undo a removal. It can contain personal information you typed in a note. | Local storage until cleared or until you remove them; no automatic expiry. They stay on this device and are not added to an account. |
| ems:books:guest:v1 | Without an account: the printed page numbers you have read in each book on the website, so the pages you already read stay open and your free pages are counted on this device. Written only when you read a page while signed out, never when you are signed in. | Local storage until cleared; no automatic expiry. It stays on this device and is never sent to us. |
| ems.planner-demo.ticks:v1; ems.imat-books.owned; ems.apply:<guide>; ems-ward-checklist:<guide> | Ticks in a guide's interactive tools: the steps of the sample study plan, the books you mark as I have it, the application documents you mark as ready and the skills on the ward checklist. The study plan's key is written as soon as the plan comes into view, empty until you tick a step. | Local storage until cleared; no automatic expiry. The ticks stay on this device and are not added to an account. |
| ems.c2.once:<moment>; ems.ai.leo:<moment>; ems.wc.file:<moment>; ems.ip.cheer.<year> | Marks that one of Leo's short animations in a guide or on the IMAT papers page has played after something you did, such as answering a question, ticking a box, tapping a tile or coming back from a download, so it plays once per visit. | Session storage; each value is only 1. |
| ems:community-invite:session; ems:community-invite | The Telegram community invitation on guides: a marker once it has opened in this tab, and, after you press Not now or Join Telegram, the times you pressed Not now and whether you joined. | Marker: tab session. Not now pauses the pop-up for 14 days; a second Not now or Join Telegram stops it on this browser. The local key has no automatic expiry. |
| cx.group:<school>; cx.cycle:<school>; cx.retake:<school>; cx.country:<school>; cx.docs:<school>; cx.done:<school> | A university page (at launch the University of Pavia page, where <school> is pavia-uni): the applicant group, admission year, retake answer and citizenship country you choose or a shared link carries, the documents you tick as ready and the steps you mark with I did this, so the page opens on your situation next time. cx.retake is saved as 0 when the page opens. | Local storage until cleared or changed; no automatic expiry. |
| ems:universities:citizenships | The university map: the citizenships you add under My choices without an account. They set your IMAT university choice limit on the map. | Local storage until cleared or changed; no automatic expiry. |
| ems2027:onboarding:<account-id> and its :step entry | Unsubmitted profile choices and onboarding step. | Session storage; can contain personal information you typed. |
| ems:dashboard-plan:<account-id>; ems.dashboard.exams.pending.v1:<account-id>; ems:language-preferences:<account-id>; ems:verification:pending:<account-id>; ems.notifications.pending.v1:<account-id> | Recovering your pending planner, exam, preference, verification or in-account notification action. | Session storage. |
| ems.tutorials.arrived; ems.tutorials.tourChipHidden | Arrival and dismissal choices, only when the relevant tutorial is available. | Session storage; not evidence that a closed tutorial is open. |
| ems-private-upload-drafts (browser database) | Holds unsent community upload drafts, a feature that is closed at launch. When you sign out or switch accounts, the site opens it to delete the previous account's drafts, which creates it empty if it was not there. | Nothing is saved in it at launch; the empty database stays until you clear site data. |
Session storage normally lasts for a tab session, although browsers can restore sessions. Local storage stays until the site or you remove it. A reminder no longer having an effect does not mean its key was deleted.
You can clear cookies and site storage in your browser. This can sign you out and remove unsaved drafts or preferences. It does not erase server records, data already received by a provider, or copies on another device. Use section 8 to request those changes. Retiring the old service worker does not guarantee that all old browser data is removed.
7. Data Retention
We keep information for its stated purpose and any separate legal duty. A token becoming unusable is different from deleting its database record. Some cleanup happens in later maintenance passes; an expiry time is not a promise that every copy disappears at that moment.
| Record | Retention period or decision rule |
|---|---|
| Account, profile, verification, preferences and saved study work | While the account or requested feature needs the information, until you change or delete it or close the account, subject to specific legal exceptions. There is no general automatic inactive-account deletion period. |
| Registration, pending Google signup, sessions and second-factor records | Short validity windows protect access. Scheduled maintenance removes expired registration and pending Google signup records in bounded batches. Other expired records can await later cleanup. A 10- or 15-minute validity window is not a physical-deletion deadline. |
| Date of birth and age-control state | For eligibility and protections while needed. Scheduled maintenance processes age-control records in bounded batches. The derived eighteenth-birthday record can remain until a cleanup or correction removes it; turning 18 does not itself prove deletion. |
| Planner recovery receipts and study-action history | While needed to resolve saves and provide the history you request, or until relevant deletion. Scheduled maintenance removes expired recovery records and prunes eligible history in bounded batches. Records can remain until a later maintenance pass or your deletion request. |
| Confirmed opening-notification entries | Until you leave the list, your matching account is deleted, or we remove the entry after the requested announcement or abandonment of the feature. The current store has no automatic timed purge. We handle removal separately from confirmation-link expiry. |
| Email content and delivery records | Website security notices have a 24-hour expiry; product-mail payloads have deadlines of no more than seven days, with cleanup separate from expiry. Delivery outcomes can remain after payload removal. SMTP2GO has its own retention described above. |
| Email suppression and withdrawal evidence | The minimum identifier, reason and date needed to keep honoring a refusal while the relevant sending system operates or a legal obligation requires evidence. These records have no automatic expiry; they are not a marketing list. |
| Support, chat, requests and disputes | Until the issue is resolved and any necessary follow-up is complete. Keep a restricted subset longer only for an applicable legal duty or a specific dispute, with review when that need ends. Provider-side copies need separate deletion handling. |
| Purchase, billing and tax records | For the period required by the applicable accounting and tax rules, and longer only where a specific legal hold applies. This does not extend the lifetime of all profile or study data. |
| Technical logs and security counters | For service delivery, the relevant abuse window and necessary investigation. Application budget windows range from minutes to 24 hours, with later cleanup. Hosting and other provider logs have their own service settings; these are not a universal 14-day maximum. |
| Account-deletion evidence and backup reconciliation records | Limited request and owner identifiers, hashes, generations and dates while a retained copy could restore deleted data, and for any justified rights-accountability or claim period. These are pseudonymous records, not necessarily anonymous. |
| New database restore history and other backup copies | Until each copy expires under its configured retention or is removed. The new database restore window must be distinguished from the old-site archive. A backup can retain a restricted copy after deletion from the active database. |
| Old website database | Kept separately for transition support, old-record requests and existing purchases. The new website does not automatically delete the old database. Ari handles requests about old records; continuing course and legally required transaction records have their own purposes and retention rules. |
The old database supports transition questions, old-account rights requests and continuity of existing purchases. Only people authorized to handle those tasks may use it. It is not imported wholesale into the new account database or used to restart marketing. You can ask Ari for access or deletion of old records; keeping an archive does not suspend your rights.
After we accept account deletion, access is blocked while removal is processed. Deletion from the active database does not immediately remove retained backup copies. Restoring a backup requires separate reconciliation of completed deletion requests; account deletion alone does not perform that reconciliation. Requests concerning provider copies and the old database are handled separately through Ari, subject to lawful retention exceptions.
8. Your Rights
You can write to ari@entermedschool.com to ask what we hold about you and why, receive a copy, correct it, request deletion or restriction, or object to processing based on legitimate interests. Where the legal conditions apply, you can receive data you supplied in a portable format or ask for it to be transferred.
You can withdraw consent at any time. This does not change whether earlier processing was lawful. You can always object to direct marketing, including related profiling, without giving a reason. For other legitimate-interest uses, explain your situation so we can assess the objection.
Use an unsubscribe link for the messages it covers, or change available email choices in your account. For an opening-notification list, use its removal control where available or email us from the address you used. A general mail switch may not remove a separate interest entry. You do not have to create an account to leave a list. A new subscription after withdrawal needs a fresh choice from you.
We verify requests using information proportionate to the risk. We do not require an unusable password or ask for identity documents by default. Requests are normally free. We respond without undue delay and within one month; if complexity or the number of requests justifies up to two additional months, we explain the extension within the first month. If we cannot act, we explain why and how to challenge that decision.
You have the GDPR protections that apply to decisions based solely on automated processing with legal or similarly significant effects, including human intervention and contesting the decision where required. You may complain to the Garante per la protezione dei dati personali, the Italian supervisory authority, or another competent authority, including where you live or work in the EEA. You do not need to contact us first or wait through a contractual dispute period.
8.1 Self-Service Controls
Settings provide account export and deletion controls, but they are not the only way to exercise your rights. The account export includes email preferences and opening-notification entries matching your current account email. Provider records, old-site records and entries under another email address need a separate request. Ask Ari for a complete access response or for records beyond an export limit.
An account with a password confirms that password for export or deletion. An account that uses only Google sign-in can confirm again with Google. If you cannot complete self-service verification, email Ari for help with a verified request. Email Ari for a birth-date or email correction that settings cannot make. Clearing your browser does not close your account or remove provider records.
9. International Data Transfers
Some providers and support teams process data outside the European Economic Area. Frankfurt database storage alone does not keep every support interaction, log, backup or onward transfer in Europe.
The safeguards depend on the recipient: an applicable European Commission adequacy decision, the EU-US Data Privacy Framework for a covered certified US recipient and activity, or EU Standard Contractual Clauses with any additional protections required. New Zealand and Israel have adequacy decisions. These do not automatically cover onward transfers to other countries.
Section 5 identifies the relevant provider arrangements. A provider offering a DPA is different from that agreement applying to a particular account. Our applicable contracts, recipient roles and transfer coverage must support each transfer; consent to these terms is not a substitute for that protection.
Contact ari@entermedschool.com for the recipient and safeguards applying to your information, including a copy of the relevant safeguards with confidential details removed where needed.
10. Data Security
We use access controls, password hashing, protected connections, encrypted fields and safeguards for sensitive actions. Some metadata, such as account identifiers and derived age-control dates, is stored separately from encrypted profile fields. We do not claim that every field or provider copy is encrypted in the same way.
No website can promise perfect security. Third-party scripts can access information in the page where they run; click-to-load is a control over when chat starts, not complete isolation. We limit access and review incidents. Where a breach creates the relevant risk, we notify the supervisory authority and affected people as required by law.
Please keep your sign-in details private and do not put real patient information, medical records, passwords or payment-card details into study material, feedback or chat. This is an educational website, not a place to store clinical records.
11. Children's Privacy
An EnterMedSchool account requires you to be at least 16. If you are 16 or 17, read this notice and the terms with a parent, guardian or trusted adult if you need help. A parent or guardian must authorize use or make a purchase where the law requires it. An adult buying a course for you does not automatically gain access to all your private account data.
The minimum account age does not give a minor adult capacity to enter a contract. Parental authorization may still be required under the law that applies to a particular use or purchase.
We use age information to apply eligibility and protections, not advertising. Contact ari@entermedschool.com if you think we have information about a child who is not eligible, or if an age record is wrong. We assess the request and remove information that we have no lawful reason to keep.
12. Changes to This Policy
We update this notice when our processing changes. We show the updated date and give an appropriate notice of significant changes before new processing begins. If a change needs fresh consent, we ask for it. An update does not turn an earlier refusal into consent.
13. Contact Us
Ari Horesh, EnterMedSchool, Via Francesco Orsi 27, 27100 Pavia (PV), Italy. VAT: IT02865360180. Email: ari@entermedschool.com. For requests about the old website or an existing course, tell us which service you used so we can find the right records. Do not send a password or verification code.