Privacy Policy

Mediprep Pro (“we”, “us”, “our”) operates the Mediprep Pro exam preparation platform and is the data controller responsible for the personal information described in this policy. You can reach us about any privacy matter at info@mediprep.net.

We collect the following categories of information:

• Account information — your first name, last name, email address, password (stored only in encrypted form), profession and country, provided when you register or update your profile.
• Approximate location — when you sign in we look up the country associated with your IP address using a third-party service (ipinfo.io). We use the country only to present the correct payment provider and currency. We do not collect precise or GPS-level location data.
• Study and performance data — the exams you have access to, tests you start and complete, the answers you submit, your scores and analytics, and questions you tag or report.
• Transaction information — a record of the exams you have purchased, the amount, the currency and the payment reference returned by our payment provider.
• Support correspondence — the content of messages you send us through the support form or by email.
• Technical information — standard server log data such as IP address, browser type and timestamps, generated automatically when you access the Service.

We do not collect or store your full payment card details. Card data is captured and processed directly by our payment providers.

We use personal information to:

• create and administer your account and authenticate you;
• provide the Service, including delivering question banks, running mock exams and generating your performance analytics;
• process payments and give you access to the exams you buy;
• determine which payment provider and currency to show you, based on your country;
• respond to your support requests and to questions you report as inaccurate;
• send you service messages such as email verification, password resets and subscription notices;
• monitor, secure, troubleshoot and improve the Service, including reviewing reported questions to correct our content; and
• comply with our legal obligations and enforce our Terms and Conditions, including preventing account sharing and misuse.

Where the EU or UK GDPR applies to you, we rely on the following legal bases: performance of a contract, to provide the Service you have signed up for and to process your payments; legitimate interests, to secure and improve the Service and to prevent misuse; legal obligation, to meet accounting, tax and other statutory requirements; and consent, where we ask for it separately, such as for optional marketing messages. You can withdraw consent at any time without affecting processing already carried out.

Where the Nigeria Data Protection Act applies, we process your data on the equivalent lawful bases available under that Act.

Payments are processed by Paystack and by Stripe, depending on your location. When you check out, you are interacting with the payment provider directly and your card details are submitted to them, not to us. We receive only confirmation of the outcome together with a transaction reference.

These providers act as independent controllers of the payment data they collect, and their own privacy policies govern that processing.

We use your browser's local storage rather than advertising cookies. Specifically, we store your authentication token so that you remain signed in between visits, and a copy of your basic profile details so that pages load without re-fetching them.

This storage is strictly necessary to operate the Service. You can clear it at any time through your browser settings, though doing so will sign you out. We do not use third-party advertising or cross-site tracking cookies.

We do not sell your personal information. We share it only with:

• Payment providers (Paystack, Stripe) to take payment and handle refunds and chargebacks;
• Hosting and infrastructure providers who host our application, database and uploaded images on our behalf;
• An IP geolocation provider (ipinfo.io) to determine your approximate country;
• Email delivery providers used to send verification and account emails;
• Professional advisers and authorities where we are required to disclose information by law, or to establish, exercise or defend legal claims; and
• A successor entity in the event of a merger, acquisition or sale of assets, subject to this policy continuing to apply.

Our service providers act on our instructions and are bound to protect your information.

Our infrastructure is hosted outside Nigeria, and our service providers operate in a number of countries. This means your personal information may be transferred to and processed in countries whose data protection laws differ from those of your own country.

Where we transfer personal data internationally, we take steps to ensure an appropriate level of protection, including relying on standard contractual clauses or equivalent safeguards where required.

We keep your account and study data for as long as your account remains open, so that your purchase history and performance analytics stay available to you. If you close your account, we delete or anonymise your personal information within a reasonable period, except where we must retain it longer.

Transaction records are retained for the period required by applicable accounting and tax law. Backups are cycled out on a rolling schedule.

We use technical and organisational measures to protect your information, including encrypted connections (HTTPS), hashed password storage, token-based authentication and role-based access controls that restrict administrative access to authorised staff.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant regulator where the law requires it.

Depending on where you live, you may have the right to access a copy of your personal information; to have inaccurate information corrected; to have your information deleted; to restrict or object to certain processing; to receive your information in a portable format; and to withdraw consent where processing is based on it.

You can update your name, profession and other profile details directly from your account settings. For any other request, contact us at info@mediprep.net and we will respond within the time limit set by the applicable law. You also have the right to complain to your data protection authority — in Nigeria, the Nigeria Data Protection Commission.

The Service is intended for users aged 16 and over and is not directed at children. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

We may update this Privacy Policy to reflect changes to the Service or to legal requirements. When we make material changes we will update the “Last updated” date above and, where appropriate, notify you through the Service or by email.

For any question about this policy or to exercise your rights, contact us at info@mediprep.net.