Privacy Policy

1. Introduction

MASTERMED PTY LTD (ABN 43 686 310 556) ("MasterMed", "we", "us", or "our") is committed to protecting the privacy of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the MasterMed platform.

2. Information We Collect

We collect the following types of personal information:

• Account information: name, email address, and password when you create an account.
• Study profile: details you provide during onboarding, such as your education level, UCAT experience, and exam date, used to personalise your preparation.
• Payment information: billing details processed securely through Stripe. We do not store your credit card numbers.
• Usage data: information about how you interact with the platform, including practice sessions, test results, and time spent on questions.
• Site visit data: pages visited and time spent on them, referrer, approximate location derived from your IP address (city/region level), device and browser type, screen size, and language — linked to a first-party visitor identifier (see Cookies and Tracking below) and to your account when you are signed in.
• Security audit logs: records of security-relevant events (sign-in, sign-up, password and email changes, subscription changes) including the IP address and user agent at the time of the event, used to detect and prevent fraud and unauthorised account access.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the MasterMed platform.
• Process your subscription payments.
• Generate your performance analytics and percentile rankings.
• Communicate with you about your account, updates, and support.
• Measure the effectiveness of our advertising (including Google Ads conversion measurement and remarketing audiences).
• Ensure the security and integrity of our platform.
• Detect and prevent fraudulent activity, including limiting the number of free trial accounts created from the same network in a short period.
• Comply with legal obligations.

4. Cookies and Tracking

We use the following cookies and tracking technologies:

• Our own visitor identifier:a first-party cookie (mm_visitor_id, 12 months) that links your page visits together. If your browser sends a "Do Not Track" signal, our own analytics tracker does not record your visits.
• Google: advertising cookies used to measure ad conversions and build remarketing audiences. You can opt out at Google Ads Settings.
• HubSpot: cookies supporting our website chat widget and visitor tracking.
• Sentry: error monitoring that records technical diagnostics, including limited replays of a sample of browsing sessions and of sessions where errors occur, with typed text masked.

You can block or delete cookies through your browser settings; core platform features will still work, though some support features (like chat) may not.

5. Data Sharing and Disclosure

We do not sell your personal information. We share information with the following service providers, strictly for the purposes described:

• Stripe — payment processing.
• Supabase — database and authentication hosting.
• Vercel — website hosting and delivery.
• Google — advertising conversion measurement and remarketing.
• HubSpot — support chat and visitor tracking.
• Sentry — error monitoring and diagnostics.
• Resend — sending account and service emails.
• Legal requirements — when required by law, regulation, or legal process.

6. Overseas Disclosure

Some of the providers above store or process data outside Australia — in particular, Google, HubSpot, Sentry, Resend, and Vercel are US-based. Our primary database is hosted in Australia (Supabase Sydney region). Where personal information is disclosed overseas, we rely on contractual data-protection commitments from each provider and remain accountable for your information under Australian privacy law.

7. Data Security

We implement industry-standard security measures to protect your personal information, including encryption in transit and at rest. However, no method of transmission over the Internet is 100% secure.

8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide our services. You may request deletion of your account at any time by contacting us. When you delete your account we remove your account profile and study data; site-visit analytics records are de-identified (unlinked from your account) and then deleted on the 90-day cycle below.

• Site visit data (page views) is automatically deleted after 90 days.
• Financial records (subscription, payment, and invoice events) are retained for seven (7) years to meet our obligations under the Corporations Act 2001 and Australian tax law.
• Security audit logs are retained for up to seven (7) years for fraud detection and dispute resolution, then automatically deleted.

9. Users Under 18

Many of our users are secondary school students preparing for the UCAT. We collect only the information described in this policy, regardless of age, and we never sell anyone's personal information. If you are under 18, we encourage you to involve a parent or guardian when creating an account or subscribing. A parent or guardian may contact us at any time at support@mastermed.com.au to ask about, correct, or delete the personal information of an under-18 user in their care.

10. Marketing Communications

We send two kinds of email: service messages (account, billing, security, and changes to our terms — these are part of operating your account) and marketing messages (product news and offers). Every marketing email contains an unsubscribe link, and you can also opt out from your account settings or by contacting us. Opting out of marketing never stops service messages.

11. Your Rights

Under the Australian Privacy Act 1988, you have the right to access, correct, and request deletion of your personal information. To exercise these rights, contact us at support@mastermed.com.au.

12. Data Breaches

If we suspect a data breach, we assess it promptly. Where a breach is likely to result in serious harm, we will notify affected users and the Office of the Australian Information Commissioner (OAIC), consistent with the Notifiable Data Breaches scheme.

13. Complaints

If you believe we have mishandled your personal information, email support@mastermed.com.au with the subject "Privacy Complaint". We aim to respond within 30 days. If you are not satisfied with our response, you can complain to the OAIC at oaic.gov.au.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of changes by email with a link to the updated policy, and by updating the "Last reviewed" date on this page.

15. Contact Us

If you have questions about this Privacy Policy, contact us at: support@mastermed.com.au

MASTERMED PTY LTD, 81-83 Campbell Street, Surry Hills NSW 2010, Australia.