Privacy Policy

Effective Date: November 4, 2026

Last Updated: November 4, 2026

Alma ("Alma," "we," "us," or "our") respects the privacy of people who use our website (https://almastudy.com), our learning platform, and any other services we offer (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, and the rights you have over your information.

In this policy, "you" and "your" refers to any person or entity subscribing to and/or using the Service ("Users"). The Service is operated by MeDucation AI Inc., a company incorporated in Canada.

By using the Service, you agree to the practices described in this policy. If you do not agree, please do not use the Service.

1. Information We Collect

We collect information when you register for, access, or use the Service. The categories of information we collect include:

Account and identifier information

• Full name
• Email address
• Account credentials

Educational and professional information

• School or program attended
• Country of residence
• Date of your upcoming exam (e.g., USMLE Step 1, NCLEX-RN, AANP, PANCE)
• Profession and stage of training (medical, nursing, NP or PA student; qualified clinician)

Personalization information

Hobbies, interests, and preferences you provide so we can personalize your learning experience and tailor AI-generated responses

User content

• Notes, PDF documents, and other study materials you upload to the Notebook feature
• Flashcards, mind maps, knowledge graphs, and other learning artifacts you create
• Quiz answers, performance data, and study history
• Messages, comments, and forum posts (where applicable)

Payment information

Billing details processed through our payment processor, Stripe. We do not store full credit card numbers on our servers.

Automatically collected information

• IP address, browser type, device type, operating system, and language settings
• Pages viewed, features used, time spent, and interaction data
• Error logs and diagnostic data (collected via Sentry)
• Usage analytics (collected via Google Analytics, with cookies only if you accept them): see Section 9

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Personalize your learning experience and AI-generated content based on your stated interests, exam date, and study goals
• Process payments and manage subscriptions
• Generate flashcards, mind maps, knowledge graphs, quizzes, and other learning materials from content you upload
• Communicate with you about your account, updates, and support requests
• Send you educational content, product updates and other marketing emails. You can unsubscribe at any time using the link in any of these emails.
• Detect, prevent, and respond to fraud, abuse, security incidents, or technical issues
• Comply with legal obligations and enforce our Terms of Service

Email communications. When you create an account, we add your email address to our mailing list, which is managed by our email provider Beehiiv. We send educational content, product news and occasional offers. Creating an account counts as opting in to these emails. Every marketing email includes an unsubscribe link, and unsubscribing does not affect your account or the emails we need to send about it, such as verification codes, password resets and billing notices.

3. AI Processing of Your Content

Alma uses third-party large language models ("LLMs") to power core features of the Service, including the Notebook, Ask My Notes, AI flashcard generation, mind map generation, question generation, and knowledge graph features.

Which third-party AI providers process your content:

• OpenAI
• Perplexity
• Groq

When you upload notes, PDFs, or other content to the Notebook, that content may be transmitted to one or more of the providers listed above for processing. We select providers based on the feature being used and may route requests to whichever provider is best suited to the task.

Voice conversations with Alma

When you start a voice call, audio from your microphone is streamed to OpenAI, which runs the spoken conversation, only while the call is open. A written transcript of what you and Alma said is saved to your chat history, and we record how long each call lasted to apply your monthly voice allowance. To answer your questions, Alma reads your own notebooks, flashcards and Learning Hub documents, and sends a search query drawn from your question to PubMed (the U.S. National Library of Medicine) and, when PubMed finds nothing, to the Brave Search API. We do not add your name or account details to these searches.

Vector storage for retrieval (RAG)

To enable retrieval features such as Ask My Notes, content you upload is converted into numerical representations called embeddings. These embeddings are stored in our vector databases (PostgreSQL with the pgvector extension, and ChromaDB) so the Service can retrieve relevant passages when you ask questions about your own materials.

No model training on your content

We do not use your uploaded content, your notes, your generated questions, your queries, or any other user-submitted content to train, fine-tune, or otherwise improve any AI model — ours or any third party's. Our agreements with the LLM providers above prohibit them from training their models on content submitted through their APIs.

4. Sub-Processors and Service Providers

We share information only with service providers who help us operate the Service. We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.

We require each sub-processor to handle your information consistently with this policy and applicable law. An up-to-date list of sub-processors is available on request by emailing support@almastudy.com.

5. Institutional Customers

When you access the Service through an institutional subscription (e.g., a medical school, a nursing school, an NP or PA program, or a hospital):

• The institution is the owner and controller of its account and the data generated by users within that account.
• Your institutional administrators may have access to usage data, including which features you use, your study activity, and aggregate performance metrics.
• The institution determines retention, deletion, and access rights for accounts under its subscription.
• If you have questions about how your institution handles your data, contact your institution's administrator.

Alma acts as a service provider (or "data processor" under GDPR) on behalf of the institution for institutional accounts.

6. Sharing Within Organizations

Users who belong to the same institutional organization may share flashcard decks with one another. When you share a flashcard deck, your identity (name and account) is visible to the recipient. If you do not want your identity to be visible, do not share decks.

We do not share user content across organizations. Content created by one institution's users is not visible to another institution's users.

7. Data Storage, Security, and International Transfers

Storage location.

Your data is stored in AWS data centers located in the United States and Canada.

International transfers.

Because our LLM and other service providers operate primarily in the United States, your information will be transferred to and processed in the United States and may be transferred to other countries where our service providers operate. These countries may have data protection laws that differ from those in your home country. By using the Service, you acknowledge and consent to these transfers. We rely on contractual safeguards (including standard contractual clauses, where applicable) to protect your information during international transfers.

Security.

We use industry-standard administrative, technical, and physical safeguards to protect your information, including encryption in transit, access controls, and routine security review. No system is perfectly secure, and we cannot guarantee absolute security.

8. Data Retention

We retain your information for as long as your account is active and for as long as necessary to provide the Service. After account deletion:

• Personal account data is deleted within a reasonable timeframe, except where retention is required for legal, financial, or fraud prevention purposes.
• Institutional account data is retained according to the institution's instructions.
• Backups and archived data may persist for a limited period after deletion before being permanently removed.
• Aggregated, de-identified data that can no longer be linked to you may be retained indefinitely.

You can request deletion of your data at any time by emailing support@almastudy.com.

9. Cookies and Tracking Technologies

We use Google Analytics 4, a service of Google, to understand which parts of the Service are used and how, so that we can decide what to improve and build.

Your choice

Analytics cookies are off until you accept them. When you first visit our website, a notice asks you to Accept or Decline. If you decline, or ignore the notice, Google Analytics sets no cookies and cannot recognise your browser between visits or link a visit to your account. It still receives the page and feature information described below, without a cookie or an account identifier. If you accept, it may set cookies (named _ga and _ga_ followed by an identifier) that recognise your browser across visits. You can change your choice at any time with Cookie settings in the footer of any public page (if you are signed in, open a public page such as this one). Declining after you accepted removes those cookies.

What Google Analytics receives

• The pages you visit: the address and the page title, without sign-in codes, tokens, or anything after a # symbol. Other parts of the address, such as which book, case or article you opened, are included.
• Technical details that Google works out from your browser, such as browser, device, language and approximate location. According to Google, Google Analytics 4 does not log or store IP addresses.
• For signed-in learners, which feature you open (for example flashcards, quizzes or the notebook) and the kind of action you take in it (for example generate, review, delete, export or ask), whether it worked, and roughly how long it took, as a range such as "under one second".
• When you sign up or sign in: the method you used (Google or e-mail), your account type (for example student) and, if you came from one of our articles, which article. When you send a support request or view pricing: that it happened and which pricing page. When you start a free trial, go to checkout or come back from a completed checkout: that it happened, which plan, and whether it was monthly or annual (never a card number or an amount). When you play the What Is game: the points of each clue, whether your answer was right or wrong, how it was graded, and your final score.
• If you are signed in and have accepted analytics cookies, a random account identifier, so that visits by the same learner on different devices count as one person. It is not your name, e-mail address or any content. If you decline, it is not sent.

Google Analytics never receives your name, e-mail address, phone number, messages or questions to Alma, notes, flashcards, uploaded files, anything you generate, or the titles of your own notes, decks or files.

Google Analytics keeps event and user-level data for 14 months and then deletes it. Reports built from aggregated data are not affected.

You can opt out of Google Analytics by installing the Google Analytics Opt-Out Browser Add-on at https://tools.google.com/dlpage/gaoptout, or by adjusting your browser's cookie settings.

We do not use third-party advertising cookies, and we do not engage in cross-site tracking. Google signals, ad personalisation and other advertising features are turned off in our Google Analytics property, and we do not share analytics data for advertising.

We do not respond to "Do Not Track" browser signals at this time.

Google tools on the sign-up and sign-in pages

The sign-up and sign-in pages load two tools from Google: reCAPTCHA, which checks that a person and not a bot is using the form, and Google Sign-In, which lets you use a Google account instead of a password. When one of those pages opens, Google's scripts run in your browser, Google receives technical information such as your IP address and how your browser interacts with the page, and Google may set its own cookies. This does not depend on your choice in the analytics notice: the tools load so that we can protect the forms and offer Google sign-in. Other pages of the website do not load them. How Google handles that information is described in the Google Privacy Policy. The fonts on our pages are served from our own servers, not from Google.

10. Your Privacy Rights

Depending on where you live, you have the following rights regarding your personal information:

For all users

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that we correct inaccurate or incomplete information.
• Deletion: Request that we delete your personal information, subject to legal exceptions.
• Withdraw consent: Withdraw your consent to processing where consent is the basis for processing.
• Portability: Request a copy of your information in a portable format.
• Object: Object to certain processing activities.
• Complaint: Lodge a complaint with the relevant data protection authority.

Canadian users (PIPEDA, Quebec Law 25, BC PIPA, Alberta PIPA)

You may file a complaint with the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca) or your applicable provincial commissioner.

California users (CCPA / CPRA)

You have the right to know, delete, correct, and opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under California law. You also have the right not to be discriminated against for exercising these rights.

EU/UK users (GDPR / UK GDPR)

You may also lodge a complaint with your local data protection authority.

To exercise any of these rights, email support@almastudy.com. We may need to verify your identity before fulfilling your request. We will respond within the timeframe required by applicable law.

11. Children

The Service is intended for users 18 years of age and older. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from someone under 18, we will delete it. If you believe a minor has provided information to us, contact support@almastudy.com.

12. Privacy Officer and Accountability

We designate a Privacy Officer who is accountable for our compliance with this Privacy Policy and applicable privacy laws.

Privacy Officer

Roupen Odabashian
MeDucation AI Inc.
Email: support@almastudy.com

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (if you have opted in to communications) and by updating the "Last Updated" date at the top of this policy. Continued use of the Service after the effective date of any change constitutes your acceptance of the updated policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, contact us at:

MeDucation AI Inc.

Email: support@almastudy.com
Website: https://almastudy.com
Privacy Officer: Roupen Odabashian

This Privacy Policy is provided for informational purposes and does not constitute legal advice. We recommend a review by qualified legal counsel before publication, particularly before signing institutional contracts.