Sign in to start your session
Sign in to start your session
Effective Date: August 18, 2026 · Last Updated: August 18, 2026
Welcome to MedEdPrep. These Terms of Service ("Terms") govern your access to and use of the MedEdPrep testing platform available at mededprep.com and student.mededprep.com, including all associated features, content, and services (the "Service"), operated by MedEdPrep, LLC, a Georgia limited liability company ("MedEdPrep," "we," "us," or "our").
By creating an account, signing in for the first time to an account provisioned for you by your educational institution, or otherwise using the Service, you agree to these Terms and our Privacy Policy. If you do not agree, do not use the Service.
Important: MedEdPrep is a test preparation and exam delivery platform. Practice exams, study resources, and score reports are educational tools — they do not guarantee any certification, licensure, examination, or accreditation outcome, and MedEdPrep is not affiliated with any certifying or accrediting body unless expressly stated.
You must be at least 13 years of age to use the Service. Minors may use the Service only when authorized by their educational institution or with the consent of a parent or guardian; institutions enrolling minors are responsible for obtaining any required parental or guardian consent under applicable state law and institutional policy.
In these Terms:
"Customer" or "Institution" refers to an educational institution, school district, agency, or program that has contracted with MedEdPrep — including by purchase order — to provide access to the Service for its students and personnel.
"Direct Purchase" refers to a subscription or product you purchase directly from MedEdPrep for your own use.
"Institution-Administered Assessment" refers to an exam, assignment, or other assessment administered to you through the Service under an Institution's engagement, such as unit exams, exit exams, and assigned homework.
An account may include both individually purchased products and institution-administered assessments; these Terms apply to each according to its type. Where a provision addresses Direct Purchases, it applies to your directly purchased products and subscriptions; where a provision addresses Institution-Administered Assessments or institution-managed records, it applies to activity and records under your Institution's engagement, and the Institution acts as the Customer for that activity.
MedEdPrep is a test preparation and exam delivery platform for medical education. The Service provides:
Practice examinations and adaptive exams with scoring and domain-level performance reporting
Delivery of institution-administered assessments, including end-of-pathway and program exams
Study resources, including study guides and course video content
Homework assignment and submission tools
Progress reporting for students, instructors, and program administrators
Exam accommodation support (such as extended testing time) as authorized by the Institution
Administrative exports and reports for institutional customers
Pricing: Certain features are available by paid subscription or purchase; institutional access is governed by the applicable agreement or purchase order. We will provide reasonable advance notice of pricing changes that affect existing subscribers.
You are responsible for maintaining the confidentiality of your account credentials. Do not share your credentials with any other person; the Service enforces a single active session per account.
You must provide accurate information during registration, including your real name and a valid email address.
You are responsible for all activity that occurs under your account, and you may not assign or transfer your account to any other person.
Notify us promptly at [email protected] if you believe your account has been compromised.
Institutions are responsible for managing access they provision, including promptly deactivating accounts for students no longer affiliated with the program. Deactivation of institution-provisioned access does not affect any active Direct Purchase on the same account.
The Service is provided exclusively for legitimate educational and test preparation purposes. You agree NOT to:
Compromise exam integrity — take an exam on another person's behalf, permit another person to take an exam on yours, or use unauthorized aids or assistance during any assessment administered through the Service.
Reproduce or share exam content — copy, photograph, record, publish, or distribute exam questions, answers, or other assessment content in any form. Exam content is confidential and proprietary.
Misuse credentials — share login credentials or access another user's account.
Scrape or harvest — use automated scripts, bots, or other tools to extract data or content from the Service.
Interfere with the Service — attempt to disrupt, overload, reverse engineer, or compromise the Service's infrastructure or security, or access any part of the Service not intentionally made available to you.
Resell or redistribute — resell access to the Service or use it to build a competing product. MedEdPrep content is not for resale.
Violate applicable law — use the Service in any way that violates federal, state, or local laws, including laws governing student educational records.
We reserve the right to investigate violations and take appropriate action, including invalidating exam results obtained in violation of this section and suspending or terminating accounts.
Human review of integrity findings: Before we take action against your account or your results based on a suspected integrity violation, the finding will be reviewed by a human — we do not take adverse action on automated flags alone. For Institution-Administered Assessments, we report integrity findings to the Institution, and the final determination of any academic consequence rests with the Institution under its own policies.
This Section 5 applies to Direct Purchases. Access provided through your Institution is paid for under the Institution's agreement, purchase order, or invoice terms, and nothing in this section imposes any charge on you for institution-provisioned access.
Payments for Direct Purchases are processed by Stripe. By purchasing, you authorize the applicable recurring or one-time charges. Paid subscriptions renew automatically at the end of each subscription term (monthly, quarterly, or yearly, as selected at purchase) at the then-current price, until you cancel.
You may cancel your subscription at any time from your account settings or by emailing [email protected]. If you request a refund within 48 hours of purchase, you will receive a full refund and your account will revert to free (non-paid) access. After 48 hours, the current month is not refundable, but no future months will be charged. If you cancel a quarterly or yearly subscription, completed months are charged at the regular full monthly (non-discounted) price and the remainder is refunded.
Institution-administered assessment records: Records generated through Institution-Administered Assessments — including exam results, scores, and related progress data — are education records of the Institution. The Institution owns and controls these records, and MedEdPrep processes and stores them on the Institution's behalf as a service provider, as described in our Privacy Policy. Requests concerning these records (including access, correction, and deletion requests) are routed through the Institution. Institutions may request exports of their data while their engagement is active.
Your data: You retain ownership of the personal information you provide, and of records generated through your Direct Purchases.
License to operate: By submitting data to the Service, you grant MedEdPrep a non-exclusive, royalty-free license to host, store, process, and display that data solely for the purpose of operating and providing the Service. This license ends as to any data when that data is deleted from the Service.
Limited use: MedEdPrep uses Customer and User data only to provide, maintain, and improve the Service. We do not sell student education records.
All software, exam content, question banks, study materials, designs, report formats, interfaces, and other content within the Service are owned by MedEdPrep, LLC or its licensors and are protected by copyright and other intellectual property laws. You are granted a limited, non-exclusive, non-transferable, revocable license to use the Service and its content for your personal educational use (or, for Institutions, the authorized educational use of your program) only. You may not reproduce, distribute, modify, publicly display, reverse engineer, or create derivative works from any platform content without prior written permission from MedEdPrep.
If you provide feedback, suggestions, or ideas about the Service, you grant MedEdPrep a non-exclusive, perpetual, irrevocable, royalty-free, worldwide license to use, modify, and incorporate such feedback for any purpose, without obligation or compensation to you.
MedEdPrep respects the intellectual property rights of others. If you believe content on the Service infringes your copyright, send a written notice to our designated agent, registered with the U.S. Copyright Office:
DMCA Agent MedEdPrep, LLC 338 Leggett Rd Dallas, Georgia 30157 Telephone: (470) 300-0090 Email: [email protected]
Your notice must include: (1) identification of the copyrighted work; (2) identification of the allegedly infringing material; (3) your contact information; (4) a statement of your good faith belief that the use is not authorized; (5) a statement under penalty of perjury that the information is accurate and you are authorized to act for the copyright owner; and (6) a physical or electronic signature of the copyright owner or authorized agent. We will respond to valid notices in accordance with the Digital Millennium Copyright Act, 17 U.S.C. § 512. Repeat infringers may have their accounts terminated.
The contents of the Service — text, graphics, images, and other materials — are for educational and informational purposes only. The content is not intended to be a substitute for professional medical advice, diagnosis, or treatment. Always seek the advice of a physician or other qualified health provider with any questions regarding a medical condition.
Our collection and use of personal information is described in our Privacy Policy, which is incorporated into these Terms by reference. In brief: we collect what we need to operate the Service, we do not sell personal information, and we do not use student data for advertising.
In the event of a confirmed security incident affecting your personal information, MedEdPrep will provide notice without unreasonable delay and as required by applicable law. For institution-managed records, MedEdPrep notifies the Institution and supports the Institution's own notification duties; direct notice to you applies to personal information associated with your individual consumer account. Institutional agreements may specify faster institution-facing notice windows.
We strive to maintain consistent availability of the Service, but we do not guarantee uninterrupted, error-free, or loss-free operation. The Service may be temporarily unavailable due to scheduled maintenance, updates, or circumstances beyond our control. Any service levels committed to an Institution are set out in that Institution's agreement.
Force Majeure: MedEdPrep shall not be liable for any failure or delay in performance due to causes beyond its reasonable control, including but not limited to acts of God, natural disasters, pandemics, cyberattacks, third-party service provider failures, government actions, or interruptions in internet or telecommunications service.
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. MEDEDPREP DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR FREE FROM DATA LOSS, NOR THAT USE OF THE SERVICE WILL RESULT IN ANY PARTICULAR EXAMINATION, CERTIFICATION, OR ACADEMIC OUTCOME.
TO THE MAXIMUM EXTENT PERMITTED BY LAW, MEDEDPREP AND ITS OFFICERS, DIRECTORS, EMPLOYEES, AND AGENTS SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE, INCLUDING WITHOUT LIMITATION LOSS OF DATA, EXAMINATION OR CERTIFICATION OUTCOMES, OR ANY DAMAGES RESULTING FROM RELIANCE ON CONTENT PROVIDED THROUGH THE SERVICE.
OUR TOTAL LIABILITY FOR ANY CLAIM ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE SHALL NOT EXCEED THE TOTAL AMOUNT PAID TO MEDEDPREP BY THE CLAIMANT FOR THE SERVICE IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR ONE HUNDRED DOLLARS ($100 USD) IF GREATER.
Some jurisdictions do not allow the exclusion of certain warranties or the limitation of liability for certain damages. In those jurisdictions, our liability is limited to the greatest extent permitted by law. Nothing in these Terms limits liability for gross negligence or willful misconduct, or any liability that cannot be limited under applicable law.
Institution-provisioned access: This section does not apply to your access to and use of the Service provided through an Institution, including your participation in Institution-Administered Assessments. Any indemnification relating to an Institution's engagement is governed by the Institution's agreement with MedEdPrep.
Direct Purchases: With respect to your use of the Service under a Direct Purchase, you agree to indemnify and hold harmless MedEdPrep, LLC, its officers, employees, and agents from third-party claims, damages, losses, or expenses (including reasonable attorneys' fees) to the extent arising from: (a) your willful misconduct; (b) your infringement of a third party's intellectual property rights; or (c) your violation of applicable law.
Mechanics: MedEdPrep will provide you prompt written notice of any claim subject to this section and reasonable cooperation in its defense, at your expense. You may not settle any indemnified claim in a manner that imposes any obligation or admission on MedEdPrep without MedEdPrep's prior written consent, and you have the right to participate in the defense of any indemnified claim at your own expense.
This indemnification obligation does not apply to the extent a claim arises from MedEdPrep's gross negligence, willful misconduct, or material breach of these Terms.
Public institutions: If you are a state or local government entity (including a public school district or public college), your indemnification obligations apply only to the extent permitted by the constitution and laws of your state, and nothing in these Terms waives any sovereign or governmental immunity to which you are entitled.
If your Institution has entered into a separate written agreement, purchase order, data processing agreement, or data privacy agreement with MedEdPrep, the terms of that agreement control over these Terms to the extent of any conflict, for the Institution and its authorized Users.
By you or your Institution: You may stop using the Service at any time. Institutions may terminate by contacting [email protected]; institution-provisioned access may be deactivated by the Institution at any time.
By us — for cause: For violations of these Terms that pose an immediate risk to the Service, to exam integrity, or to other users, we may suspend or terminate accounts immediately upon notice.
By us — all other cases: For all other terminations of institutional engagements, we will provide at least 30 days' written notice to the email address on file.
Effect of termination: Upon termination, your right to use the Service ceases. For institutional customers, MedEdPrep will provide a reasonable window of not less than 30 days to request an export of the Institution's data before deletion, and personal information will thereafter be handled in accordance with our Privacy Policy. Provisions that by their nature should survive termination will survive, including Sections 4 (exam-integrity and confidentiality obligations), 5 (as to amounts accrued before termination), 6 (except the license to operate, which ends when the associated data is deleted), 7, 8, 11, 12, 13, 14, 16, 17, and 18.
Informal resolution: Before either you or MedEdPrep initiates arbitration or a court proceeding (other than a small claims action or a request for injunctive relief permitted by this section), the party raising the dispute will send the other a written notice describing the dispute — to [email protected] if to us, or to your email address on file if to you — and both parties will attempt in good faith to resolve the dispute informally for at least 60 days. Most concerns can be resolved this way. Any applicable statute of limitations, and any deadline for paying arbitration filing fees, is tolled during this informal resolution period.
Binding arbitration: If we cannot resolve a dispute informally, you and MedEdPrep agree to resolve any disputes arising out of or relating to these Terms or the Service through final and binding individual arbitration administered by the American Arbitration Association ("AAA"). Disputes brought by or against you as an individual will be administered under the AAA Consumer Arbitration Rules. Disputes involving an Institution are resolved as provided in the Institution's agreement with MedEdPrep or, if that agreement does not address dispute resolution, under the AAA Commercial Arbitration Rules. The arbitration will be conducted remotely to the extent possible, or in Georgia if an in-person hearing is required.
Arbitration fees: MedEdPrep will pay all AAA filing fees and arbitrator costs for claims under $10,000. For claims above $10,000, fees and costs will be allocated in accordance with AAA Consumer Arbitration Rules. MedEdPrep will not seek attorneys' fees from you in arbitration unless the arbitrator determines your claim was frivolous.
Exceptions to arbitration: This arbitration agreement does not prevent: (a) either party from bringing an individual action in small claims court for disputes within that court's jurisdictional limits; (b) either party from seeking public injunctive relief in court where a claim for such relief cannot lawfully be waived; or (c) either party from seeking injunctive or other equitable relief in a court of competent jurisdiction for actual or threatened infringement of intellectual property rights or breach of the exam-integrity and exam-content-confidentiality obligations in Section 4.
Class action waiver: YOU AND MEDEDPREP AGREE THAT EACH MAY BRING CLAIMS AGAINST THE OTHER ONLY IN YOUR OR ITS INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS, CONSOLIDATED, OR REPRESENTATIVE PROCEEDING. This class action waiver is a material and non-severable part of this arbitration agreement: if the waiver is found unenforceable as to a particular claim or request for relief, then that claim or request for relief (and only that claim or request) shall be severed from arbitration and proceed in court in accordance with Section 17, and all remaining claims shall be resolved in arbitration.
Opt-out right: You may opt out of this arbitration agreement and class action waiver by sending written notice within 30 days after you first accept these Terms, either by email to [email protected] or by mail to MedEdPrep, LLC, 338 Leggett Rd, Dallas, Georgia 30157, including your name, your email address, and a clear statement that you wish to opt out. Opting out will not affect any other part of these Terms or your use of the Service. If you opt out, disputes will be resolved in accordance with Section 17 (Governing Law).
Students under 18: If you are under 18 years of age, disputes concerning your use of the Service are raised and resolved through your Institution or through your parent or guardian on your behalf.
Changes to this section: Any changes to this Section 16 apply prospectively only; they do not apply to disputes that arose before the change took effect.
Public institutions: This Section 16 (including the arbitration agreement and class action waiver) applies to a state or local government entity only to the extent permitted by the constitution and laws of its state. Disputes with such entities that cannot lawfully be arbitrated will be resolved in accordance with Section 17, subject to any venue or forum requirements applicable to that entity.
These Terms are governed by and construed in accordance with the laws of the State of Georgia, United States, without regard to conflict of law principles. For disputes not subject to arbitration, any legal action shall be brought exclusively in the state or federal courts located in or serving Paulding County, Georgia, except as otherwise required by law for government entities.
Entire agreement: These Terms, together with our Privacy Policy and any applicable institutional agreement (see Section 14), constitute the entire agreement between you and MedEdPrep, LLC regarding the Service.
Severability: If any provision is found unenforceable, it will be replaced by an enforceable provision that most closely matches its intent, and the remaining provisions remain in full force. This does not apply to the class action waiver in Section 16, which is non-severable from the arbitration agreement as described there.
No waiver: Our failure to enforce any provision does not waive that provision.
Assignment: You may not assign your rights or obligations under these Terms without our prior written consent. MedEdPrep may assign its rights and obligations in connection with a merger, acquisition, or sale of assets, with notice to affected customers.
Electronic communications: You consent to receive communications from us electronically, and agree that such communications satisfy any legal requirement that they be in writing.
Notices: We may provide notices via email to the address on file or via in-app notice. Notices to MedEdPrep must be sent to [email protected]; legal notices should also be sent by mail to MedEdPrep, LLC, Attn: Legal, 338 Leggett Rd, Dallas, Georgia 30157.
Changes to Terms: We may update these Terms from time to time. For material changes, we will provide at least 14 days' advance notice by email or by prominent notice within the Service before the changes take effect, and we will update the Effective Date. Changes to Section 16 (Dispute Resolution) apply prospectively only. Material changes that affect an active institutional agreement will not degrade that agreement's terms without the Institution's consent. Continued use after changes become effective constitutes acceptance. Previous versions are available on request.
MedEdPrep, LLC 338 Leggett Rd, Dallas, Georgia 30157 Email: [email protected] Telephone: (470) 300-0090
Effective Date: August 18, 2026 · Last Updated: August 18, 2026
MedEdPrep, LLC, a Georgia limited liability company ("MedEdPrep," "we," "us," or "our") operates the MedEdPrep student testing platform at student.mededprep.com (the "Service"). The Service is a test preparation and exam delivery platform used by individual learners and by students of educational institutions — including colleges, technical colleges, EMS education programs, and high school career and technical education programs — to prepare for and take medical education assessments.
An account may include both individually purchased products and institution-administered assessments. This Privacy Policy applies to each record according to its type: records you create through a direct purchase are your individual consumer records, and institution-administered assessment records (such as unit exams, exit exams, and assigned homework) are education records controlled by your institution (your "Institution"), which we process and store on the Institution's behalf as a service provider.
This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and what choices you have. We are committed to protecting the privacy of our users, particularly students whose records are managed on behalf of an educational institution.
The short version: We collect only what we need to run the Service — your account details, your exam and study activity, and (for paid individual accounts) billing handled by Stripe. We do not sell your data. We do not use student data for advertising. We do not send student personal information to third-party AI services or use it to train generative AI models. Exam sessions are monitored for integrity. We share your data only with your institution (if you use the Service through one), and with the service providers who help us operate the platform.
Information We Collect
How We Use Your Information
How We Share Your Information
Educational Records and FERPA
Data Security
Children's Privacy
Cookies and Tracking
Data Retention
Your Rights
International Data Transfer
Governing Law
Changes to This Policy
Contact Us
Account information: First and last name, email address, and — depending on how your account was created — mailing address, phone number, education level, and school or program affiliation.
Institution-provisioned accounts: If your Institution or instructor created your account, they provide your name, email address, program or cohort assignment, and any exam accommodation settings (such as extended testing time) that your Institution has authorized for you. Accommodation settings are treated as confidential: they are visible only to personnel with a need to know and are used solely to deliver the accommodation your Institution has authorized.
Billing information (individual paid accounts): If you purchase a subscription or product directly, payment is processed by Stripe. Card details are collected and stored by Stripe — we retain only a payment reference, not your card number.
Exam and study activity: Exam attempts, answers, scores, domain-level performance, adaptive exam progression, homework submissions, and survey or questionnaire responses.
Exam-session monitoring: Exam sessions are monitored and analyzed for exam integrity, including session timing and interaction patterns. See Section 2 and Section 8.
Reports: Score reports and progress reports generated from your activity, available to you and — for institution-managed accounts — to your instructors and program administrators.
Device and browser information: Browser type and version, device type, and operating system, used for compatibility and security.
Usage data: Pages visited, features used, and interaction patterns (first-party click and usage logging used to operate and improve the Service).
Network information: IP address, used for security and abuse prevention.
Patient health information: The Service holds education and assessment records, not patient records. It is not used to deliver, bill for, or document clinical care. We do not request or require patient information; do not submit it through the Service.
Card numbers: Payment card details are held by Stripe, not by MedEdPrep.
We use the information we collect to:
Provide the Service: Deliver practice and certification-preparation exams, score and report results, track study progress, and apply institution-authorized exam accommodations.
Support your institution: Make student progress and results available to the instructors and administrators of the program you are enrolled in.
Process payments: Complete purchase transactions for individual paid accounts via Stripe.
Communicate with you: Send account-related and transactional email such as registration confirmations, password resets, exam notifications, and receipts.
Improve the Service: Analyze usage in aggregate to fix problems and improve features.
Maintain security and exam integrity: Detect and prevent unauthorized access, and monitor and analyze exam sessions — including session timing and interaction patterns — to protect the integrity of assessments.
Artificial intelligence and automated analysis: We do not transmit student personal information to third-party AI services, and we do not use it to train generative AI models. AI-assisted analysis — including exam-integrity review and assessment analytics — runs on systems under MedEdPrep's control. We use student responses to deliver and score assessments, including statistical (psychometric) models that calibrate question difficulty, estimate ability, and generate readiness indicators as part of the Service. Question and platform improvement uses de-identified and aggregated data.
Marketing communications: We do not use student data managed on behalf of an educational institution for marketing or advertising, and we do not advertise to students through the Service. Individual consumer account holders may occasionally receive promotional email about MedEdPrep products; you can opt out at any time using the unsubscribe link in any such email or by contacting [email protected].
Our role: When you use the Service through an educational institution, we act as a service provider on behalf of your Institution and use institution-managed records only for the educational purposes the Institution has authorized. For individual purchases, we use your information to provide the products and services you bought and to operate the platform, as described in this Policy.
We do not use your data to build advertising profiles. The Service does not serve ads, and we do not sell, rent, or trade your personal information to advertisers or data brokers.
We share your information only in the following limited circumstances:
With your institution: If you use the Service through an educational institution, your program administrators and instructors can view your exam results, progress, and related records as part of supervising your education. This is the core educational purpose of the Service.
With service providers (subprocessors): We use a limited number of third-party services to operate the platform:
Cloud infrastructure (AWS, US-East-1): Application hosting, database, and file storage.
Managed hosting and infrastructure services (Unified Infotech): Platform infrastructure management, maintenance, and backup administration.
Payment processing (Stripe): Payment collection and subscription billing for individual paid accounts.
Email delivery (SendGrid): Transactional email delivery.
Bot protection (Google reCAPTCHA): Abuse prevention on public forms.
Notifications (Google Firebase): Application notifications.
Image delivery (ImageKit): Image hosting and transformation.
Video hosting (Vimeo): Course video content delivery.
These providers access data only as needed to perform their services for us and are bound by contractual confidentiality obligations. Google reCAPTCHA and Vimeo process the data they receive through their embedded components under their own privacy policies. Survey and questionnaire pages are rendered using SurveyJS, a licensed software component that runs within the Service; SurveyJS is not a recipient of your data — your survey responses are stored by MedEdPrep.
When required by law: We may disclose information in response to a valid legal process such as a subpoena, court order, or government request. Where the legal process concerns institution-managed education records, we will notify the Institution before complying unless we are legally prohibited from doing so.
In aggregated or de-identified form: We may share aggregated statistical data (for example, pass rates or item performance) for research or reporting. We de-identify this data so that it is not reasonably capable of being linked to any individual, and we do not permit recipients to attempt re-identification.
Business transfers: In the event of a merger, acquisition, or sale of substantially all assets, your data may be transferred. We will notify affected institutions and users as and when permitted and required by law before any such transfer takes effect, and any successor will be bound by this Privacy Policy with respect to previously collected information.
We do not sell your personal information, and we do not share it with third parties for their own marketing or advertising purposes, including data brokers and cross-context behavioral advertising.
When the Service is used through an educational institution, student exam records, scores, and progress data may constitute "education records" under the Family Educational Rights and Privacy Act (FERPA). In that context:
Your institution controls its education records. MedEdPrep processes and stores this data on the Institution's behalf as a service provider, under the Institution's direction.
School official exception: MedEdPrep is prepared to operate as a "school official" with a legitimate educational interest under 34 CFR 99.31(a)(1), subject to the Institution's designation. We use education records only for the educational purposes authorized by the Institution and under the Institution's direct control.
Limited disclosure to subprocessors: Education records may be disclosed to the subprocessors listed in Section 3 solely for the purpose of operating the Service and under written contractual restrictions prohibiting further re-disclosure.
No independent contact: We do not independently market to students or use education records for purposes unrelated to the educational services we provide.
Who holds FERPA rights: For students in K-12 programs (including high school career and technical education programs), FERPA rights — including the rights to inspect records and request amendments — belong to the student's parent or guardian until those rights transfer to the student under FERPA. For students in post-secondary programs, those rights belong to the student as an "eligible student." In both cases, FERPA rights are administered through your educational institution: contact your registrar or program director for FERPA-related requests.
Legal process: If we receive a subpoena or other legal demand for institution-managed education records, we will notify the Institution before complying unless we are legally prohibited from doing so.
Surveys (PPRA): For surveys administered by an Institution through the Service, the Institution is responsible for any notice and consent required under the Protection of Pupil Rights Amendment (PPRA) and applicable state law. MedEdPrep does not use survey responses for marketing.
Institutional agreements: If your institution requires a FERPA compliance addendum, data processing agreement (DPA), or data-sharing agreement, contact us at [email protected]. We are prepared to execute institutional agreements as needed.
Order of precedence: If MedEdPrep has signed a data processing agreement or other written agreement with your Institution, that agreement controls over this Privacy Policy for that Institution's data to the extent of any conflict.
We implement technical and organizational safeguards appropriate to the data we hold, including:
Encryption in transit: Data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
Password security: Passwords are stored using industry-standard salted password hashing. We never store or have access to your plain-text password.
Session protection: Session cookies are encrypted and HTTP-only, requests are protected against cross-site request forgery, and each account is limited to a single active session at a time.
Role-based access: Administrator, instructor, and student roles are enforced so users see only what their role requires; students cannot access other students' records.
Payment isolation: Card data is tokenized and held by Stripe; MedEdPrep never stores card numbers.
No system is perfectly secure. If we confirm a security breach that affects your personal information, we will provide notice without unreasonable delay and as required by applicable law. For institution-managed records, we notify the affected Institution and support the Institution's own notification duties to its students; direct notice from MedEdPrep applies to individual consumer accounts. Institutional agreements may specify faster institution-facing notification windows.
The Service is designed for adult learners and for students enrolled in authorized educational programs, including high school career and technical education programs whose students may be minors.
The Service is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13 in compliance with the Children's Online Privacy Protection Act (COPPA). Minor students may use the Service only when authorized by their educational institution; institutions enrolling minors are responsible for obtaining any required parental or guardian consent under applicable state law and institutional policy.
If you believe we have inadvertently collected information from a child under 13, contact us at [email protected]. We will promptly delete or de-identify it; where the information is part of an institution-managed record, we will coordinate with the Institution to do so.
The Service uses:
Essential session cookies: Secure, encrypted, HTTP-only cookies that keep you logged in. These are required for the platform to function.
Bot protection: Google reCAPTCHA on public-facing forms.
First-party usage logging: We log feature usage and page interactions within the Service to operate and improve it. This data stays with MedEdPrep.
We do not use advertising cookies and we do not sell usage data to advertisers.
Do Not Track: The Service does not track users across third-party websites and does not use behavioral advertising. Because we do not engage in cross-site ad tracking, we do not respond to Do Not Track (DNT) browser signals — there is no such tracking to disable.
Active accounts: We retain your data for as long as your account is active and, for institution-managed accounts, as long as your institution maintains its relationship with MedEdPrep.
Generated export files: Report and export files generated through the Service are automatically deleted 30 days after generation.
Exam-integrity records: Records of exam-integrity investigations are retained for five (5) years, or as directed by the Institution for institution-administered exams.
Deletion requests: On a verified deletion request, we will remove or de-identify your personal information in active systems, except for records your institution is required to retain for educational or accreditation purposes, records needed to comply with legal obligations, and data subject to legal holds. Assessment response data is retained in de-identified form to preserve the statistical validity of exam questions; once de-identified, it is no longer associated with you. See Section 9.
Backups: Backup copies may persist for a limited period after deletion from active systems before being overwritten in the ordinary course.
Institution-managed records: For records submitted or managed by an institution, MedEdPrep processes this data on the Institution's behalf. Requests regarding institution-managed records are routed through the Institution, which controls the records it manages. See Section 9.
You have the right to:
Access: Request a copy of the personal information we hold about you.
Correction: Request correction of inaccurate or incomplete personal information.
Deletion: Request deletion of your account and associated personal data, subject to the retention constraints described in Section 8. Deleted assessment response data is retained only in de-identified form, as described in Section 8.
Data portability: Request your data in a commonly used, machine-readable format.
To exercise any of these rights, email [email protected]. We will respond to verified requests within 30 days where practicable and in any event as required by applicable law.
Institution-managed records: If your request concerns education records managed by your Institution, we will forward the request to the Institution within 5 business days and support the Institution's response. We do not delete education records without the Institution's authorization; FERPA access and amendment rights for those records are exercised through your Institution as described in Section 4.
The Service is hosted in the United States (AWS US-East-1). If you access the Service from outside the United States, your data will be transferred to and processed in the United States. By using the Service, you acknowledge this transfer.
This Privacy Policy is governed by and construed in accordance with the laws of the State of Georgia, United States, without regard to conflict of law principles. Nothing in this section limits your rights under applicable mandatory data protection laws in your jurisdiction.
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. If we make material changes, we will notify you at least 14 days before the changes take effect, by email or through a prominent notice within the Service. Material changes affecting an active institutional agreement do not degrade that agreement's terms without the Institution's consent. Your continued use of the Service after a change takes effect constitutes acceptance of the updated policy, except where applicable law requires additional consent before materially different data practices take effect.
If you have questions about this Privacy Policy, need help exercising your rights, or want to discuss FERPA compliance or a data processing agreement for your institution:
MedEdPrep, LLC 338 Leggett Rd, Dallas, Georgia 30157 Email: [email protected] Telephone: (470) 300-0090
We aim to respond to all inquiries within 30 days.