Privacy & cookies

Any information about you that you share with us when using Examed — typically your name and email, your university (if applicable), your role (student, teacher, admin), and the practice data you generate inside the platform (answers, sessions, notes). If you sign a service that requires invoicing, we will additionally request your full address, full name and tax ID. For technical reasons, certain information such as the IP address assigned by your internet provider is automatically stored.

Providing the service: we process your data to deliver the practice platform, store your progress and respond to your requests. Legal basis: art. 6(1)(b) GDPR — performance of the contract and pre-contractual measures.

University-tier customers: when a university licences Examed for its students, the university acts as joint controller for the student-cohort data and signs a data-processing agreement with MEDICINA POR EUROPA S.L. Legal basis: art. 6(1)(b) GDPR and art. 28 GDPR.

Marketing communications (newsletters, product updates): optional processing subject to your express consent through a specific checkbox in the forms (not pre-ticked). Legal basis: art. 6(1)(a) GDPR — free, specific, informed and unambiguous consent. You may withdraw it at any time without affecting the lawfulness of prior processing.

Minors: if you are under 14, your parents’ or legal guardians’ consent is required to process your personal data (art. 7 LOPDGDD).

Retention periods:

• Leads not converted to clients: 24 months from last contact, unless you previously request deletion.
• Clients with a service contract: 10 years after the end of the contractual relationship, in line with accounting obligations (art. 30 Spanish Commercial Code) and the general civil prescription period (art. 1964 Spanish Civil Code).
• Newsletter data: until consent is withdrawn.
• Student practice data (university accounts): for the duration of the university licence plus 24 months, unless the university requests earlier deletion.

MEDICINA POR EUROPA S.L. complies with the General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679 —, Spanish Organic Law 3/2018 (LOPDGDD) and Spanish Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE).

Appropriate technical and organisational measures have been implemented to ensure the security of your personal data (art. 32 GDPR). The site uses an SSL/TLS certificate to secure communications, and the application database enforces row-level security so each university workspace is isolated from the others.

You have the rights of access, rectification, erasure, restriction, data portability and objection, as well as the right not to be subject to solely automated individual decisions. In case of conflict, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) — www.aepd.es — c/ Jorge Juan, 6, 28001 Madrid (Spain), as the supervisory authority of the Data Controller.

To exercise these rights, please write to:
MEDICINA POR EUROPA S.L. — RÚA MAIOR, 21 2A — 32600 Verín (Ourense), Spain
Or by email: info@intmedgroup.com

Data Protection Officer (DPO): if a DPO has been appointed, their contact details will be published in this section in accordance with art. 37(7) GDPR.

To deliver the service and maintain the site, MEDICINA POR EUROPA S.L. relies on the following processors (art. 28 GDPR), all bound by contract:

• Vercel Inc. — application hosting and edge delivery.
• Supabase Inc. — managed database and authentication (EU region).
• Resend Inc. — transactional email delivery.
• Google Ireland Ltd. (Google Analytics) — audience measurement.
• Google Ireland Ltd. (Google Tag Manager) — tag management.

Some of the providers above (Vercel, Resend, Google) may process data in countries outside the European Economic Area, in particular in the United States. Such transfers rely on the Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914) and, where applicable, on the EU–U.S. Data Privacy Framework, ensuring an adequate level of protection in accordance with art. 46 GDPR.

MEDICINA POR EUROPA S.L. reserves the right to modify this Privacy Policy at its discretion, motivated by legislative or jurisprudential changes. Any modification will be published at least 30 days before its effective application. If you have provided an email address, we will notify you of substantial changes through it.