Privacy Policy

1. Introduction & Scope

Penziv, Inc. ("Penziv", "we", "our", or "us") provides an intelligent study companion, clinical scoring calculators, and cognitive diagnostic engines designed for high-stakes medical examinations (including USMLE and MCAT).

We believe trust is foundational to learning. This Privacy Policy explains our practices regarding the collection, use, retention, and disclosure of your personal information, as well as your statutory rights under the European Union General Data Protection Regulation (EU GDPR), United Kingdom GDPR, California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), Washington My Health My Data Act (MHMDA), and applicable global privacy laws.

2. Information We Collect

We collect information to provide, personalize, and secure our educational software. We group this information into the following categories:

• Account Identifiers: Email address, encrypted password credentials, name or username, and authentication identifiers provided during account registration or Google OAuth sign-in.
• Academic & Diagnostic Performance Data: Practice quiz responses, question difficulty selections, Anki telemetry imports, topic mastery scores, study streaks, and cognitive calibration metrics.
• Billing & Transactional Data: Subscription tier (Penziv Pro vs. Free), billing status, renewal date, and transaction receipts. All payment card details are collected directly by our PCI-DSS Level 1 payment processor (Stripe, Inc.); Penziv never handles or stores full credit card numbers.
• Technical & Device Data: IP address, operating system, browser type, device identifiers, session timestamps, and interface latency telemetry to maintain security and resolve bugs.
• Optional Analytics & Marketing Data: Pseudonymous interaction metrics collected via Google Analytics or Meta Pixel, strictly subject to your affirmative opt-in consent.

3. Legal Bases for Processing (GDPR Article 6)

For users situated in the European Economic Area (EEA), United Kingdom, or Switzerland, we process personal data under the following lawful bases:

4. Third-Party Sub-Processors

We partner with vetted infrastructure and software sub-processors bound by strict Data Processing Addenda (DPAs) and confidentiality covenants:

5. Notice at Collection & California Consumer Rights (CCPA / CPRA)

Under the California Consumer Privacy Act as amended by the CPRA, California residents are entitled to specific disclosures:

• No Sale of Personal Information: Penziv does not sell your personal information for monetary consideration.
• Cross-Context Behavioral Advertising: Non-essential tracking scripts (such as Meta Pixel) may constitute "sharing" under California law. You may opt out at any time using our Cookie Preferences tool or by enabling Global Privacy Control.
• Right to Know & Access: You have the right to request the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You have the right to request deletion of your personal data, subject to legal retention obligations.
• Right to Correct: You have the right to rectify inaccurate personal information.
• Non-Discrimination: We will never deny services, charge different prices, or alter software functionality because you exercised statutory privacy rights.

6. Global Privacy Control (GPC)

We automatically recognize and honor the Global Privacy Control (GPC) browser signal. When your browser transmits a GPC signal, all optional marketing and third-party advertising cookies are automatically deactivated across your session without requiring manual action.

7. Data Retention Schedule

We retain your personal information only as long as necessary to fulfill the educational purposes described in this policy:

• Account Data: Retained for the active lifetime of your account. Inactive accounts are purged after 24 continuous months of inactivity.
• Quiz & Telemetry Data: Maintained to calculate longitudinal score predictions and spaced-repetition intervals until account deletion.
• Financial Transaction Records: Retained for 7 years to satisfy statutory tax and financial audit mandates.

8. Children's Privacy (COPPA)

Penziv is intended strictly for university, post-graduate, and adult learners preparing for medical board examinations. We do not knowingly solicit, collect, or process personal data from individuals under 13 years of age (or under 16 in applicable European and California jurisdictions). If we discover that personal information has been collected from a child without verified parental consent, we promptly expunge that data.

9. How to Exercise Your Rights (DSR Requests)

You can directly exercise your rights to data portability and account erasure within the platform:

10. Contact Us

If you have questions, feedback, or concerns regarding this policy, please reach our compliance team: