Privacy Policy

Last updated: 28 October 2026

1. Who we are

This policy explains how TopMD ("we") handles personal data when you use topmd.net and app.topmd.net. Questions or requests: use the contact page and choose "Privacy request".

2. What we collect

Account: your email address, username, name (if you give one) and password. Passwords are stored only as a secure one-way hash — we can't read them.
Plan: your plan, its end date and the subscription codes you redeemed.
Devices: a random device identifier, the browser and device type, and when each device was last used — needed for the two-device limit.
Study data: your answers, test results, time spent, notes, highlights, flashcards, bookmarks and study planner settings.
Messages: what you send through the contact form, problem reports and study room chats.
Technical logs: IP address, browser and the pages requested, kept in server logs to keep the service secure and fix problems.

3. Why we use it

To run your account, save and sync your progress, and show your analytics (performing our agreement with you).
To keep TopMD secure, prevent abuse and enforce plan and device limits (our legitimate interest).
To answer your messages.
To meet legal obligations.

We don't sell personal data, show ads or use third-party tracking or advertising cookies.

4. Cookies and local storage

One essential cookie keeps you signed in. It can't be read by page scripts and is removed when you sign out.
Your browser's local storage keeps your theme choice and offline copies of the sources you've opened, so TopMD works without internet. You can clear these in your browser settings at any time.

Because we only use what's strictly necessary, there is no cookie banner.

5. Services we use

Hosting: TopMD runs on servers in the European Union (Helsinki, Finland).
AI Study Coach (optional): if the coach is enabled and you use it, the text of your request and the related question are sent to our AI provider to produce an answer. Your name and email are not sent. Don't include personal details in your requests.
Videos: embedded YouTube or Vimeo videos load only when you press play, using their privacy-enhanced modes.

6. How long we keep it

Account and study data: while your account exists. When you ask us to delete your account, we delete it and its study data.
Messages: up to two years, unless needed longer to resolve an issue.
Server logs: kept for a short period for security, then deleted.

7. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your data, to object to or restrict some uses, and to complain to your data protection authority. To use these rights, contact us from the email address on your account.

8. Security

All connections use HTTPS. Passwords are hashed, sign-in uses a protected cookie, the number of sign-in attempts is limited, and access to administration tools is restricted.

9. Children

TopMD is intended for medical students and doctors and is not directed at children under 16.

10. Changes

If we change this policy we'll update the date at the top and, for important changes, tell you in the app or by email.