What we collect, and why

1. Information you provide

When you apply for an account: your name, email, date of birth, graduate type and country, attempt number, and province/country of residence — this is how we verify you're a real, eligible exam candidate before granting access, and how the program understands who it's serving. Your password is stored as a one-way hash; we can't read it, and neither can anyone who gains access to the database.

2. Payment information

If you subscribe, your card details go directly to Stripe, our payment processor — PharmaLeap's own servers never see or store your card number. We keep only what Stripe tells us afterward: your subscription's status, plan, and renewal date, so we know what you've paid for.

3. How you use the portal

We record which questions you've answered, flagged, or studied, and your quiz/exam simulation results, so your progress and history can be shown back to you and to program administrators reviewing overall performance. We also record each sign-in and sign-out with its time, IP address and the approximate location derived from it (city level at best), used only to enforce the one-device and location rules in the Honor Code and visible to program administrators.

How long we keep it. An application that is not approved is anonymised 90 days after the decision. An approved account with no activity, no subscription and no granted access for 24 months is anonymised. Anonymising overwrites your name, contact details, date of birth, postal code and PEBC ID, removes free text you wrote and your sign-in records, and keeps only the scores, so the program's aggregate figures stay accurate without naming you. You can ask for your account to be erased sooner at any time by emailing support. Practice content you view carries an invisible marker tied to your account (see the Honor Code) — this exists to trace material back to its source if it's ever found redistributed outside the portal, not to monitor your normal studying.

4. Cookies

We use a single, essential session cookie to keep you signed in. We don't use third-party advertising or tracking cookies.

5. Who else sees this data

We share data only with the services that make PharmaLeap work, each acting as a processor on our behalf: Stripe (payments), Resend (account emails), Supabase (database hosting), and Vercel (application hosting). We don't sell your information or share it with anyone else.

6. How long we keep it

We keep your account and activity history for as long as your account is active, so your progress stays available to you. If you'd like your account and data deleted, email us — we'll confirm and remove what we're not otherwise required to keep (for example, payment records Stripe requires for tax/accounting purposes).

7. Your rights

You can ask to see, correct, or delete the personal information we hold about you at any time by emailing us. We'll respond as quickly as we reasonably can.

8. Changes to this policy

If this changes, we'll update the date at the top of this page. Significant changes will also be communicated by email.