LEK Study privacy policy

Version of [publication date]. Draft, subject to legal review before publication. This is a translation for convenience; in case of discrepancies the Polish version prevails.

1. Controller

The controller of personal data is Insoft Solutions Artur Lenart, ul. Bagno 8, 27-420 Bodzechów, Poland, tax ID (NIP) 6612300015 ("we"). Contact on personal data matters: [email protected].

2. Using the app without an account

You can use the app as a guest. Your study progress (answers, exams, favourites, settings) is then stored only on your device and we do not send it to a server. We only process technical crash data (section 5) and – when you make a purchase – the data needed to handle it (section 6).

3. Account and sync

If you create an account, we process:

• your e-mail address, first name (if you provide it) and the date the account was created; the password is stored only in secured (hashed) form by the sign-in service provider; when you sign in with Google or Apple, we receive your e-mail address and account identifier from them;
• study progress: sessions and exams taken, answers given, favourite questions and app settings – to move them between your devices;
• the list of devices on which you use the account: a random installation identifier created by the app (not the phone's hardware number), the platform (Android/iOS), the app version and the dates of first and last use – to protect the account and purchases from being shared.

Legal basis: performance of the service contract (Art. 6(1)(b) GDPR); the device list – our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

You can delete your account at any time in the app (More → Account → Delete account). We then delete the account and all associated data on the server.

4. Data on the server

Account data is stored with Supabase (Supabase Inc.), in a data centre in the region [fill in the Supabase project region, e.g. EU – Frankfurt]. Only the account owner, and the administrator to the extent necessary for support, have access to the data.

5. Crash reports

To detect and fix errors, the app uses Firebase Crashlytics (Google Ireland Ltd / Google LLC). When the app crashes or a server connection error occurs, a technical report is sent: the error trace, device model, system and app version, a random Crashlytics installation identifier and the time of the event. Reports do not contain the content of your answers or account data. Legal basis: our legitimate interest in keeping the app working (Art. 6(1)(f) GDPR).

6. Premium purchases

Payments are handled by Google Play and the Apple App Store as separate controllers of payment data – we do not see your card details. To verify purchases and grant access we use RevenueCat (RevenueCat Inc., USA), which receives the purchase identifier, product, date and country of purchase and your account identifier in the app (or an anonymous identifier if you use the app without an account). Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and legal obligations related to accounting (Art. 6(1)(c) GDPR).

7. Transfers outside the EEA

Some providers (Google, RevenueCat, Supabase, Cloudflare) may process data in the USA. This takes place on the basis of the European Commission's adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.

8. Contact form and e-mail

When you write to us through the form on lekstudy.pl or to [email protected], we process your name, e-mail address, topic and message – only to reply and deal with your request. Messages from the form are relayed by Cloudflare (Cloudflare Inc.), which delivers them to our mailbox at Gmail (Google). The form may be protected against spam by Cloudflare Turnstile, which checks that a person is sending it. Legal basis: our legitimate interest in replying to messages (Art. 6(1)(f) GDPR). We keep correspondence until the matter is closed, and longer only when it is needed to defend claims or required by law.

9. What we don't do

• We do not show ads and do not use advertising or tracking tools.
• We do not sell data.
• We do not profile for marketing purposes.

10. How long we keep data

Account data – until the account is deleted. Crash reports – according to Crashlytics settings (up to 90 days). Purchase data – for the period required by tax and accounting law.

11. Your rights

You have the right to access your data, to rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest. Write to us: [email protected]. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland.

12. Age of users

The app is intended for medical students and graduates. It is not directed at persons under 18.

13. Changes

We will inform you about significant changes to this policy in the app or on this page.