Your story is yours.

Account information. Your email address and password credentials, so you can sign in and we can reach you about your account.

Application information you enter. The things you type into MedPath: your school list, deadlines and requirements, essay drafts and versions, your Story Bank entries, activities, letter writers and their status, interview details, costs, and the profile details you give us during setup — cycle year, MD/DO scope, state of residence, weekly time capacity, and optional academic context like GPA or MCAT if you choose to enter it.

Usage and technical data. Basic information your browser sends (device type, browser, approximate region) and product analytics about which features are used, so we can find what's broken and what's confusing. We also log application errors.

Payment information. If you subscribe to Plus, our payment processor handles your card details. We receive the subscription status and billing metadata — never your full card number.

To run the product you signed up for: building your prioritized plan, tracking deadlines, powering the writing workspace and character counts, sending the reminders you asked for, and providing AI coaching when you request it.

To keep the service working and secure: diagnosing errors, preventing abuse, and maintaining backups.

To communicate with you: account and billing notices, and — only if you opt in — occasional product updates. You can unsubscribe from non-essential email at any time.

To improve MedPath in aggregate: understanding which features get used and where people get stuck. This analysis uses usage patterns, not the content of your essays.

This is the part applicants worry about most, so we will be specific about it.

When you ask the AI advisor for feedback on a draft, that draft is sent to our AI provider so it can generate the response you asked for. That happens when you request it — your essays are not continuously streamed anywhere in the background.

We do not use your essay content to train AI models, and we contract with our AI provider on terms that prohibit using your content to train theirs. Your writing is not turned into anyone's training data.

The advisor is built to coach, not to author. It asks questions, flags unclear or unsupported passages, and helps you revise — it does not generate essay content for you to submit as your own. That is a product decision, not just a policy one.

You, by default. Your account is private. Other applicants cannot see your data, and there is no public profile, feed, or leaderboard in MedPath.

People you explicitly invite. If you invite a pre-health advisor, mentor, or family member to review your application, they see only what you share with them — specific essays, or your plan — and nothing else. You can revoke that access at any time, and revoking it takes effect immediately.

Our service providers. A small number of vendors process data on our behalf so the product can function: our hosting and database provider, our AI provider, our payment processor, our email delivery provider, and our error-monitoring and analytics tools. They are bound by contract to process data only for us and only for those purposes.

Nobody else. Specifically: we do not sell your data, we do not share it with medical schools, application services, admissions consultants, or advertisers, and we do not disclose it in response to anything less than a valid legal obligation. If we ever were legally compelled to disclose information, we would notify you unless we were legally prohibited from doing so.

We keep your information for as long as your account exists. Applying to medical school is not always a one-cycle process, and if you reapply, your Story Bank, drafts, and letter history are still there waiting for you.

You can export your data at any time from your account settings, in a portable format.

You can delete your account at any time from your account settings — no support ticket, no retention call. Deletion removes your application data from our production systems promptly and from routine backups within 30 days. Records we are legally required to keep, such as billing records, are retained as required by law.

Depending on where you live, you may have additional rights to access, correct, port, or delete your information, or to object to certain processing. Email us and we will honor them — we would rather just do this than make you invoke a statute.

Your data is encrypted in transit and at rest. Access is controlled at the row level, meaning the database itself enforces that your records are reachable only by your account and by anyone you have explicitly invited — not just the interface, but the underlying data layer.

Internal access to production data is limited to the people who need it to operate and support the service. No system is perfect, and anyone who claims otherwise is selling something; if we ever experience a breach affecting your information, we will tell you promptly and tell you plainly what happened.

One thing we will never ask for: your AMCAS, AACOMAS, or school portal passwords. MedPath does not store portal credentials, and any message asking you for them is not from us.

Our security page goes into more detail, including what we don't have yet.

We use cookies and similar local storage to keep you signed in and to remember basic preferences. We also use a small amount of privacy-respecting product analytics to understand feature usage.

We do not run advertising trackers, retargeting pixels, or third-party ad networks on MedPath. You are not the product here — the subscription is the business model.

MedPath is built for people applying to medical school and is not directed at children. You must be at least 16 years old to create an account. If we learn we have collected information from someone under 16, we will delete it.

If we make a material change to how we handle your information, we will update this page and notify you by email before the change takes effect — not quietly, and not in a footer diff you would have to go looking for.

Questions about privacy, or want to exercise any of the rights above? Email privacy@medpath.app and a human will answer.

MedPath is operated by [Legal Entity Name], [Mailing Address].