MedPath Privacy Policy

Effective date: 24 August 2026 Last updated: 24 August 2026

MedPath is operated by MANNA STUDIOS LLC, 30 N Gould St Ste N, Sheridan, WY 82801 (“we”, “us”). This policy explains what we collect when you use MedPath, why, who else sees it, and what you can do about it.

Questions, requests, or complaints: Contactmannastudios@gmail.com.

1. Who this covers

• Applicants — people using MedPath to manage a medical school application.
• Advisors — people an applicant has invited to review their work, and advisors working within an institution.
• People an applicant tells us about — supervisors, professors and referees whose details an applicant records. See §4; you did not sign up, and we think you should know what we hold.

2. What we collect

Everything below is entered by you or generated by your use of MedPath. We do not buy personal data, and we do not collect it from data brokers, social networks or advertising networks.

About you and your cycle

Your name, email address, state of residence, application type (MD, DO or both), application services, cycle year, and current stage.

Your academic record

Cumulative and science GPA, MCAT score and planned test date, coursework with grades, and the status and results of other admissions tests you record.

Your written work

Personal statement and secondary essay drafts, every saved version of them, your activity and experience entries, and the stories you write to draw on.

These are free-text fields, and people write about their lives in them. Medical school essays routinely include illness, disability, bereavement, caring responsibilities, immigration status, religion and sexuality. We do not ask for any of that and we do not analyse it, but we hold what you write, and §6 explains what happens when you use an AI feature on it.

Your schools and progress

The schools on your list, their status and priority, secondary invitations and target dates, application fees and costs you record, requirements, interviews, and admissions decisions including financial aid details you enter.

Your circumstances

Whether you are first-generation, a reapplicant, taking a gap year, receiving fee assistance, and the employment or caring commitments you tell us about, so the plan fits the time you actually have.

Interview practice

Your typed or spoken answers, your reflections, and delivery measurements (words per minute, filler-word counts) computed from the text of your answer. See §6 for recordings.

Technical information

IP address, browser type and pages visited, collected for error monitoring and to keep the service running. We do not use advertising or analytics cookies.

3. What we do not collect

• We do not ask for your date of birth, government ID, or payment details.
• We do not collect race, ethnicity or any demographic category.
• We do not collect health records. Essays you write may mention your health; that is your writing, not a medical record, and we treat it as your writing.
• We do not track you across other websites.

4. Information about other people

When you log an experience you can record a supervisor’s name, title, email and phone number, and when you add a letter writer you record their name, institution and relationship to you. That is information about someone who is not a MedPath user.

If you are one of those people: we hold your details only because an applicant recorded them, we do not contact you unless that applicant asks us to send you an invitation, we never use your details for marketing, and you can ask us to delete them at Contactmannastudios@gmail.com.

We ask applicants to record only what they need. Contact details are optional.

5. How we use what we collect

• To run MedPath: build your plan, track deadlines, and show your progress.
• To send you the reminders you have asked for, subject to your settings.
• To provide the AI features described in §6, when you use them.
• To show your work to advisors you have chosen to share it with (§7).
• To keep the service working — error monitoring, debugging, and preventing abuse.

We do not use your essays, scores or application data to train any AI model, and we do not sell your personal information or share it for advertising.

6. AI features

Three MedPath features send your content to OpenAI for processing:

What we do with recordings. Audio is sent for transcription and discarded — we never store it. Only the transcript is kept, and only if you save it. The delivery measurements are computed from that transcript text, not from your voice. We do not identify you by voice, do not create a voiceprint, and do not analyse how you sound. We ask before your first recording.

What is never sent. Private notes on a practice session are excluded from everything sent to the AI coach, by design and by test.

Model training. Content sent through these features is not used to train OpenAI’s models. OpenAI may hold it briefly to monitor for abuse of their service, and does not use it for any other purpose.

Using MedPath without them. These three features are the only ones that send your content anywhere for processing. Everything else — your plan, your deadlines, your school list, your drafts — works without them. If you never use the coach, never paste to capture, and never record a practice answer, none of your writing leaves MedPath’s own systems.

7. Sharing you control

Advisors. You can invite someone to review your application. You choose what they see, scope by scope, and you can set an expiry or revoke access at any time. Advisors can view and comment; they cannot edit your work. Every time an advisor opens something of yours, it is recorded.

Institutions. If your advisor belongs to an advising office, others in that office may be able to see the same information. This is how a pre-health office covers for a colleague. It means “share with my advisor” can mean “share with that office” — the interface tells you when this applies before you grant access.

The shared prompt library. When you record a secondary essay prompt, the question the school asked may be contributed to a library other applicants can see. Only the school’s question crosses accounts — never your drafts, your notes, your name, or anything identifying you. A prompt appears only once at least two applicants have independently recorded it.

8. Who else processes your data

We use a small number of service providers. They act on our instructions and may not use your data for their own purposes. The full list, and what reaches each of them, is in subprocessors.md.

In summary: Supabase (database and accounts), Cloudflare (hosting), OpenAI (the AI features in §6), Resend (email), and Sentry (error monitoring).

9. How long we keep things

We keep your data for as long as your account exists. Delete your account and we delete your profile, cycles, schools, essays and every version of them, tasks, interviews, decisions, letters, costs and reminders.

Your contributions to the shared prompt library are deleted too, which can remove a question from the library entirely if you were one of the two applicants who put it there.

One thing survives deletion: a record of your user ID and email address, kept so we can show that the deletion happened if you or a regulator ever ask. It holds nothing else about you.

We keep that record for as long as we may need it to show the deletion happened. It is the only thing we retain, and it exists to protect you: without it we could not prove, to you or to anyone else, that we did what you asked.

10. Your rights

Whatever regime applies to you, MedPath gives everyone the same controls:

• See and export everything. Profile → Data controls → “Everything (JSON)” gives you a complete file of your own data, plus CSV and Markdown exports.
• Correct anything. Every field is editable in the app.
• Delete your account. Profile → Data controls → Delete account. It is immediate and it is not reversible.
• Control what advisors see, scope by scope, with an expiry, revocable.
• Control email, by kind, with quiet hours, or off entirely.

To ask us something about your data, or to complain, write to Contactmannastudios@gmail.com. We will respond within 30 days. If we refuse a request we will tell you why, and you can reply to that same address to ask us to reconsider.

11. Security

Every table is protected by row-level security, so one account’s queries cannot reach another’s. Advisor access is granted per scope by the applicant, expires when they say, and is logged. Passwords are checked against known breach corpora at sign-up, and are never sent anywhere in the process — only a partial hash prefix leaves your browser.

No system is perfectly secure, and we do not claim MedPath is. We hold no security certifications at this time.

12. Age

MedPath is for adults. You must be 18 or older to use it. We do not knowingly collect information from children, and if we learn that we have, we will delete it.

13. Where your data is held

Your data is stored in the United States — the database sits in AWS us-west-2 (Oregon), and every provider in §8 processes data there.

One nuance worth stating rather than glossing: MedPath’s application code runs on Cloudflare’s edge network, which executes requests at the location nearest the person making them. So a request from Europe is processed in Europe even though the data it reads and writes rests in Oregon.

MedPath is offered to residents of the United States. We are not set up to meet the obligations that come with serving people in the UK or the European Economic Area, and we would rather say so than pretend otherwise. If you are outside the United States, please do not use MedPath.

14. Changes

If we change this policy we will update the date above, and we will tell you directly before any change that materially reduces your protections.

15. Contact

MANNA STUDIOS LLC 30 N Gould St Ste N Sheridan, WY 82801 Contactmannastudios@gmail.com