MedPath Privacy Policy

Effective date: 24 August 2026 Last updated: 18 October 2026

MedPath is operated by MANNA STUDIOS LLC, 30 N Gould St Ste N, Sheridan, WY 82801 (“we”, “us”). This policy explains what we collect when you use MedPath, why, who else sees it, and what you can do about it.

Questions, requests, or complaints: Contactmannastudios@gmail.com.

Waitlist and interest forms

When available, our marketing-site forms let you separately request applicant launch updates, individual-advisor updates, or institutional access and pilot updates. Submitting interest does not create an app account or guarantee access, a pilot place, or any admissions outcome. These forms are for US residents aged 18 or older.

We collect your email, chosen audience, optional organization, signup time, source page, and a record of the consent wording and eligibility confirmation. Checkboxes are not preselected. Switching audience requires a fresh opt-in; choosing one list does not subscribe you to the others. This form uses single opt-in and does not verify ownership of an email address.

Purpose and providers. MANNA STUDIOS LLC uses these details to maintain the requested interest lists and send updates about the selected audience. Resend stores contacts, preferences and consent details; Vercel processes form requests and operational metadata. This is service-provider processing, not sharing with advisors, institutions or advertising partners. We do not sell waitlist details. We use basic spam protection; this endpoint does not log submitted addresses or keep raw IPs in its rate-limit keys. Provider operational logs and processing locations remain subject to their settings.

Your choices. Joining is optional. You may join more than one audience separately. You can unsubscribe using the link in any update or contact Contactmannastudios@gmail.com to withdraw consent, request access, correct details, or request deletion. Existing unsubscribe preferences are not silently reset by the signup form. Withdrawing consent does not affect processing that already occurred.

Retention. We keep waitlist details while needed for the updates you requested, until you withdraw or the list is retired. We may retain minimal consent and suppression records needed to honor opt-outs or handle complaints. Provider backups and operational logs follow their configured retention. This website does not promise automatic deletion on a fixed timetable. Waitlist information is separate from app-account data described below.

1. Who this covers

• Applicants: people using MedPath to manage a medical school application.
• Advisors: people an applicant has invited to review their work, and advisors working within an institution.
• People an applicant tells us about: supervisors, professors and referees whose details an applicant records. See §4; you did not sign up, and we think you should know what we hold.

2. What we collect

Everything below is entered by you or generated by your use of MedPath. We do not buy personal data, and we do not collect it from data brokers, social networks or advertising networks.

About you and your cycle

Your name, email address, state of residence, application type (MD, DO or both), application services, cycle year, and current stage.

Your academic record

Cumulative and science GPA, MCAT score and planned test date, coursework with grades, and the status and results of other admissions tests you record.

Your written work

Personal statement and secondary essay drafts, every saved version of them, your activity and experience entries, and the stories you write to draw on.

These are free-text fields, and people write about their lives in them. Medical school essays routinely include illness, disability, bereavement, caring responsibilities, immigration status, religion and sexuality. We do not ask for any of that and we do not analyse it, but we hold what you write, and §6 explains what happens when you use an AI feature on it.

Your schools and progress

The schools on your list, their status and priority, secondary invitations and target dates, application fees and costs you record, requirements, interviews, and admissions decisions including financial aid details you enter.

Your circumstances

Whether you are first-generation, a reapplicant, taking a gap year, receiving fee assistance, and the employment or caring commitments you tell us about, so the plan fits the time you actually have.

Interview practice

Your typed or spoken answers, your reflections, and delivery measurements (words per minute, filler-word counts) computed from the text of your answer. See §6 for recordings.

Technical information

IP address, browser type and pages visited, collected for error monitoring and to keep the service running. We do not use advertising or analytics cookies.

Optional planning improvement pilot

If you join the planning improvement pilot for an application cycle, we record account-linked planning action types, revision identifiers, policy version and timestamps to evaluate the feature. We exclude essay text and task titles from these measurements. Participation is off until you choose to join. You can stop sharing and delete the cycle’s usage records from Today. No additional analytics cookies or third-party analytics service is used for this pilot.

3. What we do not collect

• We do not ask for your date of birth, government ID, or payment details.
• We do not collect race, ethnicity or any demographic category.
• We do not collect health records. Essays you write may mention your health; that is your writing, not a medical record, and we treat it as your writing.
• We do not track you across other websites.

4. Information about other people

When you log an experience you can record a supervisor’s name, title, email and phone number, and when you add a letter writer you record their name, institution and relationship to you. That is information about someone who is not a MedPath user.

If you are one of those people: we hold your details only because an applicant recorded them, we do not contact you unless that applicant asks us to send you an invitation, we never use your details for marketing, and you can ask us to delete them at Contactmannastudios@gmail.com.

We ask applicants to record only what they need. Contact details are optional.

5. How we use what we collect

• To run MedPath: build your plan, track deadlines, and show your progress.
• To send you the reminders you have asked for, subject to your settings.
• To provide the AI features described in §6, when you use them.
• To show your work to advisors you have chosen to share it with (§7).
• To keep the service working: error monitoring, debugging, and preventing abuse.

We do not use your essays, scores or application data to train any AI model, and we do not sell your personal information or share it for advertising.

6. AI features

Three MedPath features send your content to OpenAI for processing:

What we do with recordings. Audio is sent for transcription and discarded. We never store it. Only the transcript is kept, and only if you save it. The delivery measurements are computed from that transcript text, not from your voice. We do not identify you by voice, do not create a voiceprint, and do not analyse how you sound. We ask before your first recording.

What is never sent. Private notes on a practice session are excluded from everything sent to the AI coach, by design and by test.

Model training. Content sent through these features is not used to train OpenAI’s models. OpenAI may hold it briefly to monitor for abuse of their service, and does not use it for any other purpose.

Using MedPath without AI features. Your plan, deadlines, school list and writing workspace work without the coach, paste-to-capture or transcription. Not using these features avoids sending their content to the AI provider. Hosting, database, email and monitoring providers still process data to operate the service, as described in §8. They are distinct from advisors you invite.

Provider retention. MedPath does not persist practice audio. This does not promise zero retention by the transcription provider; processing and retention depend on the provider’s terms and endpoint settings. See service providers.

7. Sharing you control

Advisors. You can invite someone to review your application. You choose what they see, scope by scope, and you can set an expiry or revoke access at any time. Advisors can view and comment; they cannot edit or submit your work. Comments have an access event; view logging is best effort and may be incomplete.

Institutions. Sharing with an individual and sharing with a named advising office are separate choices. Joining an office does not turn a personal grant into an office grant. Before you accept an office request, the interface names the office and explains that current authorized staff, including colleagues who join later, can see only your selected scopes until expiry or revocation. Removing an employee stops their office access; the office grant remains for other current staff. An office roster creates requests to share, not access to your application. Current staff and roster invitations appear in the app and do not send email.

Advisors may download reports from the information shared with them. Those copies are outside MedPath’s access controls; revocation cannot recall them. Small-group reports can identify people even when they omit names. We label outcomes exports for authorized internal advising, not public redistribution.

The shared prompt library. When you record a secondary essay prompt, the question the school asked may be contributed to a library other applicants can see. Only the school’s question crosses accounts, never your drafts, your notes, your name, or anything identifying you. A prompt appears only once at least two applicants have independently recorded it.

8. Who else processes your data

We use a small number of service providers. They act on our instructions and may not use your data for their own purposes. The full list, and what reaches each of them, is in subprocessors.md.

In summary: Supabase (database and accounts), Vercel (the configured application hosting), OpenAI (the AI features in §6), Resend (email), and Sentry (error monitoring).

9. How long we keep things

We keep your data for as long as your account exists. Delete your account and we delete your profile, cycles, schools, essays and every version of them, tasks, interviews, decisions, letters, costs and reminders.

Planning pilot events older than 30 days are removed during nightly cleanup. Withdrawing from the pilot deletes its event records immediately; deleting your account or cycle also deletes its pilot records and planning-change signals. Operational backups follow the separate backup limits below.

Your contributions to the shared prompt library are deleted too, which can remove a question from the library entirely if you were one of the two applicants who put it there.

Deletion requests. We attempt to record your user ID and email address when you request deletion. This is a best-effort record of an attempt, not by itself proof that deletion succeeded. It does not contain your application content.

We keep that record for as long as we may need it to show the deletion happened. There is currently no automatic fixed-period purge of that record.

Provider backups and operational logs follow their configured retention and may expire after live account data is deleted. We do not promise immediate erasure from every backup or from copies an advisor already downloaded.

Unsent drafts on this device. The editor may keep a pending copy in your browser for recovery, with a seven-day expiry from the edit. Confirmed saves, explicit discard and sign-out clean up copies as applicable on the current device; unavailable or cleared storage can prevent recovery. Other offline devices and browser profiles are not remotely cleared by an account action.

10. Your rights

Whatever regime applies to you, MedPath gives everyone the same controls:

• See and export everything. Profile → Data controls → “Everything (JSON)” gives you a complete file of your own data, plus CSV and Markdown exports.
• Correct anything. Every field is editable in the app.
• Delete your account. Profile → Data controls → Delete account. It is immediate and it is not reversible.
• Control what advisors see, scope by scope, with an expiry, revocable.
• Control email, by kind, with quiet hours, or off entirely.

To ask us something about your data, or to complain, write to Contactmannastudios@gmail.com. We will respond within 30 days. If we refuse a request we will tell you why, and you can reply to that same address to ask us to reconsider.

11. Security

Every table is protected by row-level security, so one account’s queries cannot reach another’s. Advisor access is granted per scope by the applicant, expires when they say, and is logged. Passwords are checked against known breach corpora at sign-up, and are never sent anywhere in the process; only a partial hash prefix leaves your browser.

No system is perfectly secure, and we do not claim MedPath is. We hold no security certifications at this time.

12. Age

MedPath is for adults. You must be 18 or older to use it. We do not knowingly collect information from children, and if we learn that we have, we will delete it.

13. Where your data is held

The MedPath database sits in AWS us-west-2 (Oregon). Application hosting, monitoring, email and AI processing locations depend on each provider’s configuration and terms; we do not represent that every processing step takes place exclusively in the United States.

The application is built for Vercel hosting, whose delivery network is global. The location of stored database records is different from the locations where traffic, requests and provider logs may be processed.

MedPath is offered to residents of the United States. We are not set up to meet the obligations that come with serving people in the UK or the European Economic Area, and we would rather say so than pretend otherwise. If you are outside the United States, please do not use MedPath.

14. Changes

If we change this policy we will update the date above, and we will tell you directly before any change that materially reduces your protections.

15. Contact

MANNA STUDIOS LLC 30 N Gould St Ste N Sheridan, WY 82801 Contactmannastudios@gmail.com