Effective from 14 October 2026
This is the English version of the Privacy Policy. In case of any discrepancy, the Polish version (“Polityka prywatności”) prevails.
This policy explains what personal data we collect in the MedMigrant website (medmigrant.com) and the MedMigrant mobile apps, why, how long we keep it and what rights you have. It applies wherever you use the Service from: we apply the same rules everywhere, based on the GDPR (Regulation (EU) 2016/679). We do not sell personal data.
1. Data controller
The controller is Prospect-Med Rafał Sójka, ul. Bagnowska 43, 15-189 Białystok, Poland, registered in the Polish Central Register and Information on Business Activity (CEIDG), tax ID (NIP) 966-215-04-01, REGON 389006478.
For anything related to personal data, write to prospect.med.ua@gmail.com. We have not appointed a data protection officer.
2. What data, for what purpose and on what legal basis
Account and login. Login, e-mail address, password (stored only in encrypted form), display name, date you accepted the Terms. Purpose: creating and running your Account, logging in, password recovery, contacting you about your Account. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Retention: until you delete your Account.
Study data. Your answers, results, answer times, notes, clipboard of saved questions, progress, unfinished tests and the country your study relates to. Purpose: statistics, resuming tests and other study features. Legal basis: performance of a contract (Art. 6(1)(b)). Retention: until you delete your Account. This data is used only to run your Account and is not published.
Comments and user questions. Content, display name (by default your login), date, and the Account e-mail address stored with the entry (not visible to other Users). Your display name and content are visible to other Users. Purpose: running the community features. Legal basis: performance of a contract (Art. 6(1)(b)). Retention: until the entry or your Account is deleted (when you delete your Account, we also delete your comments and questions).
Moderation and security. Reports of content (who reported, the reason), the list of Users you blocked, information about an Account block, messages exchanged about reports. Purpose: protecting Users and the Service, enforcing the Terms, handling reports. Legal basis: legitimate interest (Art. 6(1)(f)) and obligations under Regulation (EU) 2022/2065 (Art. 6(1)(c)). Retention: until the matter is closed and, if an Account is blocked, until the limitation period for claims expires.
Correspondence. E-mail address, content of messages and any data you provide. Purpose: replying to you, complaints, exercising your rights. Legal basis: legitimate interest (Art. 6(1)(f)) or performance of a contract. Retention: until the matter is closed and then until the limitation period for claims expires.
Technical data (server logs). IP address, date and time, requested page address, browser and device data. Purpose: security, detecting abuse and failures. Legal basis: legitimate interest (Art. 6(1)(f)). Retention: limited period set by the hosting provider.
Analytics (Google Analytics). Data about how the Service is used, such as pages visited, visit duration, device and browser type, approximate location, and identifiers in cookies. Purpose: understanding how the Service is used and improving it. Legal basis: your consent (Art. 6(1)(a) GDPR and the rules on privacy in electronic communications). Analytics runs only after you consent. You can withdraw consent at any time by changing your consent settings in the Service or by deleting cookies in your browser; withdrawal does not affect the lawfulness of earlier processing. Retention: according to the retention setting in Google Analytics, no longer than 14 months.
Providing the data needed for an Account is voluntary, but without it we cannot create one. We do not profile Users and do not take decisions based solely on automated processing that would have legal effects on you. The automatic, temporary hiding of a comment after reports from other Users is always reviewed by a person.
We do not ask for health data, and we ask you not to enter any in comments or questions, in particular patient data.
3. Recipients of data
Data may be shared with providers that supply services to us, under data processing agreements or their own terms:
- LH.pl (LH.pl sp. z o.o., Poznań) — hosting of the Service and e-mail, storage of data and backups;
- Google (Google Ireland Limited, Google LLC) — e-mail (Gmail), Google Analytics, Google Fonts and distribution of the apps through Google Play.
Data may also be disclosed to public authorities where required by law, and to legal and accounting advisers where necessary to protect our rights. Other Users can see your display name and what you publish. For this reason do not use your real name as a display name if you do not want to disclose it.
4. Transfers outside the European Economic Area
Google may process data in the United States and other countries outside the EEA. Transfers rely on a European Commission adequacy decision (Data Privacy Framework) or standard contractual clauses. We keep the other data on servers in Poland (data centres in Warsaw). You can get a copy of the relevant safeguards by writing to the address in section 1.
5. Cookies and browser storage
We use only what is needed for the Service to work and, with your consent, analytics.
Strictly necessary:
wordpress_logged_in_*and related WordPress cookies — keep you logged in; until the end of the session, or up to 14 days if you choose “Remember me” (or create an Account);wordpress_test_cookie— checks that your browser accepts cookies; until the end of the session;mcq_country— remembers the country (version of the Service) you selected; 1 year.
Browser storage (kept only on your device):
mcq_theme,mcq_fs(localStorage) — your light/dark theme and text size;mcq_app,mcq_app_country(sessionStorage) — detect that the Service is open in the app and the app’s country; until you close the tab or app;- app cache (service worker) — style, script and font files that speed up loading.
With consent: Google Analytics cookies (for example _ga, _ga_*), up to 2 years.
You can delete or block cookies in your browser settings. Blocking strictly necessary cookies will prevent you from logging in.
We load the Inter font from Google Fonts servers, so Google receives your IP address and browser data when you open a page. Legal basis: legitimate interest (Art. 6(1)(f)) — a consistent look of the Service. The demo video on the home page is played from our own server, without third-party providers.
6. Mobile apps
The apps from Google Play display the Service and use the same data as the browser version. They do not request access to your contacts, location, camera, microphone or files. Google, as the operator of Google Play, processes data about installs and errors under its own privacy policy and gives us aggregated statistics.
7. Your rights
You have the right to access your data, rectify it, erase it, restrict processing, data portability (we will send a copy in a commonly used format on request) and to object to processing based on legitimate interest. You can also withdraw your consent to analytics at any time.
You can exercise some rights yourself: change your Account details in your Profile, and delete your whole Account with its data at medmigrant.com/delete-account/. For anything else, write to the address in section 1; we will reply within one month.
You also have the right to lodge a complaint with a supervisory authority: in Poland, the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or the data protection authority in your own country if you live elsewhere.
8. Deleting data
After you delete your Account we erase your Account data, study data, and your comments and questions. We may keep only what we need to defend against claims (for example e-mail correspondence, or a note that an Account was blocked for breaches) or what the law requires. The data may remain for a short time in the hosting provider’s backups until they are rotated.
9. Security
The Service runs over an encrypted connection (HTTPS), passwords are stored in hashed form and only authorised people can access data. No technical solution gives an absolute guarantee, however; if a breach could put your rights at risk, we will notify you as the law requires.
10. Children
The Service is intended for people aged 18 or over. We do not knowingly collect data of minors. If you think such data reached the Service, write to us and we will delete it.
11. Changes to this policy
We may change this policy, for example when the law or the way the Service works changes (including the introduction of payments). The current version is always on this page with its effective date, and we will also tell you about material changes by e-mail.