Privacy Policy

Last updated: September 28, 2026
Controller: Reflex PMR LLC · Contact: support@reflexpmr.com

This Privacy Policy explains what we collect, how we use it, and who we share it with when you use Reflex PMR (the “Service”), on the web at reflexpmr.com or through the Reflex iOS app.

1. Information we collect

• Account data: your email address, optional name, and authentication identifiers, handled through Clerk.
• Billing data: Stripe handles your payment details, billing address, contact information, and transaction records. We receive purchase status, payment identifiers, and related billing metadata. We do not store your full card number.
• Study and usage data: account-linked progress, spaced-repetition state, answers, notes, bookmarks, settings, practice scores, and activity events stored in our database on Supabase.
• AI voice practice: when you use Explain It, your recording is uploaded to Reflex and sent to Google Gemini to transcribe and evaluate your spoken answer. The feature returns a transcript, score, and AI feedback. We store attempt and score records associated with your account, plus diagnostic metadata such as the grading outcome and upload size. See the voice-practice and retention sections below.
• Web analytics and performance: Vercel Web Analytics and Speed Insights measure visits, page usage, and loading performance, including page/referrer and browser/device information. We also record account-linked study activity in our own database to provide progress features and understand product use.
• Server and request logs: hosting and content-delivery providers, including Vercel and Cloudflare, process IP addresses and request metadata to serve and secure the Service.
• Diagnostics and web session replay: Sentry receives error and performance information, device/browser details, and interaction context. On the web, we attach your account ID when you are signed in. Error-triggered session replay can reconstruct interactions around an error. Replay is configured to mask text and inputs and block media; this is a safeguard, not a guarantee that every piece of personal information is excluded.
• Support and feedback: messages, screenshots you choose to attach, account ID and email when available, page URL, referrer, browser information, and relevant episode and audio position. If a feedback submission cannot be saved, its contents and context may be sent to Sentry so we can recover the report.
• Waitlist: your email, signup source, referrer, and browser information when you request availability updates, even if you have not created an account.

Your choices in voice practice

Voice practice is optional. Before recording, we ask you to agree to send your recording to Google Gemini for transcription and AI feedback. Microphone permission is separate from that agreement. You can decline and continue using other study features.

Use fictional study scenarios. Do not submit identifiable patient information, medical records, patient images, other people’s voices or personal information, or confidential exam content in recordings, messages, screenshots, or other inputs. The Service is not intended to receive patient records or provide clinical care.

The iOS app and embedded web tools

The native iOS app uses account and study data for its features and Sentry for crash, error, and performance diagnostics when configured. We do not deliberately add your account ID to native crash reports. Some tools open the Reflex website inside the app; those embedded pages use the web services described above, including web analytics and diagnostics. We do not use these services for advertising that tracks you across other companies’ apps or websites.

2. How we use information

We use information to provide and personalize the Service, maintain study history, process one-time purchases, operate optional AI voice practice, maintain security and prevent abuse, investigate errors and feedback, improve the product, respond to you, send requested availability updates and service communications, and comply with law.

3. Legal bases (GDPR/EEA users)

Where these laws apply, our legal bases are performance of a contract (providing the Service), legitimate interests (security and improvement), consent where required, and legal obligations. You may withdraw consent for future optional processing by no longer using that feature or by contacting us; withdrawal does not undo processing already carried out lawfully.

4. Service providers and other disclosures

We use the following providers to operate the Service:

Support messages and notifications are also handled in our support email systems. Access to support reports and diagnostics helps us investigate and respond to problems. Providers may also process certain data for their own legal, security, or payment obligations under their applicable terms. We may disclose information when legally required or to protect the Service and its users.

We do not sell your personal information.

5. International transfers

Our providers may process data in the United States and other countries. Where required, transfers rely on appropriate safeguards, such as Standard Contractual Clauses. Contact us for information about the safeguards applicable to your data.

6. Data retention

Retention depends on the type of information, the reason it was collected, account and support needs, provider retention settings, and applicable legal obligations:

• Account and study history: we retain these to provide your account, access, and progress history. Account deletion removes your authentication account and associated application records, including linked feedback screenshots and waitlist entries matched to your account email addresses.
• Voice practice: the current Explain It flow processes recordings to return a result; it does not save recordings or transcripts in our practice-history database. The browser holds recordings for submission or retry and displays transcripts and feedback during the session. Stored attempt scores and grading metadata follow account-data retention. Google’s handling of submitted audio and generated output is governed by the applicable service terms and settings. Provider retention is separate from storage in your Reflex account.
• Feedback and screenshots: retention is based on investigating and resolving reports and documenting corrections or recurring problems. Copies in support email, Slack, or Sentry are separate from the application database.
• Logs, analytics, and replay: retention is based on security, debugging, and product-analysis needs and the retention settings of the relevant systems.
• Waitlist and communications: retention is based on providing the updates you requested and handling removal requests. You can ask us to remove a waitlist signup without creating an account.
• Payments and backups: transaction records may be retained for tax, accounting, fraud prevention, or disputes. Backup copies remain subject to the relevant backup cycle and any legal preservation requirement.

Account deletion does not instantly erase all provider logs, support copies, payment records, or backups. Contact us to request deletion of information held outside your account; we assess those requests under applicable law and retention obligations.

7. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or export your data, object to or restrict processing, withdraw consent, or opt out of the “sale” or “sharing” of personal information. We do not sell your personal information. You can download your account data and delete your account from your account page; account deletion is also available in the iOS app. The download lists feedback-attachment metadata; contact us for copies of screenshot files or other data not included in the download.

For requests or privacy questions, contact support@reflexpmr.com. We may need to verify your identity before acting. We will not discriminate against you for exercising your rights. Where applicable, you may complain to your local data-protection authority.

8. Adult eligibility

The Service is intended for medical professionals and trainees who are at least 18. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. Contact us if you believe a child has provided personal information.

9. Security

We use reasonable technical and organizational measures, including encryption in transit and access controls. No system is perfectly secure.

10. Cookies, browser storage, and privacy signals

We use cookies and browser storage for authentication, preferences, local study state, and diagnostics. Web analytics and performance measurement are described above. We do not use advertising cookies. You can manage cookies and storage through your browser, but disabling them may affect sign-in and other features. Reflex does not implement a site-wide change in response to browser Do Not Track signals; individual browser or provider controls may still limit collection. Contact us to exercise applicable privacy rights.

11. Changes

We may update this Policy; material changes will be notified through the Service or by email.

12. Contact

Reflex PMR LLC, support@reflexpmr.com