Privacy Policy

Last updated: June 3, 2026

Our Privacy Policy is available in PDF form.

Introduction

At MedIQ Learning, LLC d/b/a ScholarRx and d/b/a USMLE-Rx (“ScholarRx,” “we,” “us,” and “our”), we respect your privacy and are committed to protecting it.

This Privacy Policy (“Policy”) explains how ScholarRx collects, uses, discloses, and protects Personal Information (defined below) that we collect from and about you and your rights with respect to that information.

This notice covers Personal Information we collect from or about you when you access or use our websites ScholarRx.com, USMLE-Rx.com, and any other website operated by us (each a “Website”) on which this Privacy Policy is posted, use of our services including USMLE-RX™ modules, RX BRICKS® offering, RX BRICKS® ASSESSMENT BANKS offering, BRICKS CREATE™ offering, or other offerings (each such separate module or other offering is a “Solution”) to which this Policy is posted, use our apps, or interact with our advertisements (collectively, the “Services”). It also covers information that we may receive from other people or entities who share your Personal Information with us.

Please note that this Privacy Policy applies to anyone who uses or accesses our Services, regardless of whether you use the Services via a computer, mobile device, tablet, or other medium (collectively, your “Equipment”).

This Privacy Policy applies to information we collect:

Via the Services.
In email and other electronic messages between you and ScholarRx via our Services.
Via your interaction with our advertisements on third-party websites and services, if those advertisements include links to this Privacy Policy.

This Privacy Policy does not apply to information collected by:

Us through any website, content, application, or service we may offer which does not link to this Privacy Policy.
Any third party, including through any application or content (including advertising) that may link to or be accessible from or through our Services.

If you do not agree with this Privacy Policy, please do not use our Services. We reserve the right to update this Privacy Policy at any time. The “Last updated” date above provides you with notice of when this Privacy Policy was most recently updated.

Information We Collect

When you use our Services, we may collect information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you (“Personal Information”). Personal Information does not include information that is de-identified or anonymized or otherwise not considered Personal Information, consistent with applicable law.

We may collect the following information:

Identifiers. Examples include first name, last name, billing address, shipping address, email address, IP address, account access information.
Other Personal Information. Examples include name, address, telephone number, financial information (such as payment-related information), education information, and professional or employment-related information. Note, some information in this category may overlap with other categories.
Characteristics of Protected Classifications. Examples include age (over 40), gender, and marital status.
Commercial Information. Examples include details of products and services you have purchased from us.
Internet or Other Electronic Network Activity Information. Examples include information about how you use our Websites and Solutions, including when and for how long, what content you access, and other information relating to study and testing within the Solutions; internet protocol (IP) address; your login information, browser type and version, time zone setting, and browser plug-in types and versions; operating system, platform, and other technology on the devices you use to access our Websites and Solutions; and user-generated content, including messages, information, reviews, and feedback that you post publicly on our Solutions, Websites, or social media pages. If you choose to provide user content, it may be made available to other users of a Solution, on public areas of our Websites, or on or through our social media channels.
Geolocation Data. Examples include approximate or imprecise location information derived from your IP address or similar technologies (e.g., city, state, or zip code).
Professional or Employment‑Related Information. Examples include your education level and professional information.
Education Information. Examples may include course enrollment information, assessment results and test scores, progress metrics, and other education‑related data processed in connection with the Services, where applicable.
Other Information. Examples include your interests, feedback, survey responses, communication preferences, your preferences for receiving marketing from us and our third parties.

You are not obliged to provide your Personal Information to us. However, if we need Personal Information to provide a service and you do not provide this data, we may not be able to perform the Services you have requested.

Minors’ information

Our Websites, Solutions, and Services are not intended to be used by individuals under 18 years of age. No one under age 18 may provide any information to or on our Websites or our Solutions or other Services. We do not knowingly collect, sell, or share (as those terms are defined by applicable law) any Personal Information about individuals under 16. If you are under 16, do not use our Services and do not provide any information to us. If we learn we have collected or received Personal Information from an individual under 16, we will delete that information. If you believe we might have any information from or about an individual under 16, please contact us at info@ScholarRx.com.

Family Educational Rights and Privacy Act

ScholarRx may serve as a vendor to educational agencies and institutions. Subject to the Family Educational Rights and Privacy Act of 1974 (“FERPA”) and regulations under 34 C.F.R. §99.33(a) related to the use and redisclosure of personally identifiable information, ScholarRx will not disclose a student’s personally identifiable information without consent, unless FERPA or applicable laws permit the disclosure of such information.

As between ScholarRx and the applicable educational institution, all data subject to FERPA is the property of such educational institution. ScholarRx relies on covered educational institutions to obtain any consent required under applicable law for our collection, processing, or maintenance of FERPA-covered Personal Information or student education data.

How We Collect Information

We may collect Personal Information in the following ways:

When you provide it to us directly. You may give us information about you by completing forms or by communicating with us by email or otherwise. This includes information you provide when you register for an account, subscribe to one of our communications, place an order, participate in one of our events, write a review, or when you contact us about our Websites, Solutions, or other products or services. Additionally, our Services may allow you to upload your own content to public areas of the Services or to areas accessible to other subscribers of our Services. Any information you submit becomes public information, and we do not control how others may use the content you submit. We are not responsible for uses that may violate our End User License Agreement, Privacy Policy, the law, or your intellectual property rights.
Automatically from our Websites, Solutions, and emails. As you interact with our Websites, use our Solutions or other services, use our apps, interact with websites using our cookies, or our emails, we may automatically collect Technical Information about your Equipment and browsing actions and patterns. We collect this information by using cookies, server logs, web beacons, and other similar technologies. See Cookies and automatic data collection technologies section for additional information.
From third parties. We may receive information about you from third parties including, for example, our affiliated companies, business partners, subcontractors, analytics providers, and service providers. We may also receive information about you from publicly or commercially available sources, such as social media companies or advertisers or from educational institutions that provide us with your information in connection with institutional subscriptions.

Cookies and automatic data collection technologies

With your consent if required, we may automatically collect information when you interact with our Services. For example, we may use “cookies” and similar technologies, such as “web beacons” (also called “clear gifs” or “pixel tags”) and scripts, to obtain certain information when you use or access our Services. We may use information collected via these technologies to:

Estimate our audience and customer size and usage patterns.
Operate, maintain, and improve our Services.
Store your preferences so we may customize our Services according to your individual interests.
Speed up your searches.
Recognize you when you return to our Services.

We also may use these technologies to collect information about your online activities over time and across third-party websites or other online services (behavioral tracking). For more information, see the Interest-based advertising section of this privacy notice.

The technologies we use for this automatic data collection may include:

Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your Equipment or to your web browser’s memory to enable our systems to recognize your browser and to provide convenience and other features to you. We may also use cookies to provide additional features or functionality to your experience when you use our Services, for example, storing your preferences and other information about you when you use the Services. You may block or limit the storage of cookies via browser controls or other software. You may also delete cookies manually from your device through your internet browser, operating system, or other programs you use to access the Services. Please note that some portions of our Services may not function properly or be available if you block or delete certain cookies. For information about managing browser settings to refuse cookies, see Your rights and choices.
Web Beacons and Similar Technologies. Our Website pages, advertisements, and e-mails may contain small transparent embedded images or objects known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit us (often through our service providers or vendors), for example, to count Website page visitors or email readers, or to compile other similar statistics such as recording Website content popularity or verifying system and server integrity. For information about managing web beacons, see Your rights and choices.

How We Use information

Depending on how you interact with us or which of the Services you use, we may use Personal Information for the following purposes:

To create and manage your account.
To provide you with Solutions and other products and Services you request or purchase from us.
To deliver educational and interactive content via the Services.
To allow you to enter a grant, sweepstake, contest, promotion, other program that we may offer.
To conduct market research.
To develop and provide advertising tailored to your interests and to determine the effectiveness of our advertising.
To provide you with the information or support that you request from us, including to send you newsletters.
To operate and improve our Websites, Solutions, other products or Services, marketing, customer relationships, and experiences.
To support, improve, and develop AI-assisted features within our Services. “AI-assisted features” means features that use artificial intelligence or machine learning models to generate or help generate content within the Services (for example, content creation).
To develop new products and Services.
To analyze performance and use of our Services.
To notify you of special offers, discounts, updates, and products and services that we think may be of interest to you, including from us and third parties. To learn more about your choices with regards to these communications see Your rights and choices.
To manage our relationship with you, which may include notifying you about changes to our terms or Privacy Policy, providing you with notices about your account, asking you to leave a review or complete a survey, addressing any questions you may have about our products or services.
To provide you with the information, products, services or support that you request from us or to fulfill any other purpose for which you provide it.
To deliver relevant content, advertisements, and messaging to you and to measure or understand the effectiveness of such content, advertisements, and messaging.
To make suggestions and recommendations to you about our own and third parties’ products or services that may be of interest to you. If you do not want us to use your information in this way or for more information on how to adjust your preferences, see Your Rights and Choices.
To carry out our obligations and enforce our rights and to protect our Websites, Solutions, customers, and other individuals including to protect against or identify possible fraudulent transactions.
For any other purpose as may be permitted by law or that we describe when you provide the information, including with your consent, as permitted by applicable law.

We may also use or disclose Personal Information in the following circumstances:

To comply with any court order, law, or legal process, including responding to any legal government or regulatory request.
To enforce our Terms and Conditions, this Privacy Policy, or other applicable policies or agreements with you.
To protect the rights, property, or safety of our business, employees, customers, or others. This includes exchanging information with other companies and organizations for the purposes of cybersecurity, fraud protection, and credit risk reduction.
To investigate suspected violations of any law, rule or regulation, or the terms or policies for our Websites or Services.

Under some circumstances, we may anonymize or de-identify Personal Information so that it can no longer be associated with you, either directly or indirectly, alone or in combination with any other information. We reserve the right to use such anonymous and de-identified data for any legitimate business purpose without further notice to you or your consent, consistent with applicable law.

Legal Bases for Processing Personal Information

If you reside in the European Economic Area (“EEA”), the UK, or Switzerland, the following legal bases for processing your Personal Information apply:

Consent: Your Personal Information is primarily used to provide you with the Services you request. It may also be used to comply with legal obligations we are subject to and to enforce our Terms and Conditions and agreements with you.
With your prior consent, your Personal Information may also be used to send you tailored offers and updates about products and Services from us by email or other electronic means of communication, such as showing you our ads on social media platforms.
Your Personal Information may be used to fulfill our legitimate interests, such as to develop and improve our Services, to provide you with an account to access our Services, or to detect illegal activities. We also rely on our legitimate interests to execute our marketing strategies, such as creating aggregated segments and models for business analytics, including to look for similar audiences on online platforms that may enjoy our ads, or to ensure these platforms do not show our ads to you. You may object to the activities based on our legitimate interest at any time by contacting us as indicated in the Contact Us section below, but we may continue processing if we have compelling interests, which override your objections.
Disclosure of Information

We may disclose Personal Information as follows:

Service Providers. We may share Personal Information with vendors who help us with certain Services, including customer support, email and text message deployment and engagement analytics, research and analytics, marketing and advertising services, data processing, management, fraud prevention, transaction and payment processing, and survey administration. If we engage any service providers in data processing activities, such processing will be governed by a Data Processing Agreement (“DPA”), and any such sub-processors will be added to our Sub-processors List.
Business Partners, Advertisers, and Other Third Parties. With appropriate consent if required, we may share Personal Information with or make it available to our sponsors, partners, advertising networks, advertising servers, and analytics companies or other third parties in connection with our and their marketing, promotional and other offers, as well as product information.
Educational Institution or Organization. If your subscription to one or more of our Solutions is provided through an agreement between us and your educational institution or organization, we may share your Personal Information with the educational institution or other organization through which you are subscribed.

Note: We also use Google Analytics to analyze use of our Services. For more information about how Google uses information from sites or apps that use its services, please visit https://policies.google.com/technologies/partner-sites - http://www.google.com/policies/privacy/partners/.

We may also disclose Personal Information in the following circumstances:

Law Enforcement, Regulators, Courts, and other Governmental Authorities. We may share any of the categories of Personal Information we collect, pursuant to applicable law, to respond to subpoenas, court orders, legal process, and other law enforcement measures, to comply with other legal obligations, to respond to an emergency, or otherwise to protect our or the rights, property, safety, or security of other parties, visitors to or users of our Services, or the public.
Business or Asset Transfers. If we are involved in a merger, acquisition, transfer of control, bankruptcy, reorganization, or sale of assets, or diligence associated with such matters, we may share Personal Information with relevant stakeholders. For example, if another entity acquires us or all or substantially all of our assets, or assets relating to any of our businesses, your information may be disclosed to that entity as part of the due diligence process and may be transferred to that entity as one of the transferred assets.

Interest-based advertising

Some content or applications on our Websites, Solutions, and other Services, including advertisements, may be served by third parties, including advertisers, ad networks, and servers, content partners, or application providers. These third parties may use cookies alone or in conjunction with web beacons or other tracking technologies to collect information about you when you use our Services. If they collect information, it may be associated with your Personal Information, or they may collect information, including Personal Information, about your online activities over time and across different websites and other online services. Such information may be used to provide you with interest-based (behavioral) advertising or other targeted content. Our partners may use non-cookie technologies on which browser settings that block cookies might have no effect. Your browser may not permit you to block such technologies.

For information on how to block non-essential cookies from your Equipment, please refer to the Cookies and Other Data Collection Technologies section above.

Finally, please note that certain browsers may offer the option of providing notice to websites that you do not wish for your online activities to be tracked for interest-based advertising purposes (Global Privacy Control Notice or universal opt out mechanisms). Should we engage in the sale or sharing (as those terms are defined by applicable law) of Personal Information for targeted advertising, we will respond to and abide by the signals sent through universal opt out mechanisms that are consistent with applicable law.

Third-Party Content, Apps, and Links

Some content or applications on our Services may contain links to other third-party websites, including social media sites. This Privacy Policy only applies to our Websites and Services. If you click a link on or through our Services that takes you to another website which we do not control, including any educational institution or organization links or subscriptions, you are subject to that site’s privacy policy and terms.

International Transfers of Personal Information.

We are based in the United States. If you are using our Services from outside the United States, such as in the EEA, the UK, Switzerland, or Canada, please know that the information collected by our Services will be stored and processed in the United States, or any other country in which ScholarRx maintains facilities, including hosting services or servers. Such cross-border transfers are made using appropriate safeguards and any necessary supplementary measures.

By providing your information via our Services, you are consenting to the transfer of your personal information outside of your country of residence in accordance with this Privacy Policy and applicable law. You are also consenting to the application of United States law in all matters concerning our Services. We enter into the EU Standard Contractual Clauses for data transfers with our customers located in the EEA, the UK, or Switzerland who use the Services.

Your Rights and Choices

You may exercise control over your information as follows:

Subject to applicable law and your location, we may send you marketing communications. If you do not want us to use your email address or other contact information to promote or recommend our own products and services, or third parties’ products or services, you can opt-out. If you have an account with us, you may be able to log in set preferences related to use of your information for certain marketing purposes. If you do not have an account, you can indicate your preferences by contacting us as provided in the Contact Us section. You may also opt-out of email marketing communications by replying to any promotional email we have sent you or following the opt-out links provided in an email marketing message.
Accessing, Updating, and Deleting Your Information. If you have an account with us, you may access your information and make updates to or delete your data. You may also contact us as provided in the Contact Us section below to request access to, correction of, or deletion of your Personal Information, consistent with your rights as described below. We may not accommodate a request to change information if we believe the change may violate any law or legal requirement or negatively affect the information’s accuracy.
Location Information. As noted above, when you use our Services, we may automatically collect certain information about the Equipment you are using. This includes the approximate location of your Equipment derived from your IP address, for example.
Cookies and Automatic Data Collection Technologies. You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. However, if you disable or refuse cookies, please note that some parts of the Services may become inaccessible or not function properly. In some cases, you may be able to set your browser or email program to not download web beacons.
Interest Based Advertising. Please see Interest-based advertising above for information on how to opt-out of interest-based advertising.

U.S. Residents’ Data Subject Access Rights. Depending on your U.S. state of residency, you may have certain rights related to your Personal Information. For information about EU/UK/Swiss data subject rights, please see Your European Data Subject Rights below, and for information about Canadian data subject rights, please see Your Canadian Data Subject Rights below.

U.S. state data subject rights may include:

Access. You may confirm whether we process your Personal Information and access a copy of the Personal Information we process. Depending on your state of residency, you may also have the right to receive additional information, and it will be included in the response to your access request. (e.g., CA, CO, CT, DE, IN, IA, KY, MD, MN, MT, NB, NH, NJ, OR, RI, TN, TX, UT, VA).
Data Portability. To the extent feasible and required by state law, depending on your state of residency, data will be provided in a portable format. (e.g., all states noted above in Access except for DE, IN, IA, MT, NB, TN, TX, UT; VA right limited to consumer-provided data).
Correction. You may request that we correct inaccuracies in your Personal Information that we maintain, considering the information's nature and processing purpose. (e.g., all states noted above in Access except for IA; IN right limited to consumer-provided data).
Deletion. You may request that we delete Personal Information about you that we maintain, subject to certain exceptions under applicable law. (e.g., all states noted above in Access except UT which is limited to consumer-provided data).
Opt Out of Using Personal Information for Targeted Advertising, Profiling, and Sales. You may request that we do not use your Personal Information for these purposes. (e.g., all states noted above in Access except for IA and UT with respect to use for profiling and IA for use for target advertising).
The right to exercise your rights free from discriminatory treatment. (e.g., all states noted above in Access).

California Residents. If you are a California resident, you may have additional personal rights and choices regarding your personal data. For example, California’s “Shine the Light” law (Civil Code Section § 1798.83) permits California residents that use covered websites to request certain information regarding the disclosure of certain personal information to third parties for the third parties’ own direct marketing purposes. Please note that it is our policy not to disclose the personal information of individuals who have opted out of such disclosure for such purposes to third parties for their direct marketing purposes. You may exercise this cost-free right by contacting us using the information provided in Contact Us below.

Nevada Residents. Nevada residents have the right to opt out of the sale of certain personal information collected by operators of websites or online services. Please note that we do not sell covered information, as "sale" is defined by the Nevada law.

Exercising U.S. Data Subject Rights

To exercise any applicable U.S. state data subject rights, please submit a request using the contact information provided in the Contact Us section below.

Verification of Data Subject Rights Requests. We may require that your identity be verified prior to processing verifiable rights requests. If your request requires verification, we will verify your identity by comparing the information we have about you against the information we receive when you submit your request. If we do not have enough information to verify your identity, we may request additional information from you, consistent with applicable law. We may deny a rights request if we are unable to verify your identity.
Authorized Agents. Some U.S. states expressly permit their residents to designate an authorized agent to submit requests to exercise certain data subject rights on the individual’s behalf, including California, Colorado, Connecticut, Virginia, and Maryland (for opt‑out requests). Even if you use an authorized agent to submit a request on your behalf, pursuant to applicable law, we may still require that you verify your identity depending on the nature of the request and sensitivity of the information at issue.

If you are an authorized agent submitting a request on behalf of an individual, please submit a request using the contact information provided in the Contact Us section below. You must include a copy of the data subject’s written, signed permission indicating that you are permitted to act on that person’s behalf.

Appealing a Denied Data Subject Request. In some circumstances, we may deny your request to exercise one or more of the rights described above. If you disagree with our decision to deny your request or any portion of your request, and your state of residency grants you an appeal right (not CA or UT) you may appeal our decision within sixty (60) days of receipt of notice that your request has been denied. If you submit an appeal to a denied request more than sixty (60) days after you have been notified of our decision to deny the request, we may deny your appeal. If you submit a timely appeal, we will respond within forty-five (45) days of our receipt of your appeal.

If you wish to appeal a decision, please clearly and plainly describe your disagreement with our decision by responding through the same means by which we communicated our decision or by submitting your appeal using the information provided in the Contact Us section below. We will review your appeal and either amend or uphold our decision. In either case, we will provide a written explanation of the reason for the decision. This decision will be final.

If your appeal is denied, certain U.S. state privacy laws require that we inform you of your right to file a complaint with your state attorney general. States with such requirements currently include: Colorado, Iowa, Kentucky, Maryland, Montana, Nebraska, New Jersey, Oregon, Tennessee, Texas, and Virginia.

EU, UK, and Swiss Residents’ Data Subject Rights

If you reside in the EEA, the UK, or Switzerland, you have the following rights regarding your Personal Information:

Right to request access to your Personal Information;
Right to request rectification (correction) of your Personal Information;
Right to request erasure of your Personal Information (right to be forgotten);
Right to request restrictions on processing your Personal Information;
Right to object to our processing of your Personal Information;
Right to request portability of your Personal Information;
Where our processing of your Personal Information is based on your consent, the right to withdraw your consent at any time, without affecting the lawfulness of any processing based on consent before its withdrawal;
Right to lodge a complaint with a supervisory authority; and
Right to know the existence of our use of automated decision-making, including profiling, and to receive meaningful information about the logic involved, as well as the significance and the possible consequences of such processing for the data subject, if we engage in such activities.

To exercise any of these rights, please contact us as provided in the Contact Us section below. We will respond to all requests in accordance with applicable data protection laws. If we reject your data subject request, we will notify you of our reason for doing so. You have the right to file a complaint with the Data Protection Authority, as applicable, (contact information available here) or with the UK Information Commissioner’s Office, as applicable, here, and to seek judicial remedy.

Please note there are some instances where we cannot honor these requests and may be required by law or other legitimate reasons to continue processing your Personal Information.

Canadian Residents’ Data Subject Rights

We comply with applicable Canadian privacy laws and regulations in connection with processing Canadian Personal Information.

We collect, use, and disclose Personal Information for the purposes described in this Privacy Policy, based on your consent where required by applicable law, or as otherwise permitted or required by law. We obtain consent in a manner consistent with applicable law.

Communications

Commercial electronic messages sent to Canadian residents are subject to Canada’s Anti‑Spam Legislation (CASL), which may require express consent.

Further, you may withdraw your prior consent to receive marketing or promotional communications from us at any time, including by using the unsubscribe mechanism included in such communications.

Transferring Personal Information outside of Canada

We may transfer Personal Information that we collect, or that you provide, to third parties (including affiliates, service providers and others) as described in the Disclosure of your information section above.

We may process, store, and transfer your Personal Information in and to a foreign country, with different privacy laws that may or may not be as comprehensive as Canadian law, such as to the United States. In these circumstances, the governments, courts, law enforcement, or regulatory agencies of that country may be able to obtain access to your Personal Information through the laws of the foreign country.

When we transfer Personal Information outside of Canada for processing, we remain responsible for that information and ensure that appropriate contractual and other safeguards are in place to protect it, consistent with applicable Canadian privacy laws. These safeguards include restrictions on use, confidentiality obligations, security measures, and requirements to notify us of any unauthorized access or disclosure.

You may contact us with questions regarding the collection, use, disclosure or storage of Personal Information by our service providers and affiliates outside Canada, and/or to obtain access to written information about our policies and practices with respect to service providers (including affiliates) outside Canada.

For questions about our privacy practices, please contact us as directed in the Contact Us section of this policy.

Data Retention

Your Personal Information will be stored and hosted in the United States and accessible to our employees and service providers who have a “need to know” such information for the purposes described in this privacy notice.

Except as otherwise permitted or required by applicable law or regulation, we will retain your Personal Information for as long as necessary to fulfill the purposes for which we collected it, and/or for the purposes of satisfying any legal, accounting, or reporting requirements. We determine retention periods based on the amount, nature, and sensitivity of the information; the risk of harm from unauthorized use or disclosure of the information; the purposes for which it was collected; legal and regulatory requirements, and applicable limitation periods.

Accessing and correcting your Personal Information

By law, Canadian residents have the right to request access to and to correct or rectify the Personal Information that we hold about them, subject to certain exceptions as required or permitted by applicable law.

You can review and change your Personal Information by logging into your account and visiting the pages that correspond to the information you want to review and change.

If you want to access, review, verify, correct, rectify, update, or withdraw consent to the collection, use, or disclosure of your Personal Information, you may also contact us as directed in the Contact Us section of this policy to make such a request.

We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect.

We may request specific information from you to help us confirm your identity and your right to access, and to provide you with the Personal Information that we hold about you or make your requested changes. Applicable law may allow or require us to refuse to provide you with access to some or all of the Personal Information that we hold about you, or we may have destroyed, erased, or made your Personal Information anonymous in accordance with our record retention obligations and practices. If we cannot provide you with access to your Personal Information, we will inform you of the reasons, subject to any legal or regulatory restrictions.

Once we have confirmed the details of your requests and validated your identity, we will respond within the prescribed timeframes set out in applicable Canadian privacy law. We will provide access to your Personal Information, subject to exceptions set out in applicable privacy legislation. Examples of such exceptions may include (without limitation):

Information protected by solicitor-client privilege.
Information that is part of a formal dispute resolution process.
Information that would reveal the Personal Information or confidential commercial information of another person.
Information that is prohibitively expensive to provide.

If you are concerned about our response or would like to correct the information provided, you may contact us as described in the Contact Us section of this policy. If you are not satisfied with our response, you also have the right to file a complaint with the Office of the Privacy Commissioner of Canada.

Quebec Residents

If you are a resident of Québec, you may have additional data subject rights, including rights to be informed about the collection, use, and disclosure of your Personal Information; the right to request access to and erasure of your Personal Information; the right to restrict or withdraw consent to the processing of your Personal Information in certain circumstances; and the right to request data portability of your Personal Information.

Retention.

We retain and use Personal Information for the period necessary for the purposes for which we collected the information and as required or permitted by applicable law. Accounts that are inactive for two years may be archived and deleted after a ninety (90) day grace period.

Security.

We have implemented appropriate technical and organizational measures designed to protect Personal Information from accidental loss and from unauthorized access, use, alteration, and disclosure.

The safety and security of your information also is your responsibility. Where we have given you (or where you have chosen) a password for access to our Services, you are responsible for keeping this password confidential. Additionally, the information you share in public areas may be viewed by any user of the Website and information you share in a Solution may be viewed by any other user of the Solution.

Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your Personal Information, we cannot guarantee the security of your Personal Information transmitted to our Services. Any transmission of Personal Information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures implemented on Services.

Artificial Intelligence

Our Services may provide you access to AI-assisted features. AI-assisted features within our Services do not make automated decisions that produce legal effects or similarly significant effects on users. We do not permit patient data or other special-category health data to be input into our AI-assisted features, as described in our Terms and Conditions. Any AI-assisted features within our Services that are provided by our service providers are subject to a contractual prohibition on such service provider using Personal Information to train its general-purpose models.

Changes to our privacy policy

As noted above, we may update this Privacy Policy from time to time, and we will provide notice of any material changes to the Privacy Policy as required by law. All changes will be effective upon posting of the updated Privacy Policy on our Services. If you object to any change, please stop using the Services. We will post any changes we may make to our Privacy Policy on this page. You are responsible for periodically visiting our Website and this page to check for any changes.

If you have any questions about our Privacy Policy or to exercise your data subject rights, please use our ScholarRx Contact Us page, or send an email to privacy@scholarrx.com.

You can also reach out to our privacy officer at: privacy@scholarrx.com