Privacy notice

This notice is written for an Israeli launch and describes the categories of personal information MDvoro is designed to process. The operator should replace the bracketed contact details before launch and obtain Israeli legal review.

Who controls the information?

MDvoro is operated by the entity identified in the final Terms and Privacy Notice. The notice must publish a real legal name, business address and privacy contact before public launch.

Information we process

Depending on how you use MDvoro, this can include account identifiers, email address, profile details, exam selection, question attempts, scores, timing, confidence, bookmarks, notes, flashcards, study plans, subscriptions, security logs and support/copyright communications. MDvoro should not request medical-patient information from students.

Why we use it

We use information to authenticate users, provide the learning service, calculate progress and review schedules, protect the platform, prevent abuse, process subscriptions, answer support requests and comply with legal obligations. We should not use personal information for unrelated purposes without an appropriate legal basis and notice.

Israeli privacy framework

Israeli privacy obligations apply to databases even where database registration is not required. Amendment 13 changed the registration framework while retaining duties concerning information security, purpose limitation, confidentiality and data-subject rights. Some databases containing special-sensitivity information at significant scale are subject to a notification duty. Applicability must be assessed against the actual MDvoro database and processing activities before launch.

Security and suppliers

MDvoro uses authentication, row-level access controls, server-side authorization, restricted database functions, rate limits and audit records. Supabase, hosting, payment, email and other vendors may process information as service providers. The operator must maintain appropriate contracts, access controls, retention rules and transfer safeguards for each supplier.

Retention, access, correction and deletion

We retain information only as long as reasonably required for the stated purposes or a legal obligation. Users can request access or correction where applicable and can delete their account through the product. Deletion may be limited where information must be retained for security, fraud prevention, accounting, dispute handling or another legal requirement.

Cookies

Necessary session and preference cookies are used for the service. Optional analytics or advertising technologies must remain disabled until valid consent and the privacy/cookie notices are updated.

Cross-border processing

Some service providers may process data outside Israel. Before launch, the operator must document each transfer and apply the safeguards required by Israeli privacy law and any other applicable law.

This notice is an implementation template, not legal advice. Israeli counsel should confirm the final text, database classification, vendor agreements, international transfers, retention schedule and any notification/registration or privacy-officer duties before launch.