Privacy Policy

This Privacy Policy is issued by Prognia B.V. ("Prognia", "we", "us", or "our"), a private limited company incorporated under the laws of the Netherlands, registered with the Dutch Chamber of Commerce (Kamer van Koophandel) under number [KvK number — to be added], with its registered address at [Registered address — to be added], Amsterdam, the Netherlands.

Prognia B.V. is the data controller for personal data collected through the Prognia platform and all associated products and services, including WARD and Suture (the "Services").

Prognia has not appointed a formal Data Protection Officer. For all privacy-related questions, requests, or concerns, please contact:

We will acknowledge your request within 5 business days and respond in full within 30 days (or within any shorter period required by applicable law).

This Privacy Policy applies to all personal data processed by Prognia in connection with your use of the Services, including when you:

• Create and use a Prognia account (free or paid).
• Subscribe to a paid Subscription Plan.
• Use WARD, including its AI Features, drug database, simulations, and medical literature tools.
• Use Suture.
• Publish or purchase content on the Creator Marketplace.
• Receive communications from Prognia.
• Contact us for support or with enquiries.

This Policy does not apply to third-party websites or services linked to from within the Services. Those are governed by their own privacy policies.

We collect the following categories of personal data, depending on how you use the Services:

3.1 Account and identity data

• Full name.
• Email address.
• Password (stored as a cryptographic hash only — we never store your password in plain text).
• Professional role or status (e.g. medical student, resident, healthcare professional) if provided during registration.
• Account preferences and settings.

3.2 Subscription and billing data

• Subscription plan type (Pulse, Vitals, or Cortex).
• Billing date and subscription history.
• Payment method details: these are processed directly by Stripe, Inc. Prognia does not store your full card number, CVV, or other sensitive payment card details. We receive only a payment confirmation and a tokenised payment reference from Stripe.

3.3 Usage and activity data

• Features accessed and actions taken within the Services.
• Quiz results, flashcard progress, and simulation results.
• Search queries entered within the platform.
• Articles and guidelines viewed or bookmarked.
• Time and frequency of use.

3.4 Creator and Marketplace data

• Content you publish on the Marketplace (quiz decks, flashcard decks, and associated metadata).
• Sales history and Creator Revenue earned.
• Payout details: bank account number (IBAN for EU creators) or PayPal email address, as provided by you for the purpose of receiving payouts.
• Reviews and ratings you submit for purchased content.

3.5 Communications data

• Email address used to receive transactional communications (password resets, subscription confirmations, payout notifications).
• Email address and marketing communication preferences, if you have opted in to marketing communications.
• The content of any messages you send to us via email or support channels.

3.6 Technical and device data

• IP address.
• Browser type and version.
• Device type and operating system.
• Time zone and language settings.
• Pages visited within the Services, timestamps, and referring URLs.
• Session identifiers and authentication tokens.

3.7 Cookie and tracking data

We use strictly necessary cookies (e.g. session cookies) to operate the Services. In the future, we intend to introduce analytics and marketing cookies (including Google Analytics and Meta Pixel), for which we will request your separate consent. Full details are set out in our Cookie Policy at www.prognia.nl/cookie-policy.

We collect personal data in the following ways:

• Directly from you: when you register for an account, complete your profile, subscribe to a plan, publish content on the Marketplace, make a purchase, contact us, or otherwise interact with the Services.
• Automatically: when you use the Services, we automatically collect technical and usage data through server logs, session tracking, and necessary cookies.
• From third parties: we may receive limited data from Stripe in connection with payment processing (e.g. confirmation of payment status).

For users located in the European Union or European Economic Area, Prognia processes personal data on the following legal bases under the General Data Protection Regulation (GDPR):

Where we rely on legitimate interests, you have the right to object to that processing. See Section 11 for details of your rights. For users outside the EU/EEA, we apply the same processing standards described above, adapted to the requirements of applicable local law.

We use the personal data we collect for the following purposes:

• To create, manage, and secure your account.
• To provide and operate the Services, including all features of WARD and Suture.
• To process subscription payments and manage your billing relationship via Stripe.
• To facilitate Marketplace transactions, including processing purchases and making Creator payouts.
• To deliver transactional communications, including account confirmations, payment receipts, password reset emails, and payout notifications.
• To send marketing and promotional communications, where you have opted in. You may withdraw consent at any time by clicking the unsubscribe link in any marketing email or by contacting medical@prognia.nl.
• To operate and improve our AI Features by analysing aggregated, anonymised usage patterns. We do not use individually identifiable user inputs to train our AI models.
• To detect, investigate, and prevent fraud, abuse, and security incidents.
• To comply with applicable legal obligations, including tax and accounting requirements.
• To respond to your enquiries and support requests.
• To enforce our Terms of Service and other applicable policies.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our standard retention periods are:

When you delete your account, we will delete or anonymise your personal data within 90 days, except where we are required by law to retain it for longer (for example, financial transaction records under Dutch tax law). Content you have published on the Marketplace may be retained in anonymised form to the extent necessary to honour the rights of existing Buyers.

Prognia does not sell your personal data to third parties. We share personal data only in the following circumstances:

8.1 Service providers (data processors)

We engage the following third-party service providers who process personal data on our behalf, under written data processing agreements:

8.2 Creator Marketplace — Buyers and Sellers

When you purchase content on the Creator Marketplace, limited transaction data (such as the fact that a purchase was made and a review was left) is visible to the relevant Creator. Creators do not receive your name, email address, or payment details. When you publish content as a Creator, your creator profile name and content will be visible to all platform users.

8.3 Legal and regulatory disclosure

We may disclose your personal data to law enforcement, regulatory authorities, or courts where we are required to do so by applicable law, or where we believe in good faith that disclosure is necessary to: (a) comply with a legal obligation; (b) protect the rights, property, or safety of Prognia, its users, or the public; or (c) detect, prevent, or address fraud or security incidents.

8.4 Business transfers

In the event of a merger, acquisition, reorganisation, or sale of all or substantially all of Prognia's assets, your personal data may be transferred to the acquiring entity. We will notify you via email and/or a prominent notice on the platform before your data is transferred and becomes subject to a different privacy policy.

Prognia is based in the Netherlands and primarily stores user data on servers in the Netherlands through YourHosting. However, some of our service providers are located in the United States and other countries outside the European Economic Area (EEA).

When we transfer personal data outside the EEA, we ensure that an appropriate safeguard is in place to protect your data, in accordance with GDPR Chapter V. For transfers to the United States and other third countries, we rely primarily on Standard Contractual Clauses (SCCs) adopted by the European Commission (Commission Implementing Decision (EU) 2021/914), supplemented where necessary by additional technical and organisational measures.

Each of our US-based service providers (Vercel, Stripe, Resend, Google, SendGrid, and future providers) has entered into data processing agreements with Prognia that incorporate the applicable SCCs. You may request a copy of the relevant transfer safeguards applicable to your personal data by contacting medical@prognia.nl.

We use cookies and similar technologies to operate and improve the Services. Cookies are small text files stored on your device when you visit a website or use an application.

Currently, we use only strictly necessary cookies, which are required for the Services to function (for example, session cookies to keep you logged in). These cookies do not require your consent.

In the future, we intend to introduce analytics cookies (Google Analytics) and advertising/measurement cookies (Meta Pixel). These are non-essential cookies and we will request your explicit consent before placing them on your device, through a cookie consent banner. You may update your cookie preferences at any time through the cookie settings on the platform.

Full details of all cookies used, their purpose, duration, and how to manage them are set out in our Cookie Policy, available at www.prognia.nl/cookie-policy.

If you are located in the EU or EEA, you have the following rights in relation to your personal data under the GDPR. You may exercise any of these rights by contacting us at medical@prognia.nl with the subject line "Privacy Request":

11.1 Right of access

You have the right to request a copy of the personal data we hold about you, along with information about how we process it. We will provide this within 30 days of a valid request, free of charge for the first request.

11.2 Right to rectification

You have the right to request correction of any inaccurate or incomplete personal data we hold about you. You can update most of your account information directly through your account settings.

11.3 Right to erasure

You have the right to request that we delete your personal data in certain circumstances, for example where the data is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies. Please note that we may be required to retain certain data by law (for example, financial records). We will delete or anonymise eligible data within 90 days of a valid erasure request.

11.4 Right to restriction of processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, for example while we investigate a dispute about its accuracy.

11.5 Right to data portability

Where processing is based on your consent or on the performance of a contract, and where processing is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV), and to request that we transmit it to another controller where technically feasible.

11.6 Right to object

You have the right to object at any time to processing based on legitimate interests (Article 6(1)(f)), including profiling. We will cease the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless the processing is for the establishment, exercise, or defence of legal claims.

You also have the absolute right to object to processing of your personal data for direct marketing purposes, including profiling related to direct marketing. We will stop such processing immediately upon receipt of your objection.

11.7 Rights related to automated decision-making

You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significant effects on you. Prognia does not make any such automated decisions about users.

11.8 Right to withdraw consent

Where processing is based on your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal. To withdraw consent for marketing emails, use the unsubscribe link in any email or contact medical@prognia.nl.

If you are a resident of the State of California, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you the following rights in addition to those described elsewhere in this Policy:

12.1 Categories of personal information collected

In the preceding 12 months, Prognia has collected the following categories of personal information as defined by the CCPA:

• Identifiers: name, email address, IP address, account identifiers.
• Commercial information: subscription records, Marketplace purchase history, Creator Revenue records.
• Internet or other electronic network activity: usage data, pages visited, features accessed.
• Financial information: bank account number or PayPal email (for Creators only, for the purpose of processing payouts).
• Inferences drawn from the above: aggregated usage patterns used to improve the Services.

We do not collect Social Security numbers, driver's licence numbers, biometric data, geolocation data, or sensitive personal information beyond Creator payout details.

12.2 Your California rights

• Right to Know: you may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of collection, the business or commercial purpose for collection, and the categories of third parties with whom we share it.
• Right to Delete: you may request deletion of your personal information, subject to certain legal exceptions.
• Right to Correct: you may request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing: Prognia does not sell your personal information to third parties for monetary consideration, nor do we share it for cross-context behavioural advertising without your consent. You therefore have nothing to opt out of in this respect. If this changes in the future, we will update this Policy and provide an opt-out mechanism.
• Right to Non-Discrimination: we will not discriminate against you for exercising any of your CCPA rights.
• Right to Limit Use of Sensitive Personal Information: where we process sensitive personal information (Creator payout details), we use it only for the purpose of processing your payouts and for no other purpose.

12.3 How to submit a California rights request

California residents may submit a rights request by emailing medical@prognia.nl with the subject line "California Privacy Request". We will respond within 45 days of receiving a verifiable consumer request. We may request additional information to verify your identity before processing your request.

13.1 Our approach

Prognia does not impose a minimum age requirement, as the Services contain no age-restricted content. The platform is designed for medical education and is appropriate for users of all ages who wish to learn about medicine. We do not knowingly collect personal data from children for commercial or advertising purposes.

13.2 US users under 13 — COPPA

If you are located in the United States and are under 13 years of age, you must obtain verifiable parental consent before creating an account or using the Services, as required by the Children's Online Privacy Protection Act (COPPA). By registering, you confirm that parental consent has been obtained.

Parents or legal guardians of users under 13 may contact us at medical@prognia.nl to: (a) review the personal data we have collected from their child; (b) request correction of that data; or (c) request deletion of their child's account and associated data. We will respond within 30 days and take action within 45 days. We do not direct advertising to users under 13, and we do not share data about users under 13 with advertising networks.

13.3 EU/EEA users below the digital age of consent

In the Netherlands, the digital age of consent under GDPR Article 8 is 16. In other EU member states, this age ranges from 13 to 16. If you are below the applicable digital age of consent in your country, your parent or legal guardian must provide consent for the processing of your personal data before you register. By registering, you confirm that such consent has been obtained. Parents or legal guardians may contact us at medical@prognia.nl to review, correct, or request deletion of data relating to their child.

Prognia implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Encryption of all data in transit using TLS (Transport Layer Security / HTTPS).
• Cryptographic hashing of passwords (passwords are never stored in plain text).
• Access controls limiting access to personal data to authorised personnel only, on a need-to-know basis.
• Hosting of primary data on servers located within the EU through YourHosting.
• Regular review of security practices and assessment of risks.

Despite these measures, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security of your personal data. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours of becoming aware of the breach, and will notify affected users directly where required by law.

The Services may contain links to third-party websites, including links to scientific articles, medical databases, and external resources. This Privacy Policy does not apply to those third-party websites or services. We encourage you to review the privacy policies of any third-party sites you visit. Prognia is not responsible for the privacy practices of third-party operators.

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, the Services we offer, or applicable law. When we make material changes, we will notify you by email to the address registered on your account and/or by posting a prominent notice on the platform, at least 30 days before the changes take effect.

The date at the top of this Policy indicates when it was last updated. We encourage you to review this Policy periodically. Your continued use of the Services after the effective date of a revised Policy constitutes your acceptance of the changes. We maintain a version history of previous Privacy Policies, which is available on request by emailing medical@prognia.nl.

17.1 Contact us first

If you have a concern or complaint about how we handle your personal data, we encourage you to contact us first at medical@prognia.nl with the subject line "Privacy Complaint". We take all complaints seriously and will endeavour to resolve your concern within 30 days.

17.2 Dutch supervisory authority

If you are located in the Netherlands and are not satisfied with our response, you have the right to lodge a complaint with the Dutch Data Protection Authority:

17.3 Other EU supervisory authorities

If you are located in another EU member state, you may also lodge a complaint with the supervisory authority in your country of residence. A list of EU supervisory authorities is available at edpb.europa.eu.