Privacy Notice

Effective date: July 29, 2026

Version: 2026-07-29.3

This Privacy Notice explains how Urology Oral Boards Coach, operated by Sohrab Arora, MD in Texas, collects, uses, discloses, retains, and protects personal data. The Coach is an educational board-preparation tool only. Do not enter patient-identifiable information.

Information We Collect

• Account and contact data: email address, display name, password hash, consent records, account status, trial status, and settings.
• Practice and user content: typed answers, simulated case context, examiner responses, scores, practice transcripts, selected mode and difficulty, feedback, and issue reports.
• Dictation data: audio submitted for transcription and the resulting transcript. We do not intentionally retain a local copy of dictation audio after processing the request.
• Purchase data: plan, entitlement, renewal/expiration status, included-turn usage, purchased extra-turn balance, processor customer or transaction identifiers, and billing-event records. Apple and Stripe process payment credentials; we do not store full card numbers.
• Device, usage, and security data: device registrations, IP address, browser or app type, user agent, login and signup events, rate-limit and device-limit events, feature usage counts, request timing, errors, audit events, and security logs.
• Communications: support requests, correction reports, refund requests, and other communications you send us.

We do not intentionally collect patient records, health records about the user, precise location, contacts, advertising identifiers, or data for targeted advertising.

How We Use Information

We use personal data to provide and secure accounts; deliver simulated practice, scoring, and dictation; maintain sessions and device limits; validate purchases and entitlements; prevent fraud and abuse; provide support and refunds; monitor reliability and cost; investigate errors; maintain backups; enforce our Terms; and comply with legal, tax, accounting, security, and dispute obligations.

We do not sell personal data. We do not share personal data for cross-context behavioral advertising or use it for decisions that produce legal or similarly significant effects.

Service Providers and Data Disclosure

We disclose only the data reasonably needed for a provider to perform its service. Providers may include:

• OpenAI, OpenRouter, routed AI model providers, and other configured AI providers or gateways for examiner responses, scoring, and related educational processing;
• AssemblyAI or another configured speech-to-text provider for dictation;
• Apple for App Store distribution, purchases, subscription management, and refunds;
• Stripe for web checkout, billing management, fraud prevention, and refunds;
• Cloudflare and hosting/network providers for delivery, security, rate limiting, and infrastructure;
• email, backup, monitoring, and support providers used to operate the service.

Providers process data under their own applicable terms and privacy obligations. We require providers acting for us to protect data consistently with this Notice and applicable law. We may also disclose information when required by law, to protect rights or safety, to investigate fraud or security incidents, or as part of a business transfer subject to appropriate safeguards.

AI and Speech Processing Consent

Practice answers, active case context, recent transcript, scoring requests, mode and difficulty, dictation audio or transcript, and limited technical identifiers may be securely processed through configured third-party or self-hosted AI and speech-to-text services. The in-app disclosure requests consent before these features are used. You may decline by not using the Coach. Dictation is optional.

Do not submit patient information, institutional secrets, or information you are not authorized to share.

No Patient-Identifiable Information

The service is not designed to receive protected health information or patient-identifiable information. Do not enter names, record numbers, dates of birth, addresses, contact information, identifiable images, photographs, institutional identifiers, or unique details that could identify a patient. The service is not offered as a HIPAA-compliant patient-record system or business-associate service.

Retention

We retain account and practice data while the account is active and as reasonably needed to provide the service. Session credentials expire according to the configured session period. Dictation audio is processed for transcription and is not intentionally stored locally after the request; provider-side processing is governed by the provider's service terms.

When an account is deleted, we delete or de-identify associated practice, device, session, feedback, and account data that we are not required to retain. We may retain minimal billing, transaction, tax, fraud-prevention, security, backup, dispute, and legal records for the period reasonably necessary for those purposes. Backup copies age out through normal backup rotation and are not restored except for disaster recovery.

Security and Incident Response

We use safeguards appropriate to the service, including encrypted transport, password hashing, access controls, secure cookies, rate limits, device limits, network controls, backups, monitoring, audit records, and restricted administrative access. No system can guarantee absolute security.

If a security incident affects personal data, we will investigate and provide notices required by applicable law. Do not send passwords, private keys, payment credentials, or patient information in support messages.

Your Privacy Rights and Choices

Depending on your location, you may have rights to confirm processing; access or obtain a portable copy of personal data; correct inaccuracies; delete data; withdraw consent; and appeal a denied request. You also have the right not to receive discriminatory treatment for exercising applicable privacy rights.

We do not sell personal data or process it for targeted advertising or qualifying profiling, so there is no sale or targeted-advertising opt-out to exercise. You may avoid optional dictation, stop using the service, or delete the account in the app.

Submit a request or appeal by emailing [email protected] from the account email. Describe the request without including a password or patient information. We may verify identity before acting. We will respond within the period required by applicable law. If an appeal is denied, Texas residents may contact the Texas Attorney General; residents of other jurisdictions may contact their local privacy regulator.

Account Deletion and Subscriptions

Account deletion is available in the iPhone app. It removes Coach access and deletes or de-identifies associated data as described above. Deleting the account does not cancel an Apple or Stripe subscription. Cancel the subscription through Apple subscription settings or the Stripe-hosted billing portal before deleting the account.

International Processing

The service is operated from the United States. Personal data may be processed in the United States and other locations where service providers operate. Those locations may have different data-protection laws. Where required, we use legally recognized safeguards for cross-border processing.

Children

The service is intended for adults and is not directed to children under 13. We do not knowingly collect personal data from children under 13. Contact us to request deletion if you believe a child submitted personal data.

App Store Privacy Information

The iPhone app may collect contact information, user identifiers, purchase history, other user content, audio data when dictation is used, product interaction, and diagnostics for the purposes described above. These categories and the practices of integrated service providers must be reflected accurately in App Store Connect.

Changes

We may update this Notice as practices or legal requirements change. We will post a new effective date and, when required, provide additional notice or request renewed consent.

Contact

Email [email protected] for privacy requests, appeals, security concerns, or questions about this Notice.