Awaiting the owner's review. This policy describes how the site works as it is built today. Details that depend on the owner's business and legal decisions, such as who the controller is, how long some records are kept and which providers are used, are marked [Owner to confirm] and are not yet final.
1. Who we are
Dextrology (dextrology.com) is an educational website for clinicians in training. The controller responsible for your personal data is [Owner to confirm: the legal name and postal address of the person or organisation that runs Dextrology].
For anything in this policy, write to [email protected] or use the contact form with the topic "Privacy and my data". [Owner to confirm: a data protection officer or local representative, if the law that applies requires one]
2. In short
- You can use most of the site without an account. Your progress is then kept only in your own browser.
- An account needs only an email address. We sign you in with a one-time link; there is no password.
- We do not sell personal data and we show no advertising.
- Google Analytics runs only if analytics is configured and you choose "Accept analytics". You can change your mind at any time in .
- When you are signed in you can download everything stored for your account, or delete it, from this page.
3. What we collect and why
Visiting the site
- Server logs. For each request our server records the time, the address requested, the response status, how long it took, and your IP address. We use them to keep the site running and secure, and to investigate abuse.
- An anonymous browser id. Your browser creates a random id (stored as
dextrology.cid) and sends it with requests to the site's own API. It lets features that work without an account recognise the same browser, and lets us limit abuse. It contains nothing about you. - Your progress, in your browser. Which walkthroughs and chapters you have watched, course steps you have completed, practice you have logged and courses you have saved are kept in your browser's storage (
dextrology.v1). While you are signed out they never leave your device. - Your preferences. Light or dark theme (
dextrology.theme) and your analytics choice (dextrology.consent), also in your browser.
Your account
- Email address, to send you sign-in links and the emails you ask for, and an optional name if you add one.
- Sign-in records: when you ask for a sign-in link we store a scrambled (hashed) copy of the link's token, your email address, the page to return to, the time and your IP address. The link works once, for 20 minutes.
- Sessions: a cookie (
dx_session) keeps you signed in. We store only a hashed copy of it, with when it was created and expires and your browser's user-agent string, so you can recognise and end sessions. We also note when you were last active. - Synced progress: when you are signed in, the progress described above is copied to your account so it follows you between devices.
Courses, bookings, reminders and messages
- Course registrations. When you register for a course we store the details the registration form asks for (shown on the form itself), the course and the time, and we email you about it. A registration is a request until we confirm your place by email.
- Practice bench bookings. When you book a practice session we store the details the booking form asks for, the slot you chose, and the emails about it.
- Interest lists, "notify me" and live-session reminders. We store your email address, what you asked to hear about and your language. We first email you to confirm the request (double opt-in) and add you only once you confirm. Every reminder email has an unsubscribe link.
- Contact messages and corrections. When you use the contact form we store your name, email address, topic, the page you were reporting (if any), your language, your message and a keyed hash of your IP address (used to spot repeated abuse; the address itself is not kept). Our team receives a copy by email so they can reply, and you receive an acknowledgement with a reference number. We also record the message's status and any internal notes.
Emails we send
We keep a copy of every email the site sends (recipient, subject, content, the time and whether it was delivered) so that a message that failed can be sent again and we can answer questions about it. When an email delivery provider is configured, messages are handed to it for delivery: [Owner to confirm: the email delivery provider]. When none is configured, messages are only recorded and not sent.
Analytics, only with your consent
If Google Analytics 4 is configured for the site, a banner asks whether you accept analytics. Nothing from Google Analytics loads until you choose "Accept analytics". If you accept, Google Analytics measures how pages are used (pages viewed, approximate location, device and browser) with IP anonymisation requested and Google signals and ad personalisation turned off. If you later reject, we stop it, ask the analytics library to opt out and delete its cookies from this site.
Content from other providers
- Fonts. Pages load their typefaces from Google Fonts, so your browser sends your IP address and browser details to Google when a page loads.
- Videos. Some walkthrough pages embed videos from YouTube in its privacy-enhanced mode (youtube-nocookie.com). When the player loads, YouTube (Google) receives your IP address and browser details, and it may store information in your browser once you play a video.
- Page performance. When enabled, article pages measure how quickly they loaded and how stable they were, and send those numbers with the page address to our SEO service, without any identifier.
Administration
Our administrators' actions are recorded in an audit log (who did what, and when). When an administrator deletes an account at someone's request, the log keeps a note of that deletion, including the email address.
4. Legal bases
Where data protection law asks for a legal basis, we rely on:
- Contract (providing what you asked for): your account, synced progress, course registrations, bookings and the emails about them.
- Consent: analytics, and interest lists and reminders. You can withdraw consent at any time, without affecting what happened before.
- Legitimate interests: keeping the site secure and working (server logs, the anonymous browser id, rate limits, the audit log), answering messages and correcting content.
- Legal obligation: keeping records the law requires us to keep.
[Owner to confirm: the data protection laws that apply to Dextrology and its visitors]
5. How long we keep it
| Data | Kept for |
|---|---|
| Sign-in link records (including IP address) | Deleted about a day after the link expires. |
| Sessions | Until you sign out, or 30 days after your last visit. |
| Your account, name and synced progress | Until you delete your account. |
| Course registrations and bookings | [Owner to confirm]. If you delete your account, these records are kept without the link to your account, because we need them to run the course and for our own records. |
| Interest lists and reminders | Until you unsubscribe or the item you asked about has passed. [Owner to confirm] |
| Contact messages | [Owner to confirm] |
| Copies of emails sent | [Owner to confirm] |
| Server logs | [Owner to confirm: the hosting platform's log retention] |
| Database backups | One a day; the newest seven are kept, so deleted data leaves the backups within about a week. |
| Google Analytics (if you accepted) | [Owner to confirm: the data retention setting in Google Analytics] |
| Your browser's storage | Until you clear it, or use the controls on this page. |
6. Who receives it
We do not sell or rent personal data. It is shared only with:
- Our hosting provider, which runs the server and stores the database and its backups: [Owner to confirm: the hosting provider and the server's location].
- Our email delivery provider, when one is configured (see above).
- Google, for Google Analytics (only if you accept), Google Fonts and YouTube embeds, as described above.
- Course organisers and faculty, for the courses you register for: [Owner to confirm: whether registration details are shared with the course's faculty or venue, and which details].
- Authorities, when the law requires it.
7. International transfers
Google operates worldwide, so information it receives may be processed outside your country. [Owner to confirm: where our server and email provider process data, and the safeguards used for transfers]
8. Your rights
Depending on where you live, you may have the right to access your data, receive a copy of it, correct it, delete it, restrict or object to how we use it, and withdraw consent. You can also complain to your data protection authority.
- Download your data: while signed in, use "Download my data" below. You receive a file with your account and everything each feature stores for it.
- Delete your account: while signed in, use "Delete my account" below. Your account, sessions, synced progress and other data linked to it are deleted at once (backups follow within about a week). Course registrations and bookings are kept without the link to your account (see above).
- Contact messages are kept by email address, not by account. To have them deleted, or for anything else, contact us.
- Reminders: use the unsubscribe link in any reminder email.
- Analytics: change your choice in .
We answer requests within [Owner to confirm: response time]. We may ask you to confirm the request from the email address concerned.
Your data
Checking whether you are signed in…
Sign in to download or delete the data stored for your account.
Signed in as .
9. Cookies and browser storage
We use one cookie of our own, only for signing in, and a few items in your browser's storage. None of them is used for advertising.
| Name | Kind | Purpose | Lasts |
|---|---|---|---|
dx_session | Cookie (ours, HTTP-only) | Keeps you signed in. Set only when you sign in. Strictly necessary. | 30 days, renewed while you use the site; removed when you sign out |
dextrology.v1 | Local storage | Your learning progress and saved courses. | Until you clear it |
dextrology.theme | Local storage | Your light or dark theme choice. | Until you clear it |
dextrology.cid | Local storage | The anonymous browser id described above. | Until you clear it |
dextrology.consent | Local storage | Your analytics choice, so we do not ask again. | Until you clear it |
dextrology.me, dextrology.livenow | Session storage | A one-minute cache of who is signed in and whether a live session is on air, to save requests. | Until you close the tab |
_ga, _ga_<id> | Cookies (Google Analytics) | Distinguish visitors for analytics. Set only after you choose "Accept analytics"; deleted if you later reject. | Up to 2 years (Google's default) |
| YouTube | Cookies or storage (YouTube) | Set by YouTube's player, in privacy-enhanced mode only once you play a video. | Set by YouTube |
10. Security
The site is served over HTTPS. Sign-in tokens and session ids are stored only as hashes, so a copy of the database cannot be used to sign in. The session cookie cannot be read by scripts. Access to the admin is limited to named administrators, and their actions are logged. No system is perfectly secure; if you believe you have found a security problem, please tell us.
11. Children
Dextrology is made for medical students and clinicians and is not directed at children. [Owner to confirm: the minimum age for creating an account]
12. Changes to this policy
When we change this policy we update the date at the top. If a change affects how we use data you have already given us, we will say so on the site before it takes effect.
13. Contact
Email [email protected] or use the contact form. See also our terms of use and the medical disclaimer.