OTbuddy Privacy Notice

Effective: October 2, 2026

1. Scope and information OTbuddy processes

This Notice describes how Marshall McKinley Works LLC processes information through the OTbuddy website and iPhone app. Depending on your use, this may include name, email, birth year, gender, state of residence, professional role or study pathway, protected account credentials, consent and email preferences, study progress and practice answers, exam attempts, saved tools and research projects, AI prompts and responses, submitted study files or text, support messages, purchase and access status, and technical, security, or diagnostic records. Birth year, gender, and state are not used to determine pricing or certification outcomes; the Service requires users to attest that they are 18 or older.

2. Payment and purchase information

Website — Stripe: Stripe processes website payments. OTbuddy receives customer, checkout, payment and subscription identifiers, product or plan, billing interval, payment and renewal status, and related billing events needed to provide access and support purchases.

iPhone — Apple: Apple processes in-app payments through your Apple Account. OTbuddy verifies signed purchase records and stores transaction and original-transaction identifiers, product identifiers, purchase and expiration dates, renewal or revocation status, and an account-association token linking purchases to your OTbuddy account. This supports subscriptions, passes, exam credits, purchase restoration, and fraud prevention. OTbuddy does not receive your Apple Account password and does not intentionally store complete payment-card numbers or card security codes.

The original purchase provider remains responsible for its billing services even if you use OTbuddy on another platform. See Stripe’s Privacy Policy and Apple’s Privacy Policy for their practices.

3. AI, research, and file processing

When you request AI features, relevant prompts, reviewed study text, study context or metrics, and eligible article abstracts may be sent through OTbuddy to OpenAI to produce the response. In the iPhone app, you can disable AI permission in Account. Do not submit PHI, confidential client information, patient identifiers, or unnecessary sensitive information.

Research searches send search terms and article identifiers to the research databases and source services used to locate publications and verify available content. Opening a publisher or other external link takes you to that provider, whose privacy practices apply.

In the iPhone app, camera and selected-photo text recognition run on the device. Importing an Office file for extraction sends the selected file to OTbuddy after confirmation. If you then request AI processing, the reviewed text and needed context are sent to the AI provider. Saved study content and research items are associated with your account for synchronization.

4. How information is used

Information is used to authenticate users; provide and personalize study features; save progress; generate requested AI output; administer subscriptions; support account administration; understand aggregate product usage and user demographics; prevent fraud and abuse; maintain security and reliability; troubleshoot errors; communicate material service or account information; and comply with applicable law. OTbuddy does not send your last name, birth year, gender, or state of residence to the AI service solely because those fields are stored in your profile. AI requests contain only the study content and limited study context needed for the requested feature.

5. Service providers and disclosures

OTbuddy uses Netlify for hosting and backend infrastructure, Stripe for website payments, Apple for in-app purchases, OpenAI for AI functionality, and Resend for email delivery. Research database and publication services receive requests needed for research discovery. Providers process relevant information needed for their functions under their applicable agreements and privacy practices. We may also disclose information where required by law or reasonably necessary to protect users, security, legal rights, or respond to a valid legal request.

6. Cookies, device storage, and reminders

The website uses cookies and browser storage for authentication, security, preferences, continuity, and study functionality. The iPhone app stores its sign-in credential in iOS Keychain and caches study tools, queued changes, and unfinished sessions on the device with file protection. Signing out or confirming account deletion in the app clears that local account copy. Device reminders are scheduled locally on the iPhone and can be disabled in device settings. Information you export or save outside OTbuddy remains under your control and is not removed by deleting your OTbuddy account.

7. Data retention

OTbuddy retains account, study, subscription, security, and transaction-related information for as long as reasonably necessary to provide the Service, maintain legitimate business and security records, resolve disputes, and meet legal obligations. Retention periods may differ by data type and provider.

8. Data choices, email preferences, and account deletion

You may update profile information, stop submitting optional content, stop using AI features, and change marketing email preferences in your account. Promotional emails are optional; essential account, security, and purchase messages may still be sent.

Delete your account through Profile & settings → Security on the website or Account → Permanently delete account in the iPhone app. Confirmed deletion removes your account and app-owned study data from the active service and cannot be undone. External provider records and backups follow their separate retention policies. Limited records may be retained where permitted or required for transaction, legal, security, fraud-prevention, or dispute purposes.

Deleting your account or uninstalling the app does not cancel or refund a subscription. Manage website renewals through the Stripe Customer Portal and Apple renewals through iPhone Settings → your name → Subscriptions. You can request account deletion without first canceling a subscription. Contact OTbuddy Support for privacy questions or access, correction, or deletion requests; we may verify your identity before acting. Rights and available remedies vary by applicable law.

9. Security and PHI-prohibited design

OTbuddy uses technical and organizational safeguards intended to reduce unnecessary collection and transmission of sensitive information, including privacy screening in AI and support inputs and data-minimization controls. Privacy-block events may record the event type and detected category without retaining the blocked message. These measures do not make OTbuddy a HIPAA-compliant clinical system. OTbuddy is not intended to receive or store PHI. No automated detector can identify every possible piece of sensitive information, and no online system can guarantee absolute security. Keep your password confidential and notify OTbuddy through the available support channel if you believe your account has been compromised.

10. Age eligibility

OTbuddy is intended only for adults age 18 or older. OTbuddy does not knowingly permit accounts for people under 18. If OTbuddy learns that an account holder is under 18, access may be suspended or deleted as appropriate.

11. Changes and contact

This Notice may change as features, providers, or legal obligations change. Material changes will be communicated through the Service or another reasonable mechanism when required. For privacy questions, contact Marshall McKinley Works LLC through OTbuddy Support, or use the home-page inquiry form if you cannot sign in. Do not send passwords, payment-card information, or patient information.