ExamRounds Privacy Policy

Effective date: 22 August 2026

ExamRounds is an educational application designed to help medical trainees record and review their performance during clinical examination practice.

This Privacy Policy describes the personal information handled through ExamRounds, how that information is used, where it may be processed, the service providers involved, and the choices available to users.

This policy reflects the current configuration of ExamRounds and information provided to us by relevant service providers as at the effective date above.

Operator: AD PATEL

Privacy contact: ap@patel.co.nz

Location: Victoria, Australia

1. Information associated with an ExamRounds account

Depending on the features a user chooses to use, ExamRounds may handle the following information.

Account information

This may include:

• email address;
• name or display name;
• an internal user identifier;
• authentication identifiers;
• session information; and
• account-related timestamps, including account creation and password-change timestamps.

A name is optional. If no display name is supplied, the application may derive one from the user's email address.

Email and password accounts

Users who register using email and password provide a password for authentication.

ExamRounds does not store the plaintext password in its database. The current application stores a cryptographic hash of the password.

Social sign-in

If Google sign-in is enabled and used, ExamRounds may receive information through the sign-in process including:

• email address;
• name; and
• profile-picture URL.

Google sign-in is not currently displayed as an available sign-in option in the ExamRounds user interface, although related backend functionality exists.

If Sign in with Apple is available and used, ExamRounds may receive:

• an Apple account identifier;
• an email address, which may be an Apple private-relay address; and
• a name where Apple provides it.

Practice information

ExamRounds stores information entered or generated in connection with clinical examination practice, including, where applicable:

• short-case or long-case classification;
• specialty;
• subspecialty;
• custom specialty names;
• practice-case date;
• assessment scores;
• whether an assessment was submitted;
• assessment submission time;
• whether an assessment was recorded as general feedback only;
• an optional examiner or consultant name;
• mock examination dates;
• an actual examination date; and
• settings relating to examination preparation, reporting and sign-off thresholds.

Assessment scores are not required where the general-feedback-only option is used.

The marking form does not include any free-text feedback fields. Text inputs across ExamRounds are limited to names, specialty names and email addresses, each with strict character limits. It is prohibited and a violation of the Terms of Use to enter any identifiable patient information into any text input; any violation of these terms of service may be a breach of local law, ethics and professional responsibility. Culpability for such a violation of terms of service rests only with the user.

Information about a nominated DPE or other recipient

A user may optionally enter an email address for a Director of Physician Education (“DPE”) or other nominated recipient.

Where the relevant email-reporting feature is enabled and configured, that address may be used to send a progress report containing information about the trainee.

Depending on the report, this may include:

• the trainee's name;
• number of practice cases completed;
• average assessment scores;
• an identified weaker assessment domain; and
• information relating to the time remaining until a nominated mock examination.

The user who supplies another person's email address is responsible for ensuring that they have an appropriate basis for doing so.

Examiner or consultant name

A person completing a practice assessment may optionally enter their name.

The examiner or consultant name is stored with the relevant practice case.

2. Information ExamRounds is not designed to collect

The current ExamRounds application does not provide functionality for:

• uploading files;
• uploading photographs;
• storing patient notes; or
• recording a patient history.

The ExamRounds application database does not intentionally store advertising identifiers, device information, approximate location or IP addresses as fields in a user's account or practice-case record.

Standard technical information may nevertheless be processed in infrastructure or server logs in connection with operating the service.

3. Patient information

ExamRounds is designed to record information about a trainee's examination practice and performance. It is not designed to collect information about patients.

There are no dedicated fields for patient names, dates of birth, medical record numbers, patient photographs or patient clinical histories.

Users must not enter information that identifies, or could reasonably identify, a patient into ExamRounds.

Text inputs, including custom specialty names and the examiner-name field, must not be used to enter patient information. ExamRounds does not provide free-text feedback fields.

ExamRounds displays warnings instructing users not to enter patient information.

Because limited text inputs exist (names, specialty names and email addresses), ExamRounds cannot guarantee that it is technically impossible for a user to enter inappropriate information. It is prohibited and a violation of the Terms of Use to enter any identifiable patient information into any text input; any violation of these terms of service may be a breach of local law, ethics and professional responsibility. Culpability for such a violation of terms of service rests only with the user. Users remain responsible for complying with applicable confidentiality, privacy and professional obligations when entering information.

4. Technical information and logs

The current ExamRounds application audit did not identify third-party advertising, behavioural-analytics or crash-reporting SDKs such as Google Analytics or Sentry.

The ExamRounds database does not store users' IP addresses or device information as user-profile fields.

Standard infrastructure and web-server logs may nevertheless process technical information such as IP addresses, requests, timestamps and error information in connection with operating, securing and troubleshooting the service.

ExamRounds server error logs may also contain limited user information in some circumstances. For example, an email address may appear in an error log if an email-delivery operation fails.

We do not currently have a verified list of every category of platform-level operational information processed by Emergent and therefore do not make more specific representations in this policy.

5. Information stored locally on a user's device

The current application may store limited information locally on a user's device, including:

• an authentication token; and
• application preferences such as dark-mode selection.

6. How ExamRounds uses information

Information handled through ExamRounds is used to provide the application's current functions, including:

• creating and maintaining accounts;
• authenticating users;
• recording clinical examination practice;
• receiving practice assessments;
• displaying past practice cases;
• calculating and displaying practice-performance information;
• maintaining examination-related settings;
• generating progress reports where a user enables that feature;
• delivering emails to the user or a nominated recipient where applicable;
• providing account-management functionality;
• operating the service; and
• investigating technical or operational problems.

ExamRounds does not currently display third-party advertising or contain an advertising SDK.

The current ExamRounds application audit did not identify an integration that sends trainee assessment data to an artificial-intelligence service.

The application audit also did not identify a mechanism through which ExamRounds sells or rents user information or provides it to an advertising or data-broker service.

These statements describe ExamRounds itself as currently configured. Emergent and other service providers may independently process technical or service-related information in accordance with their own applicable terms and privacy policies.

7. Practice assessment links and QR codes

ExamRounds allows a trainee to provide a unique assessment link or QR code to a person completing a practice assessment.

The relevant assessment page is intentionally accessible without the examiner creating an ExamRounds account.

A person who possesses a valid assessment link may be able to view limited information about the case, including:

• case type;
• specialty; and
• date.

The public assessment page is not designed to display the trainee's account email address or name.

A person with the valid link may submit the assessment while the case is awaiting submission. The current application is designed to reject a further submission after the assessment has already been submitted.

Users should treat assessment links as private links and provide them only to the intended assessor.

8. Storage and account separation

ExamRounds is deployed using infrastructure provided through Emergent.

Emergent support has confirmed that production databases for deployed applications use a managed MongoDB Atlas environment, with a database cluster provisioned when the application is first deployed.

Emergent has not provided us with a verified per-component geographic breakdown identifying a separate physical location for the ExamRounds application server and database. ExamRounds therefore does not claim that any individual component is located in a particular city or data centre.

The ExamRounds preview/development environment and production deployment use separate application data environments.

Within ExamRounds, separation between one user's account information and another user's information is implemented by the application's own authentication and access-control logic.

The current application associates protected account and case information with an internal user identifier and scopes authenticated account, case, analytics and export requests to the authenticated user.

The intentionally public assessment-link workflow is an exception and is described separately in section 7.

9. Service providers

ExamRounds relies on third parties to provide parts of the service.

Emergent

Emergent provides application hosting, deployment, database provisioning and related operational infrastructure used by ExamRounds.

Information handled through ExamRounds may therefore pass through or be stored using infrastructure provided through Emergent.

Emergent has advised that, for the Standard paid account currently used to operate ExamRounds, its Terms of Service and Privacy Policy are the governing standard agreements.

Emergent has also advised that a Data Processing Agreement is available as part of Enterprise custom legal terms. Accordingly, this Privacy Policy does not rely on Emergent's separately published Data Processing Agreement as a contractual commitment applying to the current ExamRounds Standard-plan deployment.

MongoDB Atlas

Emergent support has confirmed that the production database for deployed applications runs using a managed MongoDB Atlas environment provisioned when the application is first deployed.

MongoDB Atlas therefore processes information stored in the production ExamRounds database as part of this hosting arrangement.

Resend

ExamRounds contains functionality capable of sending email reports.

Where this email functionality is enabled and configured by the ExamRounds operator, email delivery may use Resend.

Emergent support has confirmed that Resend is not an email service operated by Emergent on behalf of ExamRounds. Instead, the application operator configures a Resend account and associated API credentials for the application.

Where an email is sent through Resend, information sent to Resend may include:

• the recipient's email address; and
• the content required to deliver the email.

For a trainee or DPE progress report, that content may include information such as the trainee's name, case counts, average scores, an identified weaker assessment domain and examination-related timing information.

If Resend is not configured or used by ExamRounds, no ExamRounds email is sent through Resend.

Cloudflare and custom domains

Emergent support has advised that when a custom domain is connected to an Emergent application, traffic for that custom domain is routed through Cloudflare.

Accordingly, if ExamRounds is configured to use a custom domain, Cloudflare may process standard network and request information associated with traffic to that domain, including IP addresses and request metadata.

Emergent has not confirmed which edge provider serves the default emergent.host application URL. This Privacy Policy therefore does not state that Cloudflare processes ExamRounds traffic where ExamRounds is accessed only through the default Emergent-hosted URL.

Google

If Google sign-in is enabled and a user chooses to use it, Google handles the Google authentication process and ExamRounds may receive the account information described in section 1.

Google's own handling of information is governed by Google's privacy practices.

Apple

If Sign in with Apple is used, Apple handles the Apple authentication process and ExamRounds receives the permitted identity information described in section 1.

Apple's own handling of information is governed by Apple's privacy practices.

10. Advertising, tracking and AI

Based on the current ExamRounds application audit:

• ExamRounds does not display third-party advertising;
• no advertising SDK was identified;
• no advertising identifier is requested by ExamRounds;
• no behavioural-analytics SDK was identified;
• no third-party crash-reporting SDK was identified; and
• no AI service was identified as receiving trainee assessment data from ExamRounds.

The audit did not identify a mechanism through which ExamRounds sells or rents user information or provides it to an advertising or data-broker service.

These statements relate to the current ExamRounds application. They do not make representations about independent uses of platform-level service information by Emergent or other providers under their own terms and privacy policies.

If ExamRounds' own practices change, this Privacy Policy will need to be updated accordingly.

11. Overseas processing

ExamRounds is operated from Victoria, Australia but uses infrastructure located outside Australia.

Emergent support has advised that data processed and stored through Emergent is handled in:

• the United States; and
• India.

Emergent has not provided a verified per-component breakdown identifying which particular ExamRounds server, database node or backup is located in which country.

Accordingly, this Privacy Policy does not make a more specific geographic claim about individual ExamRounds infrastructure components.

Where ExamRounds uses third-party authentication or email providers, those providers process information according to their own infrastructure and privacy arrangements.

Emergent support has advised that Resend is US-based.

Emergent has also advised that it does not currently publish a formal subprocessor register with a per-country breakdown. We therefore do not claim to know or list every jurisdiction in which every underlying Emergent service provider may process information.

12. Account access and separation

The current ExamRounds application audit found that authenticated case, profile, analytics and export functions require authentication and are scoped to the authenticated user's internal user identifier.

The audit did not identify an authenticated endpoint intended to permit one ordinary user to retrieve another user's account or assessment history.

This statement does not apply to the deliberately public assessment-link workflow described in section 7, where a person possessing a valid case link may access the assessment page for that individual pending case.

13. Password and session security

For email-and-password accounts, the current backend stores a cryptographic password hash rather than the plaintext password.

Authentication sessions and tokens are used to identify signed-in users.

The application also stores separate session records for supported social sign-in flows.

These controls are intended to reduce certain security risks but cannot guarantee that an internet-connected service will never experience unauthorised access or a security incident.

14. Account deletion

ExamRounds provides an in-app account-deletion function.

The current account-deletion process has been tested to confirm that deleting an ExamRounds user account removes from the live ExamRounds application:

• that user's account record;
• that user's practice cases and assessment data; and
• that user's active social sign-in session records.

The deletion test also confirmed that a separate test user's account, cases and session records were not removed by that process.

This section refers to deletion from the live ExamRounds application. Existing backup copies are treated separately below.

15. Backups after account deletion

Emergent support has advised that managed database backups currently use the following retention schedule:

• hourly snapshots retained for 7 days;
• daily snapshots retained for 7 days;
• weekly snapshots retained for 4 weeks;
• monthly snapshots retained for 12 months;
• yearly snapshots retained for 1 year; and
• a continuous point-in-time recovery window of 7 days.

Emergent support has advised that when a record is removed from the live database, it is no longer part of the active dataset, but a copy captured in an existing backup remains until that backup reaches the end of its applicable retention period.

Based on the retention schedule provided by Emergent support, a copy of deleted information may therefore remain in a pre-existing backup for up to approximately 12 months.

These backups are managed at the hosting-platform level. ExamRounds does not independently control when an existing Emergent-managed backup expires.

Emergent support separately advised that deletion of an Emergent platform account is subject to a 45-day grace period before personal data associated with that Emergent account is permanently erased.

That 45-day Emergent-account process is separate from an individual ExamRounds user's use of the in-app ExamRounds account-deletion function described in section 14.

16. Other retention

The current ExamRounds application does not contain a separate automatic rule that routinely deletes active user accounts or assessment records after a fixed period while the account remains active.

Infrastructure and error logs may be retained according to the operational policies of the provider responsible for those logs.

We do not currently have a verified retention period for every category of infrastructure or error log and therefore do not state a specific retention period for those logs.

17. Information about other people

ExamRounds may hold limited information about people who are not the account holder.

This can include:

• an optional examiner or consultant name; and
• an optional DPE or nominated-recipient email address.

An examiner may provide their own name through the assessment page.

A trainee may provide a DPE or recipient email address through ExamRounds.

Users should only provide another person's personal information where they have an appropriate reason to do so and must not use these fields to record patient information.

18. Access and correction

Users can access a range of information associated with their account through ExamRounds.

A user who wants to ask about access to, or correction of, personal information that cannot be managed through the application may contact:

[YOUR SUPPORT EMAIL]

We may request information reasonably necessary to confirm the identity of the person making the request before providing or changing account information.

19. Privacy questions and complaints

Questions or complaints concerning the handling of personal information through ExamRounds may be sent to:

ExamRounds

Operator: AD PATEL

Email: Ap@Patel.co.nz

Location: Victoria, Australia

We will review the issue and respond within a reasonable period having regard to the nature of the request.

Where applicable Australian privacy law gives an individual a right to complain to a regulator, a person who remains dissatisfied after contacting us may also contact the Office of the Australian Information Commissioner.

20. Security incidents

If we become aware of a security incident involving personal information, we will assess the circumstances and take steps appropriate to the incident.

Where applicable law requires notification to affected individuals or a regulator, we will comply with those requirements.

21. Information handled by app stores

If ExamRounds is distributed through an app marketplace such as Apple's App Store or Google Play, the marketplace provider may independently process information relating to its own services, such as a user's marketplace account, application download or device.

Those activities are governed by the relevant marketplace provider's own terms and privacy practices.

22. Emergent contractual position and provider limitations

Emergent has advised us that, for the Standard paid account currently used for ExamRounds, the governing standard agreements are Emergent's Terms of Service and Privacy Policy.

Emergent has advised that a Data Processing Agreement is offered as part of Enterprise custom legal terms.

Emergent support has not yet confirmed that the separately published Emergent DPA forms part of the contract applicable to the current ExamRounds Standard account. Accordingly:

• ExamRounds does not represent that the Emergent DPA applies contractually to the current deployment;
• this Privacy Policy does not rely on DPA-specific processing restrictions or subprocessor commitments as guarantees applying to ExamRounds; and
• ExamRounds does not make claims about contractual subprocessor obligations, secondary-use restrictions or other DPA-specific protections that Emergent has not confirmed apply to the current plan.

Emergent has also advised that it does not currently publish a formal subprocessor register.

Statements in this Privacy Policy concerning Emergent infrastructure are therefore limited to information that has been specifically confirmed by Emergent support, is stated in the governing provider materials, or has been observed in the current ExamRounds application configuration.

23. Changes to this Privacy Policy

This Privacy Policy describes ExamRounds and its known service arrangements as at the effective date.

The application, its service providers, infrastructure arrangements and provider policies may change.

If a change materially alters the types of personal information handled, the purposes for which it is used or the services to which it is disclosed, this Privacy Policy will be updated to reflect that change.

The current version and effective date will remain available through ExamRounds.

24. Contact

For questions about this Privacy Policy or ExamRounds' handling of personal information, contact:

ExamRounds

Operator: AD PATEL

Email: Ap@patel.co.nz

Location: Victoria, Australia