Last updated: June 12, 2026

Privacy Policy

UroMind ("we," "our," or "the Service") is an adaptive AI-powered question bank built to help urology residents prepare for qualifying and certifying examinations in urology. We take your privacy seriously and have written this policy in plain language to explain what we collect, how we use it, and what choices you have.

Who we are

UroMind is operated by Dhruv Puri, MD, currently as a sole proprietorship pending formal incorporation, located in the United States. You can reach us at admin.uromind@gmail.com.

What we collect

Account information

When you create an account, we collect your name, email address, password (stored hashed — never in plain text), and optionally your residency program and PGY year.

Practice data

When you answer questions, we record which questions you've seen, how you answered, how long you took, your confidence rating, and any reports you submit on question quality.

Phone number — only if you opt in

If you choose to enable SMS-based daily questions, we ask for your phone number. We use it solely to deliver questions and replies via SMS. We do not share your phone number with any third party for marketing purposes, ever.

Usage data

We collect standard server logs (IP address, browser, request timestamps) for security and debugging.

How we use what we collect

• To run the Service — show you questions, track your progress, and adapt your review schedule using the SM-2 spaced-repetition algorithm.
• To deliver SMS questions, if you've opted in, via Vonage (our SMS provider).
• To improve the Service — aggregate, de-identified analytics on which questions are working and where residents struggle.
• To communicate with you about your account.

SMS-specific terms

If you enable SMS:

• We use double opt-in. After you provide your phone in the dashboard, you must reply YES to a confirmation SMS before you receive any further messages.
• Message frequency is approximately 1–10 messages per day during active practice.
• Reply STOP at any time to unsubscribe immediately. Reply HELP for assistance.
• Message and data rates from your carrier may apply.
• We retain SMS message history for two years for audit and compliance purposes (10DLC and TCPA requirements).
• We do not sell phone numbers and do not share them with any third party for promotional purposes.

Who we share data with

We share data only with the service providers required to operate the Service:

• Supabase — database and authentication provider; holds your account and practice data.
• Vonage — SMS provider; receives your phone number and message content for SMS delivery only.
• Anthropic — AI provider; processes anonymized question generation requests.
• Vercel — hosting provider; runs the application servers.

We do not sell your personal data, and we do not share data with advertisers. If we are legally required to share data (court order, subpoena, regulatory request), we will comply with the minimum necessary disclosure and will notify you when permitted to do so.

Data retention

• Account data: retained while your account is active.
• Practice data: retained while your account is active. You can request export or deletion at any time.
• SMS message logs: 2 years from message timestamp.
• Server logs: 90 days.
• Revoked SMS opt-ins: the audit record is retained indefinitely as required for TCPA compliance, but the phone number itself is purged after 30 days.

Your rights

You can at any time:

• Access your data by emailing us at admin.uromind@gmail.com.
• Correct or update your account information from the dashboard.
• Delete your account and associated practice data.
• Opt out of SMS by texting STOP to our SMS number, or by disabling SMS from the dashboard.
• Export your practice history as a JSON or CSV file.

If you are a California resident, the California Consumer Privacy Act (CCPA) gives you additional rights — please email us to exercise them.

Security

We protect your data with:

• Encryption at rest (database and backups).
• Encryption in transit (TLS 1.3).
• Row-level security policies on every database table containing user data.
• Hashed and salted password storage.
• Limited access — only the founder currently has production data access.

No system is perfectly secure. If we ever discover a breach affecting your data, we will notify you promptly and disclose what we know.

Children

UroMind is not directed at, and is not intended for, anyone under 18 years of age. We do not knowingly collect personal information from minors. If we learn we have collected data from someone under 18, we will delete it.

Changes to this policy

If we make material changes, we will notify you by email and update the effective date at the top of this page. Continued use of the Service after a material change constitutes acceptance.

Contact

Questions or concerns about this policy: admin.uromind@gmail.com.