Privacy Notice

Who is responsible for your information

Camus LLC operates MeridianBx at meridianbx.com and is responsible for the personal information described here. Contact us at contact@meridianbx.com or the mailing address below.

This notice covers MeridianBx. Other services have their own notices, even if they share an owner or technical infrastructure. A link to an official exam organization or another website does not give that organization access to your MeridianBx study records.

Information we collect and its sources

• Account information you provide: name, email address, password, profile updates, and support requests. We store a password hash rather than a readable password.
• Study information generated through your use: enrollment, question and test responses, attempts, flags, timing, scores, bookmarks, flashcard reviews and scheduling, progress, and study activity used to award points or select practice.
• Rewards information: point balances and transactions, redemptions, order status, and delivery details you enter, including recipient name, postal address, delivery email, and optional phone number. A redemption saves a copy of the delivery details with the order, so changing a saved address does not change an earlier order. Delivery details are optional for studying but are currently required to redeem a reward.
• Communications: contact-form name, email, topic, message, support correspondence, and email delivery records such as message identifiers and delivery status. Our email queue also stores the content needed to send account and support messages.
• Billing information: Stripe customer and subscription identifiers, plan, payment and subscription status, billing periods, usage allowances, and the time and terms of your recurring-payment consent. We receive subscription and payment updates from Stripe; payment-card details are entered directly on Stripe’s hosted pages.
• Technical and security information: session and password-reset records, request times, security events, and information sent by your browser, such as IP address and browser headers. We use hashed request identifiers for rate limiting and retain the document versions, time, and hashed request and browser evidence associated with legal acceptance. Our hosting providers may also process connection and diagnostic logs.

Information comes from you, your browser, your use of the Service, and providers supporting functions such as email or reward delivery. We may retain account and study records carried forward when an existing Camus-operated service is migrated to MeridianBx; those records remain subject to applicable notices and privacy rights. We do not request payment-card information for current free access.

How we use information

We use account and technical information to create and authenticate accounts, provide access, recover accounts, and prevent abuse. We use study activity to save your work, score practice, display progress, schedule flashcard reviews, and select practice questions. We use rewards and delivery records to calculate points, process redemptions, and resolve order questions.

We use messages and contact details to answer requests and send account, security, service, and legal notices. We may review activity and diagnostic records to troubleshoot problems, assess content quality, improve the Service, investigate misuse, and meet legal obligations. Optional marketing communications are subject to the choices below. Acknowledging this notice is not consent to unrelated marketing.

When information is disclosed

• Service providers and authorized personnel: hosting, database, email, technical support, and other providers receive information needed for their work. The Service uses Microsoft Azure hosting. When transactional email delivery is enabled, Brevo receives recipient details and message content, which may include a support message or account-recovery link. Authorized Camus personnel may access records to support users and administer the Service.
• Reward fulfillment: when an order is fulfilled, recipient, delivery, and relevant order information may be provided to the supplier, delivery service, or digital-reward provider needed to deliver it. These details are not public study-profile information.
• Payments: Stripe receives your account name, email address, a customer reference, chosen plan, and the payment and billing details you provide to process purchases, renewals, invoices, and cancellation. Stripe’s handling is described in its Privacy Policy.
• Legal and security needs: we may disclose relevant information to comply with legal process, protect rights and safety, investigate fraud or exam-security misuse, or establish, exercise, or defend legal claims.
• Business changes: relevant records may be disclosed during a merger, acquisition, reorganization, or transfer of the Service, subject to applicable law and confidentiality protections. A successor must handle information consistently with applicable privacy obligations.
• At your direction: we may disclose information when you ask us to or give separate permission, such as for a testimonial.

The current Service does not provide employer or school reporting. Merely studying for a job or using an employer email address does not give an employer access to your results. If sponsored reporting is introduced, we will explain what is shared and with whom before it applies.

Provider information is available in the Microsoft Privacy Statement and Brevo Privacy Policy. Independent sites you choose to visit are governed by their own notices.

Cookies, browser storage, and tracking

We use the necessary meridianbx_session cookie to keep you signed in. It expires after 30 days unless you sign out or it is revoked sooner. Blocking it prevents account features from working. Session expiry does not mean all associated database records are deleted.

Display preferences, including reduced motion and stronger contrast, are stored in this browser under meridianbx_device_preferences_v1. They remain until changed or cleared and are not synchronized as account preferences. You can remove cookies and local storage through your browser settings.

The current Service does not use advertising pixels or third-party advertising analytics to track you across websites. We do not sell personal information or share it for cross-context behavioral advertising, and do not use it for targeted advertising. This applies whether or not your browser sends a Global Privacy Control signal. The Service does not change its necessary account or security processing in response to the older Do Not Track signal. We will update this notice and provide any required choices before introducing materially different tracking.

Automated practice and sensitive information

Practice selection, scoring, review scheduling, progress calculations, and reward rules use your activity to operate study features. They do not determine official eligibility, certification, employment, or clinical decisions. The current learner features do not send your study responses or flashcards to an external generative-AI provider. If a future feature would do so, we will explain the provider and data use before you use it.

Do not submit patient or client details, protected health information, confidential exam questions, government identifiers, financial-account information, or another person’s private records in flashcards, support messages, or other free-text areas. Describe study or accessibility needs without including unnecessary health details. This is an exam-preparation service, not a clinical record system.

How long information is kept

Account and study records are generally kept while your account remains open so you can return to your work. Retention also depends on the record’s purpose, an outstanding support request or redemption, security and fraud-prevention needs, legal obligations, and the time needed to resolve a dispute. There is no single retention period for all records.

You may request deletion using the contact methods below. Some records may need to be retained after account closure, such as those needed to resolve an order, investigate abuse, or comply with law. Backups may retain copies until their normal replacement cycle. We will explain applicable exceptions when responding to a request. Expiring a session, signing out, or archiving study content is not an account-deletion request.

How we protect information

We use measures such as password hashing, hashed session and password-reset tokens in authentication records, access checks, and request limits. Password resets revoke existing sessions. These measures reduce risk, but no internet service or storage system is completely secure. Contact us promptly if you suspect account misuse, and never send your password to support.

Your choices and privacy requests

You can update your name in account settings. For an email correction, a copy of your personal information, account closure, or deletion, email contact@meridianbx.com with the subject “Privacy Request,” or use our account support form. A self-service deletion button is not currently available.

Tell us which account and request are involved. We may ask you to verify control of the account or provide information reasonably needed to protect your data; do not send passwords or identity documents with your initial request. An authorized agent may contact us, subject to verification of their authority and any identity checks permitted by law.

Depending on your location and whether the relevant law applies, you may have rights to access, correct, delete, or obtain a portable copy of information; object to or restrict processing; withdraw consent for consent-based processing; or opt out of certain uses. California rights may include knowing the categories and specific information collected, sources, purposes, and recipients, and limiting certain uses of sensitive information. We do not use sensitive information to infer personal characteristics.

We will respond within the period required by applicable law and explain any permitted extension or reason we cannot fulfill a request. You may appeal a refusal by replying with the subject “Privacy Appeal.” You may also complain to the privacy regulator with authority where you live. We will not unlawfully discriminate against you for exercising privacy rights. Deleting information needed for your account or a reward may prevent us from providing that feature.

If you receive optional marketing emails, follow their unsubscribe instructions or contact us. Account, security, support, and legal messages may still be needed. Browser display preferences do not control email subscriptions.

Age requirements

MeridianBx is intended for adults aged 18 and over, as stated in the Terms. It is not directed to children, and we do not knowingly collect personal information from children under 13. If you believe a child or an underage user has provided information, contact us so we can investigate, restrict access as appropriate, and delete information as required by law.

Processing locations

Camus LLC is based in the United States. Information may be processed in the United States and other countries where our providers operate, whose privacy laws may differ from those where you live. Where applicable law requires safeguards for an international transfer, those safeguards must be in place; using the Service does not waive your rights.

Where UK or European data-protection law applies, we process information as needed to provide the service you request, meet legal obligations, or pursue legitimate interests in security, support, and improvement, subject to your rights. When consent is required for a particular use, we will ask for it separately and you may withdraw it. Contact us for information about the safeguards applicable to your data.

Changes to this notice

We will post updates here with a new date and version. For material changes, we will provide additional notice, such as an account notice or email, and obtain consent where required before a new use applies. You can request an earlier version by contacting us. A policy update does not itself provide consent for a new use that requires your permission.

Contact us