1. Data Controller & Scope

DHAPrep.com ("DHAPrep", "we", "us") operates as the data controller for the personal data of medical candidates using our website and examination platform. We process personal data in strict compliance with the EU General Data Protection Regulation (GDPR) and UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection.

2. Categories of Personal Data Collected

Candidate Account Data: Full name, email address, and encrypted password hash (bcrypt).
Learning Analytics & Exam Performance: Practice questions completed, selected answers, timing per question, mock exam scores, and system-wise passing percentages.
Technical & Security Metadata: IP address, device type, browser user agent, and session timestamps collected to prevent unauthorized credential sharing.
Financial Data: Payments are handled directly by our authorized Merchant of Record and payment gateway. DHAPrep never accesses, collects, or stores your full credit card numbers or payment credentials.

3. AI Tutoring Features & Strict No-PHI Standard

When you interact with our educational AI tutor (DHAbot), queries are processed through encrypted enterprise APIs (Google Cloud Vertex / Gemini API) to provide clinical rationales.

Zero AI Training & Confidentiality Commitment

Candidate inputs are processed transiently in memory solely to generate explanations. User queries are never used to train foundational AI or machine learning models.

Candidates are strictly prohibited from entering patient names, identifiers, or Protected Health Information (PHI).

4. Legal Bases for Processing

We process your data based on:

Contract Performance (Art. 6(1)(b) GDPR): To grant platform access, generate your Prometric score projection, and maintain your question queue.
Legitimate Interests (Art. 6(1)(f) GDPR): To protect against cyber threats, prevent account sharing and bulk scraping, and optimize platform reliability.
Legal Compliance (Art. 6(1)(c) GDPR): For financial record-keeping and tax requirements handled via our payment processor.

5. Data Sharing & Third-Party Processors

We do not sell, rent, or monetize your personal data. Data is shared exclusively with vetted operational service providers under formal Data Processing Agreements:

Authorized Merchant of Record: Payment processing, fraud screening, and tax handling.
Neon / AWS Infrastructure: Secure cloud hosting with encrypted database backups.
Google Cloud Enterprise: Transient AI processing for educational clinical rationales.

6. Security & Encryption Standards

All data transmission between your browser and DHAPrep is secured via modern TLS encryption. Sensitive data is stored in isolated, access-controlled PostgreSQL environments with continuous security monitoring.

7. Data Retention & Your Rights

Your performance data is retained for the duration of your account. You have the right to request access to your data, rectify errors, or request complete account erasure at any time.

To request permanent erasure of your account and question analytics, email privacy@dhaprep.com or support@dhaprep.com.

Privacy Policy