Privacy notice
How EasyNeurology collects, uses, keeps and protects your personal data, and your rights.
Before the apps open
The EasyNeurology apps are not available yet. Three details depend on choices made before they open: where our database is hosted, the service that sends sign-in codes and the crash-reporting service. They are marked below, and we will name them here, with a new date, before the apps open.
Who is responsible for your data
EasyNeurology is provided by Dr Omar Aldhafeeri, a neurologist in Riyadh, Kingdom of Saudi Arabia. He decides how and why your personal data is used: under Saudi Arabia’s Personal Data Protection Law (PDPL) he is the controller. In this notice, ‘we’ means EasyNeurology.
For anything about this notice or your data, write to support@easyneurology.com.
In short
- We hold your email address, your learning records, a few settings and some technical data, all listed below, and nothing else.
- We never ask for patient data or for health data about you. Never enter patient details anywhere in EasyNeurology.
- We do not sell your data or show advertising, and nothing in EasyNeurology follows you across other websites or apps. The apps use no third-party analytics; this website counts visits with Cloudflare Web Analytics, which sets no cookies.
- You can download your data, correct it and delete your account at any time.
- EasyNeurology is for adults aged 18 and over.
What we collect and where it comes from
- Your email address
- From you, when you sign in. We send you a one-time code to it; learners have no password.
- Your nickname
- From you, only if you join the weekly league.
- Your time zone
- From your device, so that your daily questions follow your local day.
- Your reminder settings
- From you: whether reminders are on, their time and the device that shows them. The reminders themselves are scheduled on your device.
- Your learning records
- From your use of the app: your answers and confidence ratings, review schedules, progress and mastery, saved questions and lessons, and the reports you send about questions, including any text you write in them.
- Your subscription status
- From Apple or Google, through RevenueCat: whether you have Pro, and until when. Apple or Google take the payment; your card details never reach us.
- Session details
- From your device, for each device you sign in on: the platform, the app version and when it was last used.
- Usage events
- From your use of the app, such as finishing a set, recorded in our own database against an account ID rather than your email address.
- Crash reports
- From the app when it fails: technical details of the fault, without your email address, nickname or answers.
- Messages to support
- From you: what you write to us and the address you write from.
- Website visits
- From your browser, when you open a page of this website, through Cloudflare Web Analytics: the page, the site that linked to it, how quickly it loaded, and your browser, operating system, type of device and country. We see only totals (This website).
The app keeps your sign-in on your device, in its secure storage on iPhone and Android and in the browser on the web, so that you stay signed in.
Why we use it, and on what basis
- To provide EasyNeurology to you
- Your account and sign-in, your questions, reviews and progress, your saved items, your data export, support, and your subscription status. Basis: our agreement with you, the terms of use.
- To show you on the league board
- Your nickname and your points for the week, shown to other learners. Basis: your consent, given when you join. Leaving the league withdraws it.
- To keep reminders
- Basis: your choice when you turn them on. Turning them off withdraws it.
- To keep EasyNeurology secure and working
- Limiting each account to two active sessions, limiting how fast requests can be made, detecting misuse, and finding and fixing faults. Basis: our legitimate interest in a secure, working service, which we balance against your rights; it never involves sensitive data.
- To improve our questions
- Statistics combined across learners, such as how many answer a question correctly, which do not identify anyone. Basis: our legitimate interest in accurate teaching.
- To understand how this website is used
- Totals of visits to this website, such as how many people opened a page and from which country or site they came, so that we can improve it. Basis: our legitimate interest in knowing whether the website reaches the people it is for, which we balance against your rights; the totals identify no one.
- To meet legal obligations
- Such as keeping a record of a data breach or answering a lawful request from an authority. Basis: the law.
We do not use your data for marketing, profiling or automated decisions about you. If we ever want to use it for a new purpose, we will tell you first and, where the law requires, ask for your consent.
Who else sees it
Other learners see your nickname and weekly points only if you join the league. Apart from that, only service providers that work for us handle your data, each for its task alone and under our instructions:
- Supabase
- Hosts our database, our server functions and sign-in. The region of the database is named here before the apps open.
- Apple and Google
- Run the App Store and Google Play, take payment for Pro, and deliver the apps.
- RevenueCat
- Tells us whether your Pro subscription is active.
- Cloudflare
- Delivers this website and the web app, and counts visits to this website.
- An email service for sign-in codes
- Sends the codes to your email address. Named here before the apps open.
- A crash-reporting service
- Receives crash reports. Named here before the apps open.
- Backup storage
- Keeps our encrypted weekly backups, under our control.
We disclose personal data to anyone else only when the law requires it, for example to a court or a competent authority.
Processing outside Saudi Arabia
Our service providers operate outside the Kingdom, so your personal data is processed outside it. We transfer it only as the PDPL and its Regulation on Personal Data Transfer outside the Kingdom allow, limit it to what each provider needs for its task, and require each provider to protect it.
How long we keep it
- We keep your account data while your account is active.
- When you delete your account, your personal data is removed within 30 days. Copies in our backups then expire: within 7 days from the daily backups and within 90 days from the weekly backup exports.
- A sign-in code works once and expires within an hour.
- Statistics about questions are combined across learners and anonymous, so we keep them.
- Cloudflare keeps detailed reports of website visits for 7 days and then only a sample, and shows us totals for the past six months.
- Apple and Google keep their own records of your purchases, under their own policies.
Your rights
Under the PDPL you have the right to:
- be informed of how your data is used, which this notice does;
- see your data and get a copy: in the app, Profile → Account → Export my data gives you your records as a file;
- have it corrected: you can change your nickname in the app, and we correct anything else you ask us to;
- have it deleted: delete your account in the app, or as described on Delete your account;
- withdraw your consent at any time, by leaving the league or turning reminders off. This does not affect what was done before.
For a request we cannot meet in the app, write to support@easyneurology.com from the email address you sign in with, so that we know it is you. We answer within 30 days.
If you are not satisfied with our answer, you can complain to the Saudi Data and AI Authority (SDAIA), which oversees the PDPL.
How we protect it
- All connections are encrypted.
- Questions, answers and learning records are kept where only our own server functions can reach them, and each learner reaches only their own data.
- Staff access requires two-step sign-in, and our logs record account IDs rather than email addresses.
- Backups are encrypted.
If something goes wrong
If a breach affects your personal data, we act at once to contain it, notify SDAIA within 72 hours where the PDPL requires it, tell you without undue delay if it may harm you, and keep a record of what happened.
This website
This website sets no cookies and shows no advertising. To count visits, Cloudflare, which delivers the site, adds its Web Analytics script to each page. The script reports which page you opened, the site that linked to it and how quickly the page loaded, and Cloudflare notes your browser, operating system, type of device and country from your browser’s request. Web Analytics uses no cookies or local storage, does not identify you or follow you across other websites, and ignores anything after a question mark in the address. We see only totals. If your browser blocks the script, the website works the same.
Cloudflare also receives technical details such as your IP address in order to deliver and protect the site.
Adults only
EasyNeurology is for adults aged 18 and over. If we learn that an account belongs to someone younger, we delete it.
Changes to this notice
We publish every change here with a new date. Before a significant change takes effect, we tell you in the app.