Privacy policy
Effective date: [date]
1. The short version
- You tell us about your medical training and application history. We use it to score your competitiveness for the US residency match and advise you. Nothing else.
- Competitive Edge is independent. We are not part of any residency programme, the NRMP, or ECFMG, and we have no way to affect your application. Your profile stays private. We never sell it, and we never share it with programmes, the NRMP, ECFMG, or anyone outside the named service providers we list below.
- Your answers are analysed by an AI model. The AI provider does not use your data to train its models.
- You can see, correct, export, and delete your data. If you used Competitive Edge before signing in, sign in from the same browser to claim that data first.
- Questions: [privacy contact email].
2. Who we are and how to reach us
Competitive Edge is operated by [legal entity name], [registered address]. For anything in this policy, contact [privacy contact email]. We answer within the time the law allows, and usually faster.
3. What we collect and why
Everything below comes directly from you: the intake questions, a CV you choose to upload, your Google sign-in, or a payment. We do not buy data about you or collect it from third parties.
| What | It includes | Why we collect it |
|---|---|---|
| Identity and contact | Your name; the name and email address on your Google account when you sign in | To address you, run your account, and reach you about the service |
| Education and training history | Where and when you qualified, degrees, home-country residency training, years of independent practice, and your US clinical experience | Scoring and analysis |
| Examination and certification record | Your USMLE results and attempts and your ECFMG certification status | Scoring and analysis |
| Research and publication record | Counts of your research experiences and publications | Scoring |
| Professional experience and activities | Work, volunteering, teaching, leadership, languages, and professional connections | Scoring and analysis |
| Application plans | Specialties of interest, target Match year, and how many programmes you plan to apply to | Scoring and tailoring your report |
| Immigration and visa status | Whether you need visa sponsorship, and the visa type | Scoring: visa need affects the competitiveness read. Called out here because we know it is sensitive for you; see section 4 |
| Letters and record flags | Whether you hold certain kinds of recommendation letters, and whether your record carries flags such as training gaps | Scoring and analysis |
| Answers in your own words | Anything you type into an open answer box, such as the story behind a gap | Context for your analysis. The most sensitive thing we hold; see section 4 |
| Voice dictation audio | If you use the microphone button, your browser's speech service turns your voice into text. In most browsers the audio goes to the browser maker (Google or Apple), not to us; we only ever receive the text | Convenience: dictating instead of typing |
| Uploaded documents | A CV you upload to pre-fill your profile. We do not keep the file: it is processed once and discarded, and only the fields you review and confirm are stored | Pre-filling your profile |
| Account, device, and technical data | A session cookie, sign-in cookies, and hosting logs that include your IP address | Keeping you signed in, security, and debugging |
| Payment information | A payment reference, amount, currency, and status. Your card number never reaches us; Stripe holds it | Billing |
We do not ask for, and do not want, your health records, patient data, or anyone else’s information.
4. Sensitive information
Two collections deserve a plain warning.
Free-text answers. An open answer box will accept anything you type. Please do not include health information, or other data you consider deeply private, unless you decide it is necessary for honest advice, for example the reason behind a training gap. We treat free text as the most sensitive data we hold: it is stripped from shared report links and never used for anything except your own analysis.
Voice dictation. The microphone button uses your browser’s own speech service. In most browsers your voice leaves your device and goes to the browser maker (for example Google in Chrome, Apple in Safari) to be turned into text. If you would rather your voice never left your device, type instead; everything works without dictation.
Your immigration and visa status is not classed as special-category data in law, but we know what it means to you, and it gets the same protection as everything else here: used for scoring, never shared beyond the processors below.
5. Who we share it with
We will never sell your personal data, and we will never disclose it to residency programmes, programme directors, the NRMP, ECFMG, or any other party involved in the Match. Competitive Edge operates independently of those bodies. The only third parties that ever receive your data are the service providers named below, each acting on our instructions under a data processing agreement, and only so that the product can function.
| Provider | What they do | What they receive |
|---|---|---|
| Supabase | Database and sign-in infrastructure (EU region) | Your stored profile, analyses, and chat |
| Anthropic | The AI model that analyses your profile | Your profile answers, CV contents during parsing, and your chat messages. Processed in the US. Not used to train models (section 7) |
| Sign-in (OAuth); speech-to-text if you dictate in Chrome | Your Google identity at sign-in; your voice audio only if you dictate in Chrome | |
| Apple | Speech-to-text if you dictate in Safari | Your voice audio only if you dictate in Safari |
| Stripe | Payments | Card and payment details; we see only reference, amount, currency, status |
| Vercel | Hosting | Technical request data, including IP addresses |
If a law or court order compels disclosure, we will disclose only what is legally required and, where the law allows, tell you first.
6. Where your data goes and how long we keep it
Your stored data lives in the EU (Supabase, [pinned region]). AI analysis runs in the United States, which is a cross-border transfer made under an appropriate legal transfer mechanism.
How long we keep things:
- Profile, analyses, and chat: for as long as your account exists. Delete your account and they go with it (section 9).
- Anonymous sessions: if you used Competitive Edge without signing in and never claim that session, we delete it automatically after 90 days.
- Payment records: kept for the statutory financial-records period (around six to seven years) even if you delete your account, because tax and fraud law requires it.
- Uploaded CVs: never stored. Processed once, then discarded.
- Dictation audio: never reaches us at all.
7. AI model use and training
Your profile is analysed by an AI model run by Anthropic. Anthropic does not use data sent through its API to train its models by default, and nothing we send creates an exception. Anthropic retains API inputs and outputs for a limited operational window before deletion.
Your data is never used to train models, ours or anyone else’s, and one applicant’s data is never used to produce another applicant’s report.
8. Cookies
We set only functional cookies; there are no advertising or analytics cookies today.
- A session cookie that lets you build a profile before signing in and lets us show you your own report. It lasts up to 400 days unless you clear it.
- Sign-in cookies from Supabase that keep you logged in securely.
If we ever add analytics, we will add a consent banner first and update this policy.
9. Your rights and how to use them
You have the right to see the data we hold on you, correct it, export it, delete it, restrict or object to processing, and withdraw consent. If you are in California, you have the equivalent CCPA rights, including the right to know, delete, and correct; we do not sell or share data, so there is nothing to opt out of. We never treat you differently for exercising a right.
How each one actually works:
- Correct: edit your profile and re-run your read at any time. That is correction, live and self-serve.
- See and export: use “Download my data” to get your profiles, analyses, and chat as a file.
- Delete: use “Delete account”. Your profile, analyses, and chat are permanently removed. Payment records survive for the statutory window (section 6); we tell you exactly that before you confirm.
- Everything else: email [privacy contact email]. We may ask you to verify your identity first, which protects your data from impersonation.
Using Competitive Edge without an account. You can use much of Competitive Edge before signing in. When you do, we store your profile and analysis against an anonymous session held in a cookie on your device, not against your name. We cannot connect that session to you as a person.
This has a consequence for your rights. Because the data is anonymous to us, we cannot verify that an access, correction, or deletion request comes from the person it belongs to, and honouring it blindly could expose or destroy someone else’s data. To exercise your rights over data you created before signing in, sign in from the same browser you used: this links that session to your account, after which you can view, export, or delete it like any other account data. If you cannot sign in, contact us and we will help where we can reasonably identify the data, though the law does not require us to act on requests we cannot verify (GDPR Articles 11 and 12). We do not keep anonymous data indefinitely: sessions never linked to an account are deleted automatically after 90 days.
If you believe we have mishandled your data, you can complain to your data protection authority. We would rather you told us first: [privacy contact email].
10. Security
Every table in our database is protected by row-level security with no client-side access: your data is only ever read or written by our own server. Payment card numbers never touch our systems. Cookies are httpOnly and sign-in uses PKCE. Secrets live server-side only. No system is perfectly secure and we do not claim otherwise, but the data paths here are deliberately few and narrow.
11. Legal basis for processing (GDPR)
| Purpose | Basis |
|---|---|
| Scoring your profile, producing your report, and the analyst chat | Contract: it is the service you asked for |
| CV upload and parsing | Consent, given when you choose to upload; withdraw by not uploading |
| Voice dictation | Consent, given when you press the microphone; type instead to withdraw |
| Security, abuse prevention, and debugging | Legitimate interests in protecting the service and its users |
| Retaining payment records after deletion | Legal obligation |
12. Changes to this policy
We will post changes here with a new effective date, and for material changes we will tell you in the product or by email before they take effect.
See also our terms of service.