Privacy Policy

1.1 This Privacy Policy applies to all personal data processed by the Company in connection with the Platform and related services, including:

• visitors who browse the Platform without creating an account;
• registered users who have created an account;
• enrolled users who have purchased or accessed a course or any paid service;
• individuals who interact with the Company through email, customer support, social media, or any other channel.

1.2 This Privacy Policy does not apply to third-party websites, applications, or services that may be linked from the Platform. We encourage you to review the privacy policies of any third-party services you visit.

For the purposes of this Privacy Policy:

• “Personal Data” or “Personal Information” means any information that relates to an identified or identifiable natural person, directly or indirectly, including name, email address, phone number, device identifiers, and payment details.
• “Sensitive Personal Data or Information (SPDI)” has the meaning assigned to it under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and includes passwords, financial information, and health information.
• “Digital Personal Data” has the meaning assigned to it under the Digital Personal Data Protection Act, 2023 (DPDP Act).
• “Processing” means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• “Consent” means a freely given, specific, informed, and unambiguous indication of the data principal’s agreement to the processing of their Personal Data.
• “Data Fiduciary” means the Company, as the entity that determines the purpose and means of processing Personal Data.
• “Data Principal” means you, the individual whose Personal Data is being processed.

We collect Personal Data in the following categories, depending on how you interact with the Platform:

3.1 Data You Provide Directly

• Registration data: full name, email address, mobile number, and password (stored in hashed form).
• Academic profile data: MBBS college name, year of graduation, specialisation of interest, and NEET PG preparation status (voluntarily provided).
• Payment data: billing name, billing address, and partial payment card details (last four digits and card type) or UPI handle, as processed by our payment gateway partner. We do not store complete card numbers.
• Communication data: messages, queries, or feedback you submit through contact forms, email, or chat support.
• Profile and preference data: preferred subjects, performance goals, and notification preferences.

3.2 Data Collected Automatically

• Device and browser information: IP address, browser type and version, operating system, screen resolution, and device identifiers.
• Usage data: pages visited, videos watched, time spent per lecture, test scores and performance data, click patterns, and navigation paths.
• Log data: server access logs, error logs, and timestamps of activity on the Platform.
• Cookie and tracking data: data collected through cookies, web beacons, pixels, and similar tracking technologies (see Clause 9).
• Location data: approximate geographic location inferred from IP address; we do not collect precise GPS location.

3.3 Data Received from Third Parties

• Payment gateway providers: transaction confirmation, payment status, and partial payment details.
• Social login providers: if you choose to register or log in using Google or another supported OAuth provider, we receive your name, email address, and profile picture as shared by that provider.
• Analytics providers: aggregated and anonymised behavioural data to understand Platform usage patterns.

We process your Personal Data only for lawful purposes. The following table sets out the main purposes for which we process your data and the legal basis for each:

5.1 We do not sell, rent, or trade your Personal Data to any third party for their independent marketing purposes.

5.2 We may share your Personal Data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate confidentiality and data protection obligations:

5.2.1 Service Providers and Processors

• Payment gateway providers (e.g., Razorpay, PayU, or equivalent): to process course fee transactions. These providers are PCI-DSS compliant and process payment data under their own privacy policies.
• Cloud hosting and infrastructure providers: to host the Platform and store data securely on servers located in India or as permitted under applicable law.
• Email and SMS communication providers: to deliver transactional and marketing communications.
• Video hosting and streaming providers: to deliver course video content.
• Analytics providers: to analyse Platform usage in aggregated or pseudonymised form.
• Customer support tools: to manage and respond to support queries.

5.2.2 Faculty and Content Partners

Faculty members and content partners engaged by the Company may access your performance and engagement data solely to provide academic feedback, identify learning gaps, and improve course content. They are bound by confidentiality obligations.

5.2.3 Legal and Regulatory Authorities

We may disclose your Personal Data to courts, regulators, law enforcement agencies, or other governmental authorities if required to do so by applicable law, court order, or regulatory direction, or if we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of the Company, its users, or the public.

5.2.4 Business Transfers

If the Company undergoes a merger, acquisition, restructuring, or sale of all or substantially all of its assets, your Personal Data may be transferred to the successor entity, subject to the same or equivalent privacy protections as described in this Privacy Policy. We will notify you of any such transfer as required by applicable law.

6.1 We retain your Personal Data only for as long as necessary to fulfil the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by applicable law.

6.2 The following indicative retention periods apply:

• Account and registration data: retained for the duration of your active account and for 3 years after account closure or last activity, whichever is later, for legal, audit, and dispute resolution purposes.
• Payment and transaction records: retained for 8 years from the date of the transaction, as required under applicable tax and financial regulations.
• Course access and performance data: retained for 3 years after the expiry of course access, to enable re-enrolment, rank comparisons, and academic analytics.
• Communication and support records: retained for 2 years after the closure of the support ticket or query.
• Cookie and analytics data: retained in accordance with the cookie lifespans disclosed in Clause 9; aggregated analytics data may be retained indefinitely.

6.3 When Personal Data is no longer required, we will delete or anonymise it in a secure manner. Where deletion is not immediately possible (e.g., because data is stored in backup systems), we will isolate the data from further processing until deletion can be effected.

7.1 We implement reasonable security practices and procedures as required under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to protect your Personal Data from unauthorised access, disclosure, alteration, or destruction. Our security measures include:

• Encryption of data in transit using industry-standard TLS/SSL protocols.
• Hashing of passwords using secure, salted hashing algorithms; plain-text passwords are never stored.
• Restricted access to Personal Data on a need-to-know basis for authorised personnel only.
• Regular review and testing of our security systems and procedures.
• Use of PCI-DSS compliant payment processors; we do not store complete payment card numbers on our servers.
• Firewalls, intrusion detection systems, and secure server configurations.

7.2 Notwithstanding the above, no method of transmission over the internet or method of electronic storage is completely secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security. You are responsible for keeping your account credentials confidential and for any activity that occurs under your account.

7.3 In the event of a data breach that is likely to result in a risk to your rights or interests, we will notify the affected users and the relevant authorities as required under applicable law, including the DPDP Act, 2023.

Subject to applicable law, you have the following rights in respect of your Personal Data held by us. To exercise any of these rights, please contact us using the details in Clause 14.

8.1 Right to Access

You have the right to request confirmation of whether we process your Personal Data and, if so, to obtain a copy of the Personal Data we hold about you, along with information about how it is processed.

8.2 Right to Correction

You have the right to request that we correct any inaccurate or incomplete Personal Data we hold about you. You may update most profile information directly through your account settings.

8.3 Right to Erasure

You have the right to request the deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing is unlawful. This right is subject to our legal obligations to retain certain data (e.g., financial records).

8.4 Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. To withdraw consent for marketing communications, you may click “Unsubscribe” in any marketing email or contact us directly.

8.5 Right to Grievance Redressal

You have the right to have your grievances regarding the processing of your Personal Data addressed in a timely and effective manner. Please refer to Clause 13 for our Grievance Officer details.

8.6 Right to Nominate

Under the DPDP Act, 2023, you have the right to nominate another individual to exercise your rights in the event of your death or incapacity.

8.7 Right to Lodge a Complaint

If you believe that our processing of your Personal Data violates applicable law, you have the right to lodge a complaint with the Data Protection Board of India (once established under the DPDP Act, 2023) or any other competent regulatory authority.

We will respond to all legitimate rights requests within 30 days of receipt, unless a longer period is permitted by applicable law.

9.1 We use cookies, web beacons, pixels, and similar tracking technologies to enhance your experience on the Platform, analyse usage patterns, and deliver relevant content. A “cookie” is a small text file stored on your device by your browser.

9.2 We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the Platform to function, including maintaining your logged-in session and enabling secure payment flows. These cannot be disabled without affecting Platform functionality.
• Functional Cookies: Enable personalisation features such as remembering your language preferences, course progress, and dashboard settings.
• Analytics and Performance Cookies: Used by tools such as Google Analytics to collect aggregated, anonymised data about how users interact with the Platform, helping us improve content and design.
• Marketing and Tracking Cookies: Used to track your visits across websites to display relevant advertisements for our courses on third-party platforms. These are only set with your consent.

9.3 Cookie Management. You can control and manage cookies through your browser settings. Most browsers allow you to refuse or delete cookies. Please note that disabling certain cookies may affect the functionality of the Platform. Where required by law, we will obtain your consent before placing non-essential cookies on your device.

9.4 We may also use Facebook Pixel and similar third-party tracking pixels for retargeting purposes. These tools are governed by the privacy policies of the respective third parties.

10.1 The Platform is intended for use by individuals who are at least 18 years of age. The NEET PG examination is open to graduates of MBBS programmes, who are typically adults. We do not knowingly collect Personal Data from individuals under the age of 18 (“Children”).

10.2 If we become aware that we have inadvertently collected Personal Data from a Child without verifiable parental or guardian consent, we will take steps to delete that information as promptly as practicable.

10.3 If you are a parent or guardian and believe that your child has provided us with Personal Data without your consent, please contact us immediately using the details in Clause 14.

11.1 We primarily store and process your Personal Data in India. However, some of our third-party service providers (including cloud hosting, analytics, video streaming, and communication providers) may process or store data in servers located outside India.

11.2 Where Personal Data is transferred outside India, we take appropriate steps to ensure that such transfers are carried out in accordance with applicable law, including the DPDP Act, 2023, and any rules or regulations issued thereunder. By using the Platform, you consent to such cross-border transfers of your Personal Data to the extent permitted by applicable law.

12.1 We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the “Last Updated” date at the top of this Policy and, where appropriate, notify you by email or through a prominent notice on the Platform.

12.2 Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acceptance of the changes. We encourage you to review this Privacy Policy periodically. If you do not agree with the revised Policy, you should discontinue your use of the Platform and may request deletion of your account.

In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023 (as applicable), we have designated a Grievance Officer to address any concerns or complaints regarding the processing of your Personal Data. You may contact the Grievance Officer at:

We will acknowledge receipt of your grievance within 48 hours and endeavour to resolve it within 30 days of receipt, as required by applicable law.

If you have any questions, requests, or concerns about this Privacy Policy or our data practices, please contact us at:

Governing Law: This Privacy Policy is governed by the laws of India. Any disputes arising under this Policy shall be subject to the exclusive jurisdiction of the courts of Kolkata, West Bengal.