DPT SCHOOL PREREQS
Privacy & your data.
Your application plan is yours. This notice explains what DPT School Prereqs processes to provide the website and account dashboard.
Information you provide
We process your sign-in email and account identifier. Saved workspace content may include your chosen name and cycle label, saved schools, courses and grades, observation records and contacts, tasks, recommender details, essay drafts and versions, budgets and notes. Support messages include whatever you choose to send. Only enter information you need for planning and have permission to use.
Do not enter patient information, Social Security numbers, payment credentials or confidential recommendation letters. This is an application organizer, not a medical-record system.
How we use information
We use account information to authenticate you, workspace content to save and display your plan, and support messages to answer requests. Operational records help secure the service, prevent duplicate purchases, deliver access, resolve billing problems and meet legal obligations. We record limited authenticated workspace-opened, saved and deleted events; these event records do not contain your essay text or planning field values.
Payments and email
When purchases are enabled, Stripe handles payment details through hosted Checkout; DPT does not receive your full card number. DPT stores order and payment identifiers, amounts, access dates, the accepted policy version, provisioning records and payment/refund/dispute status. Confirmation delivery status and authenticated use are distinct records.
Resend sends sign-in and purchase-confirmation emails. DPT records verified DPT delivery, bounce, failure and complaint metadata. Non-DPT callback events are discarded without being stored in DPT's email-event table. The support inbox uses GoDaddy email services. Sign-in emails and receipts are service communications, not a marketing subscription.
Providers and disclosure
GoDaddy hosts public pages, support email and encrypted recovery copies; Cloudflare provides public-site DNS, HTTPS and security; Fly.io runs the application and worker and securely stores the recovery key; Supabase provides authentication and database storage; Resend sends transactional email; Stripe provides payment processing when enabled. Each receives information necessary for its role and may process technical, security, billing or delivery records under its own terms. Our database is hosted in Canada; other processing may occur in the United States and other locations used by these providers.
We do not sell personal information or share it for targeted advertising. The DPT website has no third-party advertising or analytics tags and no embedded AI processing. We may disclose information when legally required, to protect users and service security, or to address a billing dispute. We do not send your plan to schools or PTCAS.
Security, cookies and browser storage
Workspace content is encrypted before database storage and decrypted by the application to serve your requests. This is not end-to-end encryption, and encryption does not eliminate every risk. HTTPS protects supported network connections. Essential cookies maintain sign-in and protect requests. The pending sign-in cookie lasts up to 10 minutes and the session cookie up to 30 days, subject to session validity and sign-out. A temporary browser-session identifier helps prevent duplicate Checkout attempts.
The browser-only preview stores a separate plan on your device; it is not uploaded automatically. Connected account edits stay in the open tab until saving succeeds. Providers may receive IP addresses, browser information, timestamps and request/security metadata. External school and PTCAS links have their own privacy practices.
Retention and your choices
Saved account planning content is retained during active access and for 14 days after expiry, then scheduled for deletion from the active database. You can export or delete retained content in Account & access, including after expiry. Deletion leaves a minimal account/revision marker to prevent stale saves; it does not close your account or erase financial and operational records. Backups can retain prior copies until their retention cycles expire. Read the full retention and deletion policy.
For access, correction, account closure or other privacy requests, contact [email protected]. We may verify your identity and explain any lawful retention exception. We respond under applicable law; rights vary by location. Delete downloaded backups and browser site data separately. Do not send unnecessary sensitive information with a request.
Changes
We will update this notice when practices change and provide notice where required. The version and review status appear below. This policy does not claim that deleting workspace content erases every provider log, payment record or copy on another device.
Policy version: 2026-10-30. Health Professions Data, LLC. Effective October 30, 2026. Contact: [email protected].