Privacy Policy
Last updated: September 2026
1. Who is responsible for your data
Clinical CME Group LLC, a Delaware limited liability company, of 2140 South Dupont Highway, Camden, Delaware, 19934, USA, operating as Titrate. Privacy enquiries: Office@clinicalcmegroup.com.
2. What we collect
You give us:
- Account details — your first and last name, email address, country, and a password (stored only as a bcrypt hash, never in plain text). If you sign in with Google we receive your Google account email and name instead of a password.
- Your marketing preference — whether you have asked us to send study tips and product news, and when you last told us.
- Study profile — which exam you are preparing for, your exam date, your available weekly study hours, whether you are resitting, and how you heard about us. All optional except the exam.
- Your answers, timings and your self-reported reference-book use.
- Anything you type to the AI tutor.
We generate:
- Scores, domain breakdowns, pace and reliance figures, AI feedback reports and revision timetables.
- Records of credit-consuming actions, for billing accuracy and abuse prevention.
We collect automatically:
- Your browser's time zone, so study reminders and timings are shown in your local time.
- Standard server logs, including IP address, browser type and request times, kept for security and troubleshooting.
We do not collect: payment card details. Those go directly to Stripe.
3. Google Sign-In data
If you choose "Continue with Google" instead of setting a password, this is what happens with your Google Account data:
- What we request: only the
profileandemailscopes — your name and email address. We never request access to your Gmail, Drive, Calendar, Contacts or any other Google service, and we never request a sensitive or restricted scope. - What Google sends us: your name and email address, and confirmation that Google has verified that address.
- How we use it: solely to create and authenticate your Titrate account and to address you by name. We do not use it for advertising, and we do not profile you with it beyond the study analytics described in section 2.
- How long we keep it: for as long as your Titrate account is open — see "How long we keep it", below.
- Who we share it with: nobody, beyond Google itself as part of the sign-in exchange. It is not sold, and it is not given to any of our other sub-processors (see the table below) except where a sub-processor is itself the one providing that data, such as Google during sign-in.
- Your control over it: you can disconnect Titrate from your Google Account at any time from your Google Account's third-party access settings, independently of your Titrate account. Deleting your Titrate account (see "Your rights", below) deletes this data from our systems.
Our use of Google user data across Titrate complies with the Google API Services User Data Policy, including its Limited Use requirements.
4. Why we use it
- To provide the service you have asked for — benchmarking, feedback, practice and progress tracking.
- To operate your subscription and enforce plan allowances.
- To keep the service secure and to prevent abuse.
- To improve question quality: we analyse aggregate answer statistics to identify questions that are mis-keyed or ambiguous.
- To email you about your account. We will not send you marketing email without your consent, and you can withdraw it at any time from your account page or any marketing email we send.
5. AI processing
When you request a feedback report, a revision timetable or a tutor answer, we send the relevant information to our AI provider (OpenRouter, which routes to the underlying model provider) to generate the response.
What is sent: your performance figures by domain, your exam date and study hours, the question concerned and your answer to it, and your message to the tutor.
What is not sent: your name, your email address or your payment details.
6. Who we share it with
We use these sub-processors:
| Provider | Purpose | Data involved |
|---|---|---|
| Railway | Hosting and database | All application data |
| Stripe | Payment processing | Email, name, payment details (held by Stripe) |
| OpenRouter | AI generation | Performance figures, question content, tutor messages |
| Resend | Transactional email | Email address, name |
| Optional sign-in | Google account email and name |
Titrate is operated from the United States, and our sub-processors are located in the United States and other countries. If you are in Australia, the UK or the EU, this means your data is transferred outside your country and processed in the United States and elsewhere. We take reasonable steps to ensure it is handled consistently with this policy.
We do not sell your personal information.
7. How long we keep it
We keep your account data while your account is open. If you delete your account, we delete your personal data and all of your study history promptly.
We keep transaction records for as long as tax and accounting law requires, and we may keep anonymised, aggregated statistics (such as how often a given question is answered correctly) that cannot identify you.
8. Your rights
You can, at any time:
- Access and export everything we hold about you, as JSON, from your account settings.
- Correct your details from your account settings.
- Delete your account and your data from your account settings.
- Complain to us at Office@clinicalcmegroup.com, and if you are not satisfied, to the privacy regulator where you live — for example the Office of the Australian Information Commissioner if you are in Australia, or the Information Commissioner's Office if you are in the UK.
If you are in the UK or EU, you have additional rights under the UK GDPR / GDPR, including the right to object to processing and to data portability. Contact us to exercise them.
9. Security
Passwords are hashed with bcrypt. Sessions use signed, httpOnly cookies. Data is encrypted in transit. Access to production data is limited to those who need it.
No system is perfectly secure. If a breach occurs that is likely to cause you serious harm, we will notify you and the relevant regulator as the law requires.
10. Cookies
We use a single essential cookie to keep you signed in. We do not use advertising or third-party tracking cookies.
11. Changes
We will post any changes here and, if they are material — including any change to how we access, use, store or share Google user data — tell you by email before the change takes effect.