Privacy Policy | Aptavia

1. Who we are

Aptavia (“we”, “us”, “our”) is operated by APTAVIA PTY LTD (ABN 45 699 800 327), based in Australia. We are responsible for the personal information we hold about you. If you have any questions about this policy or your data, contact us at contact@aptavia.com.au.

2. What information we collect

We only collect what we need to run the service and personalise your preparation:

Account information — your name, email address, and information used to authenticate your account. We never store your password in plain text.
Profile information — details you choose to give us, such as your degree, field of study, intended test date, target score, and the hours per week you plan to study, so we can tailor your study plan.
Study activity — your practice sessions and answers, mock test results, essays you submit for marking, flashcards, score history, and generated study plans. When you explicitly save a writing plan from the iOS app to your account, we also store its prompt, planning notes and connection to the essay you later submit. This lets you open the same task on the website and return to its result in the app. Unshared app drafts stay on the device; unsubmitted website essay drafts stay in the browser. Saved account plans are included in account exports and removed when the account is deleted.
Technical information — limited data needed to keep the service working and secure, such as basic log information and session cookies.
Usage events, crash and performance data — a record of how the product is used and whether it is working properly, on the website and in our iOS app. This includes features used, completed activities, crashes and response times. Most of these records are linked to your account while you are signed in; our server error records are not. Usage events describe activity rather than the text of your work. Website usage records include your device’s IP address and the approximate location (city, region and country) worked out from it. The iOS app sends crash and hang counts, not detailed crash reports. App events are sent only while you are signed in and may include earlier setup activity recorded on your device. See section 9 for analytics and recording choices.
Sign-up security signals — limited network, browser, device and email identifiers used to prevent duplicate or fraudulent accounts. For these checks, we use a protected identifier derived from your IP address rather than storing the address itself. The network identifier and browser description are deleted after 90 days; all of these signals are deleted with your account. If we block an account for misuse under our Terms, we keep a record of the block (including the email address it applies to) and, where we block sign-ups from a network, the protected network identifier for the length of that block — at most 12 months — after which the network identifier is deleted.
Marketing preferences and reminder lists — if you use the free essay-marking tool we collect your email address to verify it and deliver your report; if you sign up for GAMSAT date reminders, or tick an optional marketing checkbox, we also record when you consented, the exact wording you agreed to, and (for the reminder list) the IP address of the sign-up — this is our record that you asked to hear from us. If you unsubscribe, we keep your address on a do-not-email list so we don’t contact you again.
Free essay-marking tool, and the account it creates — using the free essay tool creates an account with your agreement to our Terms and this policy. We record the date and the version you accepted. Once your account is created, your email address, your essay and your report are account information — kept while your account is active rather than deleted on a timer, and you can delete them at any time from account settings. If an account is not created, we hold your email, essay and report only to produce your report, and delete that record automatically after 90 days. Marketing email requires your separate, optional consent.
Interview station answers and their readings — when you use an interview station we keep your answer and its AI-generated feedback, including excerpts from your answer, to support review and progress comparisons.We keep no recording. On a spoken station your voice is transcribed live by a third-party model provider and only the words are stored. These are account information: kept while your account exists, included in the “Export my data” download, and deleted with your account from account settings.

3. How we use your information

To create and manage your account and provide the service.
To personalise your study plan, practice and feedback.
To generate practice questions and mark essays using AI (see section 4).
To track your progress and show your score trajectory over time.
To improve the platform, fix problems, and keep it secure — including counting crashes and slow moments so we can find and repair them.
To detect and prevent fraud, abuse and misuse of the service, and to enforce our Terms of Use — including investigating suspected misuse, suspending or closing accounts, and blocking new sign-ups.
To communicate with you about your account or important service changes.
To send study nudges, progress recaps and — only with your consent — GAMSAT date reminders and marketing email (see section 8, including how to opt out of all of these).
To meet our legal obligations.

We do not sell your personal information, and we do not use your essays or answers to publicly identify you.

4. AI processing and third parties we share data with

To deliver core features we rely on trusted third-party providers, and some of your content is sent to them only to provide the feature you requested:

AI providers — we use third-party AI services to generate practice questions, mark your essays, provide tutoring and interview feedback, and transcribe spoken responses. Depending on the feature, relevant content is processed by Anthropic, Google, OpenAI, OpenRouter or xAI. This can include your essays, messages, answers or voice input. Where a provider offers the option, we direct them not to retain your content or use it to train their models.
Payment processing — payments for paid plans and credit packs are handled by Stripe on our website and Applefor purchases through the iOS app. Your card details are entered directly with the payment processor; we never collect or store your full card number on our servers. We keep the billing and purchase records needed to manage your plan, verify access, restore purchases, handle payment enquiries, and detect fraud or misuse of the service. Deleting an Aptavia account does not cancel a subscription billed by Apple; manage that subscription through Apple.
Hosting and infrastructure — Vercel and Neon provide services used to operate the platform and store data. Your account and study data are stored in Australia.
Email — we use Resend to send account-related messages and, subject to the preferences and consents described in section 8, study emails and date reminders.
Analytics and diagnostics — PostHog, Google and Vercel help us understand usage and performance. This includes browser session recordings and error tracking as described in section 9.
Security — Cloudflare helps protect the service from automated abuse.
Advertising measurement — Google helps measure responses to our advertising, subject to the choices in section 9.

Providers processing information on our behalf are only permitted to use it to provide their service to us. Where a provider handles information for its own purposes, its privacy terms also apply; Google’s use is linked in section 9. We may also disclose information if required by law.

5. Storage and security

We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. These steps include restricting access and using reputable infrastructure providers. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

6. How long we keep your data

We keep your personal information while your account is active. If you delete your account, we delete the personal information associated with it, except where we are required to retain certain records to comply with our legal obligations or to resolve disputes, and except for the block record described in section 2 when we have suspended or closed an account under our Terms. Interview transcripts and the readings of them are kept while your account exists, are exported on request, and are deleted with your account; we keep no audio recording. You can delete your account at any time from your account settings.

7. Your rights and choices

Under Australian privacy law you can:

Access your data — download a copy of your data at any time using the “Export my data” tool in your settings.
Correct your data — update your profile details in settings, or contact us to correct other information.
Delete your data — permanently delete your account and associated data using the “Delete my account” tool in settings.
If you can’t sign in — for example because your account has been suspended or closed — email contact@aptavia.com.au and we will handle access, correction and deletion requests by email.
Make a complaint — if you have a concern about how we handle your information, contact us first. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

8. Direct marketing, reminders and email preferences

We send a small number of email types beyond essential account messages, and every one of them is optional:

Study emails (account holders) — occasional practice reminders, streak nudges, weekly progress recaps and messages about your trial. You can turn these off in one click: every such email contains an unsubscribe link, and there is a master switch in Settings → Preferences.
GAMSAT date reminders — a consented list you join on our dates page. It is double opt-in: nothing is sent until you click the confirmation link we email you. Every reminder contains an unsubscribe link.
Marketing email — only ever sent if you ticked an optional, unticked-by-default consent box (at sign-up or on the free essay tool). Every such email contains an unsubscribe link.

When you consent, we keep a record of the time and the wording you agreed to; when you unsubscribe, your address goes on a do-not-email suppression list that we retain (even if you delete your account) solely so we never email you again — as the Spam Act 2003 (Cth) requires. Essential transactional email (verification codes, receipts, password resets, billing notices) is not affected by these preferences.

9. Cookies and analytics

We use essential cookies to keep you signed in and to operate the service securely. These are necessary for the site to function. You can control or delete cookies through your browser settings, but disabling essential cookies may stop you from being able to sign in.

We use PostHog and Google Analytics to understand how the platform is used, and Google Ads to measure responses to advertising. We do not send your essays, answers, or other free-text study content to analytics or advertising measurement.

On the website, session recordings capture page interactions to help improve the interface, and error tracking helps diagnose failures. Information you type into fields, and displayed free-text study or AI content, is masked in recordings before it leaves your browser.

Your choices. In Australia, optional analytics and advertising cookies are enabled by default and you can decline them using the cookie banner. In the European Economic Area (EEA) and United Kingdom, these cookies are disabled until you consent. Browser session recordings and browser-side error tracking follow the same banner choice. Google may still receive limited measurement signals without cookies before consent or after you decline. Service activity, security and server diagnostic records continue as described in sections 2 and 3.

Where you arrived from. When you first reach the site from another website, a search engine or an AI assistant, we may keep the name of that site (for example google.com or chatgpt.com, never the page you were on or what you searched) in a cookie for up to 30 days, and record it on your account if you create one, so we can see which channels bring students to Aptavia. This is an optional cookie and follows the banner choice described above. In the EEA and UK it is not set until you consent.

The iOS app has no advertising tracking or session recordings. Its account-linked usage and diagnostic data are described in section 2. The app does not use analytics cookies, so it has no cookie banner.

See how Google uses information from sites and apps for its data handling and available controls.

10. Overseas disclosure

Your account and study data are stored in Australia. However, some processing happens overseas: our AI providers and some infrastructure and analytics providers process data on servers located outside Australia, primarily in the United States. We do not use AI providers based in China. Where data is processed overseas, we take reasonable steps to ensure it is handled consistently with this policy and applicable privacy law. By using the service, you acknowledge that your information may be processed overseas as described.

11. EEA and UK users

If you are in the European Economic Area or the United Kingdom, the GDPR / UK GDPR applies to our handling of your personal data, and you have additional rights and protections:

Lawful bases. We process your data to perform our contract with you (providing the service), on the basis of your consent (for analytics cookies), and for our legitimate interests in running and securing the platform.
Your rights. In addition to the rights in section 7, you may request access, rectification, erasure, restriction of processing, data portability, and you may object to processing based on legitimate interests. You can withdraw consent (e.g. for analytics) at any time without affecting prior processing.
International transfers. When your data is transferred outside the EEA/UK (for example to our US-based AI providers), we rely on appropriate safeguards such as the providers’ Standard Contractual Clauses.
Complaints. You can lodge a complaint with your local data protection authority — in the UK, the Information Commissioner’s Office (ICO) at ico.org.uk.

12. Children

Aptavia is intended for graduate-medicine applicants and is not directed at children. We do not knowingly collect personal information from anyone under 16 without appropriate consent.

13. Changes to this policy

We may update this policy from time to time. When we do, we will change the “Last updated” date above, and for material changes we will take reasonable steps to notify you. Your continued use of the service after an update means you accept the revised policy.

14. Contact us

For any privacy questions or requests, contact APTAVIA PTY LTD (ABN 45 699 800 327) at contact@aptavia.com.au. We aim to respond to privacy requests within 30 days.