Privacy statement

Who processes your data

Cavum is the controller for the personal data processed through this platform. Privacy questions and anything else go to [email protected].

What data we process

• Account data: your email address, a hashed representation of your password, and your chosen language.
• Subscription data: status, start and end date. Payment itself runs through our payment provider; we never store card details.
• Device data: a register of the devices you are signed in on, with browser type and last-used time. This register makes sure your account is in use on one device at a time.
• Learning data: which questions you answered, whether the answer was correct, and the scheduling state per card. The repetition scheduler cannot work without this.
• Technical logs: IP address and request time, for security and abuse detection.

Why, and on what legal basis

• Performance of the contract (Art. 6(1)(b) GDPR): your account, your subscription, your access to the books and practice layer, and your progress.
• Legitimate interest (Art. 6(1)(f) GDPR): security, fraud prevention and countering account sharing. This is the basis for the device limit, the watermark on book pages and the technical logs.
• Legal obligation (Art. 6(1)(c) GDPR): the statutory retention period for invoices.

Watermarking of book pages

Book pages carry a watermark derived from your account. Its purpose is that a leaked screenshot can be traced back to the account that produced it. We use this only on a concrete suspicion of redistribution, never to track your reading behaviour.

Study assistant

The study assistant answers questions about the material with an AI language model. When you ask a question, we send your question, the earlier messages of that conversation, the text you selected in the book and the relevant text from the book to OpenRouter and to the model provider OpenRouter routes it to. Your name and email address are not included. Those providers may keep the text they receive or use it to improve their models.

Cavum stores your conversations with your account, so you can reread and continue an earlier one: your questions, the text you sent with them and the answers. In Cavum only you can see them. A conversation is erased 90 days after its last message, we keep at most your 50 most recent conversations, and you can delete any conversation yourself from the list of earlier conversations. If you delete your account, your conversations go with it. We also keep a daily count of how many questions you asked, for the daily limit. Do not type personal data into the assistant, including anything about patients.

Who else sees your data

We do not sell your data and do not use it for advertising. We engage processors for hosting, database, email and payments. A data processing agreement is in place with each of them. Where a processor handles data outside the EEA, that happens under the European Commission's standard contractual clauses.

How long we keep it

• Account and learning data: as long as your account exists. After deletion we erase them from active systems within 30 days.
• Study assistant conversations: 90 days after the last message, or less if you delete them yourself.
• Invoices: seven years, under the statutory tax retention period.
• Technical logs: 90 days at most.

Your rights

You have the right to access, rectification, erasure, restriction, portability and objection. You can download a copy of your data and delete your account yourself on your account page, and both take effect at once. For the other rights, or if you prefer email, send your request to [email protected]; we respond within 30 days. If you disagree with how we handle it, you can complain to the Dutch Data Protection Authority.

Changes

We update this statement when the platform changes. The date at the top marks the last substantive change. For a significant change we tell you inside the app.