Privacy Policy
Last updated: September 19, 2026
1. Introduction
NovaPath Med Labs ("we," "us," or "our") operates the NovaPath Med Labs platform (the "Service"), a subscription-based learning management system for medical laboratory technology students. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.
By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of the Service.
2. Data Controller
The data controller responsible for your personal data is:
NovaPath Med Labs
Email: support@novapathmedlabs.com
3. Information We Collect
3.1 Account Information
When you create an account, we collect:
Name (as provided during registration)
Email address
Password (stored in hashed form using bcrypt; we never see or store your plaintext password)
3.2 Payment Information
When subscriptions are enabled, payment processing is handled by Stripe, Inc. We do not store your credit card number, CVV, or full payment card details on our servers. Stripe may collect and process:
Payment method type (e.g., Visa, Mastercard)
Last four digits of your payment card
Stripe customer ID
Subscription status and billing history
Stripe's own privacy policy governs their handling of your payment data: https://stripe.com/privacy
3.3 Learning and Progress Data
As you use the platform, we collect:
Chapter completion records (which chapters you have marked as complete)
Exam attempts (scores, pass/fail status, timestamps)
Exam answers (which answers you selected for each question)
3.4 Technical and Usage Data
We automatically collect certain technical information when you access the Service:
IP address
Browser type and version
Operating system
Device type (desktop, mobile, tablet)
Pages visited and time spent on each page
Referring URL (the page that led you to our Service)
4. How We Use Your Information
We use the information we collect for the following purposes:
To provide and maintain the Service — including account creation, authentication, content delivery, progress tracking, and exam grading.
To process subscriptions — including payment verification, billing, and subscription management (when Stripe is enabled).
To communicate with you — including email verification, password reset requests, and service-related notifications.
To improve the Service — including analyzing usage patterns, identifying errors, and optimizing platform performance.
To ensure security and prevent fraud — including detecting unauthorized access, abuse, and academic dishonesty.
To comply with legal obligations — including responding to lawful requests from governmental authorities.
5. Lawful Basis for Processing (GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following lawful bases as defined by the General Data Protection Regulation (GDPR):
Contract performance — Processing necessary to deliver the Service you have subscribed to (account management, content delivery, exam grading, subscription billing).
Legitimate interests — Processing for security, fraud prevention, and improving the Service, where these interests are not overridden by your rights.
Consent — Where you have given explicit consent (e.g., for marketing communications, if implemented in the future).
Legal obligation — Processing required to comply with applicable laws.
6. Third-Party Service Providers
We share your information with the following categories of third-party service providers who assist us in operating the Service:
Stripe, Inc. — Payment processing. Processes payment data on their own infrastructure under their privacy policy.
Hosting provider — Cloud infrastructure for hosting the application and database (e.g., your hosting provider or cloud platform).
Email service provider — Transactional email delivery (password resets, account verification). Currently configured to log emails in development.
We do not sell, rent, or trade your personal information to third parties for their marketing purposes.
7. Cookies and Tracking Technologies
We use only essential cookies necessary for the functioning of the Service:
Session cookie — Maintains your authenticated session while you are logged in.
Remember-me cookie — Allows you to remain logged in across browser sessions (only if you opt in).
CSRF token cookie — Protects against cross-site request forgery attacks.
We do not use advertising cookies, analytics tracking cookies, or third-party tracking pixels. Your browser may also store a local preference for dark/light mode, but this is stored in your browser's localStorage and is never sent to our servers.
8. Data Retention
We retain your personal data for as long as your account is active or as needed to provide the Service:
Account data — Retained until you delete your account.
Session data — Expired after 120 minutes of inactivity.
Learning progress and exam attempts — Retained until you delete your account.
Password reset tokens — Expire after 60 minutes.
Payment records — Retained by Stripe in accordance with their retention policies and applicable financial regulations.
When you delete your account, we delete your personal data, chapter progress, exam attempts, and exam answers. We do not delete Stripe customer records, as these are governed by Stripe's own retention policies and applicable financial regulations.
9. Your Rights
9.1 GDPR Rights (EEA, UK, Swiss Users)
If you are in the EEA, UK, or Switzerland, you have the following rights:
Right of access — Request a copy of the personal data we hold about you.
Right to rectification — Request correction of inaccurate personal data.
Right to erasure — Request deletion of your personal data ("right to be forgotten").
Right to restrict processing — Request that we limit how we use your data.
Right to data portability — Request a copy of your data in a structured, commonly used, machine-readable format.
Right to object — Object to our processing of your personal data based on legitimate interests.
Right to withdraw consent — Where processing is based on consent, withdraw it at any time.
9.2 CCPA Rights (California Users)
If you are a California resident, the California Consumer Privacy Act (CCPA) grants you the following rights:
Right to know — Request disclosure of the categories and specific pieces of personal information we have collected about you.
Right to delete — Request deletion of your personal information.
Right to correct — Request correction of inaccurate personal information.
Right to opt-out of sale — We do not sell your personal information. If this changes, we will provide a "Do Not Sell or Share My Personal Information" link.
Right to non-discrimination — We will not discriminate against you for exercising your privacy rights.
9.3 Other US State Privacy Rights
Residents of other US states with comprehensive privacy laws (including Colorado, Virginia, Connecticut, Utah, Texas, Oregon, Montana, and others) may have similar rights to access, correct, delete, and opt out of the sale or targeted advertising of their personal information. We honor all applicable state privacy rights.
9.4 How to Exercise Your Rights
To exercise any of these rights, please contact us at support@novapathmedlabs.com. We will respond to your request within 30 days. We may need to verify your identity before processing your request.
10. Data Security
We implement appropriate technical and organizational security measures to protect your personal data, including:
Passwords are hashed using bcrypt with 12 rounds — we never store or have access to your plaintext password.
All data transmission is encrypted via HTTPS/TLS.
Sessions are stored server-side in an encrypted database with HTTP-only cookies.
CSRF protection is enabled on all state-changing requests.
Access to the admin panel is restricted to authorized administrators only.
While we strive to use commercially acceptable means to protect your personal data, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.
11. International Data Transfers
Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from the laws of your jurisdiction.
When we transfer personal data from the EEA or UK to countries that have not been deemed to provide an adequate level of data protection, we use appropriate safeguards such as Standard Contractual Clauses (SCCs) or other legally recognized transfer mechanisms.
12. Children's Privacy
The Service is designed for adult learners (18 years of age and older) in medical laboratory technology programs. We do not knowingly collect personal information from children under the age of 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete such information promptly.
If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at support@novapathmedlabs.com.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or through a prominent notice on the Service.
We encourage you to review this Privacy Policy periodically. Your continued use of the Service after any changes constitutes acceptance of the updated policy.
14. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Email: support@novapathmedlabs.com