Privacy · last updated 2 October 2026

What happens to your email, and to your lectures if you use the app.

Last updated 2026-10-02 — plain-English summary, not legal advice, not yet reviewed by a lawyer. Sections 1 to 6 cover the website and its waitlist. Section 7 covers the app, which is currently a small invite-only pilot; it applies to you if you have been invited. It is written to the standard of the strictest law, UK and EU GDPR, so it covers students in those places too.

1 · Who is responsible for your data

TheStudyFix is built by one medical student, Betra Youhanna, based in Egypt, under the name TheStudyFix (thestudyfix.com). TheStudyFix is not yet a registered company. That person decides what happens to your data. In data-protection law, that makes them the controller.

Contact for anything on this page: [email protected]. A person reads it, not a bot.

2 · The waitlist, and what the website collects

If you put your email in the box on the home page, this is everything that happens to it on the website. It was written down before the form was switched on, which is the rule section 5 sets.

What it is used for
Two things only. First, to send you the video demo you signed up for. Second, to tell you when the app opens. It is not used for anything else, and it is never sold, rented, or shared to build an audience anywhere.
What is stored
Your email address. The time you signed up. Which page the signup came from (today that is always the home page). The first 200 characters of the description your browser sends with every request (its "user agent"), kept only to spot floods of automated signups.
Your IP address
Not stored as an address. Your IP address is mixed with a secret key and scrambled into a code (a "salted hash"). The code is used for one thing: counting how many signup attempts came from the same place in the last hour, so a script cannot stuff the list. It allows five attempts an hour. The code is kept with your signup, and a separate log keeps the code and the time of every attempt, including failed ones. Without the secret key it cannot practically be turned back into your address. It is still treated here as personal data, because in law it is.
What is never stored
Your name, your country, your university, any tracking or advertising identifier, and any record of what you looked at on this site.
Where it lives
A database run by Cloudflare, in the same account that serves this page. There is no third-party form service, and nothing on this site can read the list back out.
The Google Sheet copy
A copy of your email address, your signup time and the time it was copied is written into a private Google Sheet, so the list can be read without a database console. Nobody else is given access to that sheet.
The bot check
The home page runs Cloudflare Turnstile, a check that a real browser is present. It runs when the home page loads, whether or not you sign up. To do that, Cloudflare sees your IP address and some technical properties of your browser. When you sign up, this site's server also passes your IP address to Cloudflare to confirm the check. Your email address is never sent to the check. Cloudflare states that Turnstile is not used for advertising or to follow you across other sites. It is here because without it a script can fill the list with fake addresses.
The emails you will get
The video demo, news when the app opens, and marketing emails from TheStudyFix: product updates and offers for TheStudyFix itself. Nothing from anyone else, ever. Every email will say how to unsubscribe, and replying "unsubscribe" always works. No emails have been sent yet. The service that sends them will be named on this page before the first one goes out, and it will receive your address only to deliver them.

3 · The legal basis, in plain words

Your consent. You typed your email into a box that says what it is for. That is the legal basis under the UK and EU General Data Protection Regulation (GDPR) and under Egypt's Personal Data Protection Law (Law No. 151 of 2020). You can withdraw consent at any time, and it is as easy as signing up: unsubscribe, or email [email protected].

The IP code and the user-agent text are kept for a different reason: keeping the form safe from abuse. That is a legitimate interest, meaning a genuine need that is small and does not override your privacy. You can object to it by emailing the address above.

For readers in the US: the emails will not use misleading subject lines or sender names, and an unsubscribe request will be honoured promptly, as the CAN-SPAM Act requires.

4 · Who handles it for TheStudyFix, and where

Three outside companies touch waitlist data. Each one only handles it to provide its service:

These companies may store or process data outside your country, including in the United States. Where UK or EU data leaves those regions, the transfer relies on the legal safeguards these companies offer in their data terms, such as the European Commission's standard contractual clauses.

5 · Cookies, storage, and what is measured

This site sets no cookies of its own, and its code contains no analytics, no session recording, and no advertising tags. It stores two small things in your own browser, and neither is sent anywhere:

The fonts are served from this site, not from Google. The only outside script is the Cloudflare bot check on the home page (section 2). Links to research papers take you to other sites, which have their own policies.

If anything else is ever measured, it will be declared on this page before the first measurement is taken, not after.

6 · How long it is kept, and your rights

How long
Your email is kept until you unsubscribe or ask for it to be deleted. There is no fixed end date, because it is what lets TheStudyFix keep emailing you, which is what you signed up for. The log of signup attempts (a scrambled IP code and a time, used only to stop floods of fake signups) is deleted automatically after 30 days.
Your rights
You can ask to see the data held about you, get it corrected, get it deleted, withdraw your consent, or object to how it is used. You do not need to give a reason.
How to use them
Email [email protected] from the address you signed up with, and say what you want. You will get an answer within one month. Deletion covers the database and the spreadsheet copy. Cloudflare keeps short-lived database backups, so a deleted address can survive in them for up to 30 days before it is gone for good.
If you are unhappy
Tell [email protected] first. You also have the right to complain to a data protection regulator: in the UK the Information Commissioner's Office (ICO), in the EU the regulator in your country, and in Egypt the Personal Data Protection Centre.
Age
The waitlist is for medical students aged 16 or over. If you are younger, please do not sign up.
Changes to this page
The date at the top changes whenever this page does. If a change affects how your email is used, you will be emailed about it before it applies.

7 · The app (invite-only pilot)

This section applies if you have been invited to use the app. It is written to the standard of UK and EU GDPR, and we will honour your data rights under the law of the country where you live. Betra Youhanna (section 1) is the controller. The terms are governed by Egyptian law (terms, section 7), but if you live in the UK or EU you keep every statutory right you have there.

7.1 · What is collected, why, and where it goes

Your email address
Your login. It lets you in and keeps your work separate from everyone else's. Handled by Cloudflare (login check) and our own invite list.
Your name, program and year
You answer three short questions the first time you open the app. We use the answers to greet you by name and fit the app to you, and to understand who uses TheStudyFix (for example, how many students are in each program and year). Stored on our server. You can change them in Settings.
Lecture files you upload
The PDF, its page images and its text. Used to make your notes, cards and questions. Stored on our server (Fly.io, Frankfurt, EU). The pages and text are sent to Google (Gemini AI) for processing, on the paid tier under Google's data terms.
Notes, cards and questions we generate
To give them to you. Stored on our server.
Your study activity
Answers, card grades, streaks and counts. To show your progress and run the app. Stored on our server.
Voice recordings
Only if you speak an answer. Sent to Groq (United States) to be turned into text, and held on our server.
Usage and spend records
Per student, to prevent abuse and control cost.
Technical data
IP address and request logs, for security and rate limits. Held by Fly.io and Cloudflare.
Browser only
Your theme and folder choices stay in your own browser and are not sent to us.

We do not sell your data and we do not show your files to other students.

7.2 · Legal basis

Running the service you asked for (contract). Keeping it secure and stopping abuse, and understanding who uses the app from your set-up answers (legitimate interest). Anything optional, such as marketing email, only with your consent, which you can withdraw at any time. The record that you accepted the terms is kept as evidence (legitimate interest).

When something goes wrong for you in the app, such as a failed upload or a bad card, we look at that error to fix the app. We do not train any AI model on your lectures or your medical content.

7.3 · Who else handles your data

7.4 · Transfers outside your country

Google and Groq may process data outside the UK, the EU and Egypt, including in the United States. Where they do, we rely on the safeguards they offer, such as standard contractual clauses, and we send them only what the task needs.

7.5 · How long it is kept

7.6 · Cookies and browser storage

The app sets one login cookie (by Cloudflare) and keeps your theme and display choices in your browser. It uses no analytics and no advertising cookies, and loads no fonts or scripts from third parties.

7.7 · Your rights

You can ask to see your data, correct it, export it, delete it, restrict or object to how it is used, and withdraw consent. The in-app buttons for export and delete are not built yet. Until they are, email [email protected] from your account address and we will handle it by hand within 30 days, sooner if we can. You can also complain to a regulator (section 6); we would like the chance to fix it first.

7.8 · If something goes wrong

If your data is lost or exposed in a way likely to harm you, we will tell you and, where the law requires, the regulator, within 72 hours of finding out.

7.9 · Age, uploads and changes

The app is for university students aged 18 or over, invited by us. Only upload material you are allowed to use for your own study (terms, section 9.4). We will say so in the app or by email before a material change to this section applies.

7.10 · Error reports

Error reports carry a technical trace and the page called. They do not carry your lecture text, filenames or card content.

7.11 · The notes are machine-made

Output is machine-generated and may be wrong or incomplete. Each generated item carries the slide it came from so you can check it. It is not medical advice.

Contact

[email protected] — for questions, access, correction, deletion, or to unsubscribe.

Terms · Home