Skip to content
NACMATE
Start a station

Privacy policy

This policy took effect on October 7, 2026. It describes what NACMATE actually does.

Who is responsible

NACMATE is operated by Code Kubic Solutions (Company No. 2663998-P), a company registered in Malaysia, which is responsible for the personal information described here. Our privacy officer, the person in charge of protecting personal information, can be reached at hello@nacmate.com.

What we collect

  • Your account. If you sign up with an email address and a password, we hold your address, and your password only as a hash kept by our authentication provider. If you continue with Google, we receive your email address, your name and your profile picture URL from Google, and no password. If you sign up with a password, we email you a link to confirm your address, and a link to reset your password if you ask for one.
  • Your practice sessions. Which station each attempt was on and when it ran, the text of the conversation, and the feedback written from it, so you can review a session afterwards. Where you spoke a turn rather than typing it, we also store four numbers about how you said it: how many seconds it took, how many words a minute that works out at, and how many hesitations and abbreviations were in it.
  • Your credits. A ledger of every credit added to or spent from your account and why. For a purchase it records Stripe's reference for the payment. Card details go to Stripe, never to us.
  • Messages you send us. If you use the contact form or write to us, we receive your name, your address and what you wrote, by email. The form does not store your message in our database.
  • Your waitlist address, if you gave us one. While practice was still closed, a form on this site offered to tell you when it opened, and we kept the email address you typed and which page you typed it on. That form has been removed. The addresses it recorded are still held, for that one message and nothing else, and are deleted on request.

We do not run advertising trackers, we do not sell personal information, and we do not build advertising profiles. We do not ask for clinical information about you or anyone else, and we would rather you did not type any into a station: a practice session is fiction, and nothing in it needs a real patient's details.

If you continue with Google

We ask Google for your email address, your name, your profile picture and an identifier for your Google account, and nothing else. We use them to create your account, to recognize you when you come back, and to send the email the service has to send, such as a password reset. We do not receive your Google password. We do not post to your Google account, and we do not read your contacts, your calendar or your files.

NACMATE's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use that information only to sign you in and run your account. We do not use it for advertising, we do not sell it, and we do not pass it to anyone except as needed to run the service, to keep it secure, or to comply with the law. You can disconnect NACMATE at any time in your Google Account permissions, and deleting your NACMATE account removes your Google details from our records. You can use an email address and a password instead and never connect Google at all.

Recordings of your voice

A practice station can be spoken instead of typed. Your browser asks for the microphone the first time you hold the record button, and it records only while you are holding it. Never in the background, and never on any other page.

We do not store the recording. It is sent to us, turned into text, and dropped inside that same request. It is never written to our database, never written to a file, and never written to a log. What we keep is the text of what you said and the four numbers described above. Your voice is biometric information, and there is no reason for this product to hold it.

Turning speech into text is done by the same model provider that plays the simulated patient, so your recording is sent to that provider for as long as it takes them to answer. If you would rather nothing of your voice left your machine, type your turns instead. A typed station is recorded, marked and read back in exactly the same way.

When the patient and the examiner speak back to you, that is your own browser reading the text aloud. No audio of them is fetched from us or from anyone else.

Who processes it for us

  • Supabase: authentication and our database, in its Canadian region (ca-central-1).
  • Google, through the Gemini API: the language model behind four things in a station. It voices the simulated patient, but only from facts our code wrote for that station; if it tries to say something those facts do not contain, our code discards it and has the patient say the authored sentence instead. It chooses which of our fixed examiner lines applies to what you did — the examiner's own words are written by us, not by the model. It turns your speech into text. And it judges your session against the station's fixed criteria, with every quotation it cites checked by our code against the transcript before you see it. Session content and recordings are sent to Google to get a result back. We have not verified where Google processes them, so we do not tell you that they stay in Canada.
  • Google Sign-In: only if you choose to continue with Google.
  • Stripe: taking payment, once purchases are open and you buy credits.
  • Cloudflare: hosting and serving the site, receiving mail sent to our address, and Cloudflare Web Analytics.
  • Brevo: sending email, including account confirmation and password reset messages, and contact-form messages to our inbox.

Where your data lives

Account and session data is stored in Canada, in Supabase's ca-central-1 region. NACMATE is administered from Malaysia, so that data is accessed from outside Canada. The model provider, and the payment, hosting and email providers above, process what they need wherever they operate, which can include the United States and the European Union. Information processed outside Canada or Quebec is subject to the laws of the place where it is processed, and the authorities there may be able to access it.

Cookies and analytics

We use only the cookies the site needs to work: the ones that keep you signed in, set by our authentication provider when you sign in, one that remembers the site's language, and one, nacmate-theme, that remembers whether you chose the light or the dark theme. It holds that one word, lasts a year, and is read by us and by nobody else. There is no cookie banner because there are no optional cookies to ask about.

We count visits with Cloudflare Web Analytics. It does not set cookies or use your browser's storage, and Cloudflare states that it does not fingerprint visitors or follow them across sites. It tells us, as totals, which pages are visited, from which referring sites, and in which countries and browsers.

Your browser's own storage remembers a few things on your device, such as whether you muted the voices that read a station aloud and which station you have open. The one you have open is sent to our API to resume it when you come back; nothing else stored there is.

Security

Passwords are stored only as a hash, by our authentication provider, never in plain text. Traffic between your browser and the site is encrypted in transit. Station content that includes the marking scheme is kept on the server and is not sent to your browser until it is yours to see. Access to the production database is limited to the people who need it to run the service. No system is perfectly secure; if a breach of our safeguards creates a real risk of significant harm to you, we will report it to the Office of the Privacy Commissioner of Canada and tell you, as the law requires.

How long we keep it

We keep your account and everything in it, including practice sessions, transcripts, reports and your credit ledger, until your account is deleted. There is no automatic expiry.

To delete your account, write to us from the address on it. Deleting it removes your sign-in account and, with it, your profile, your credit ledger, every attempt, transcript and report, and the usage records kept for each session. We also delete your waitlist entry if you have one. This cannot be undone.

Some copies outlast that. Stripe keeps its own records of payments, as the law requires of it. Messages you exchanged with us stay in our mailbox. Cloudflare keeps request logs for up to seven days for security and debugging. Our database provider's routine backups can hold deleted data until those backups expire.

Your rights

  • You can ask for a copy of your data.
  • You can ask us to correct anything inaccurate.
  • You can ask us to delete your account and everything in it.
  • You can withdraw your consent to a use of your information, subject to legal or contractual limits, though that may mean closing your account.

Write to hello@nacmate.com from the address on your account. We answer within 30 days, and we do not charge for it.

Canadian privacy law

We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). If you believe we have mishandled your information, please write to us first; you can also complain to the Office of the Privacy Commissioner of Canada.

If you live in Quebec, we also handle your information in line with Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25. You have the rights it gives you, including access, correction, and being told when your information is processed outside Quebec, and you can complain to the Commission d'accès à l'information du Québec.

If you are in the European Union or the United Kingdom

If the GDPR or UK GDPR applies to you, we rely on performing our contract with you to run your account and your sessions, on our legitimate interest in keeping the service secure and working, and on legal obligation for payment records. You can ask us to give you, correct, delete or port your data, or to restrict or stop a use of it, and you can complain to the data protection authority where you live.

Children

NACMATE is for medical graduates and is not meant for anyone under 18. We do not knowingly hold information about children.

Changes

If we change this policy materially, we will update the date at the top of this page and say what changed.

Contact

Code Kubic Solutions (Company No. 2663998-P), a company registered in Malaysia. hello@nacmate.com.