Privacy policy

This platform is the learning site of SMIT Academy, which prepares Sri Lankan students for university entry in Italy. The academy decides what is stored here and is the one to contact about it, at info@studymedicineitaly.com.

Accounts are created by the academy for enrolled students and for its own staff. There is no public sign-up, and the site is not open to anyone else.

The academy has offices in Sri Lanka and in Italy. [SMIT Academy to confirm: which office is the data controller, and whether the Italian office brings the platform under the GDPR]

• Name and contact: first and last name, one email address, and optionally a phone number.
• Student number and the batch (intake) the student belongs to.
• Parent or guardian details, when the academy records them: name, relationship, and optionally an email address and phone number. These come from the student or the family at enrolment.
• A profile photo, if one is uploaded.

• Quiz and practice attempts: the questions seen, the answers chosen, the marks, and how long was spent.
• Questions answered wrongly, which form the revision list, and bookmarked questions.
• Flashcard reviews and how each card is scheduled.
• Which pages of a note were read, and how far through it the student is.
• Experience points, daily activity, streaks, badges, and the weekly leaderboard position.
• The time spent reading a note, as well as how far through it the student is.
• The time the student was last active, and the alerts sent to them.
• Devices allowed to receive push alerts, until push is turned off or the device stops responding.

When live classes are switched on, the platform will also record whether a student joined a class and how much of it they watched. That is not running yet.

Some records were brought across from the academy’s previous platform when this one replaced it, and keep a reference to where they came from.

This is the record of a student’s own learning. Teaching staff at the academy can see it, which is the point of the platform: it is how progress is followed and help is offered.

Today a student sees only their own record: there is no leaderboard and no classmate profile in the platform yet.

When the leaderboard is switched on, students in the same batch will see each other’s name, photo, experience points and badges, and nothing else: not an email address, a student number, marks, attempts or attendance.

A password is stored as a bcrypt hash, which cannot be read back. For student accounts only, the password is also kept in an encrypted form, so an administrator can look it up and tell a student who has forgotten it. Every such look-up is written to the academy’s staff activity log, with the administrator, the time and the network address they used. Staff passwords are never stored this way.

Continue with Google is optional. The platform asks Google for one thing: the email address Google has verified. That address is matched against an existing account. No account is ever created from Google, nothing else is read from a Google account, and nothing from Google is stored. A student can always use their email and password instead.

Signing in sets the few cookies needed to sign in and stay signed in. The session lasts seven days from the last time it was used, so an account in regular use is not signed out every week. There are no advertising or tracking cookies, and no third-party analytics.

The academy does not sell data and does not share it for advertising. It is handled by the services that run the platform, and by nobody else:

• MongoDB Atlas — the database holding the records above.
• Cloudflare R2 — files: notes as PDFs, images inside questions and flashcards, and profile photos. Files are private and reachable only through a signed link that expires.
• Google — only when a person chooses Continue with Google.
• The push service of the student’s own browser (Google, Apple, Mozilla or Microsoft), which carries an alert to the device. It receives the alert text, not the learning record.

Not yet in use, but planned: an email service, for the messages the platform will send; Zoom, for live classes and the recording afterwards copied into the academy’s own storage; and an automated service that reads marked answer sheets. This policy will name them when they are switched on.

The academy will also hand over data where the law requires it. [SMIT Academy to confirm: where the servers are located, and whether data leaves Sri Lanka or the EU]

• Alerts are deleted automatically after 60 days.
• The feed of a student's daily achievements keeps 90 days.
• The staff activity log, which records what administrators did, is kept for as long as the academy needs it, so that a question about an account can always be answered.
• Everything else is kept while the student is enrolled.
• When a student leaves, the account is archived: they can no longer sign in, and their email address becomes free for a new account. The learning record is kept, so the academy can still answer questions about past results, and the account can be brought back if the student returns.

[SMIT Academy to confirm: how long an archived student’s record is kept before it is deleted]

Write to info@studymedicineitaly.com to ask what is held about you, to have it corrected, or to ask for it to be deleted. A student can change their own profile photo in the app; the rest is changed by the academy, so that student numbers and batches stay reliable. Deleting a record may mean the academy can no longer show past results or issue confirmations.

[SMIT Academy to confirm: how quickly the academy answers such a request, and the authority a student may complain to]

Some students are under 18. Their accounts are created by the academy at enrolment, with the family’s knowledge, and the parent details above come from that enrolment. A parent has no login of their own.

When this policy changes, the date at the top changes with it. The current version is always on this page, beside the terms of service.