๐Ÿ”’ Legal

Privacy Policy

Last Updated: November 2024  ยท  Effective Date: January 1, 2024

OREONS ("we," "us," or "our") operates the website at oreons.pk and the web application at oreonslms.web.app (collectively, the "Platform"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Platform.

By accessing or using OREONS, you agree to the collection and use of information in accordance with this policy. If you do not agree to the terms of this Privacy Policy, please do not use our Platform.

1. Information We Collect

1.1 Information You Provide

  • Account Information: When you register, we collect your name, email address, password (stored as a hash), year of study, and medical institution.
  • Profile Information: University/college name, expected exam dates, and study preferences you choose to provide.
  • Payment Information: Billing name, address, and payment method details. Card details are processed directly by Stripe and are never stored on our servers.
  • Communications: Messages you send us via contact forms, support emails, or in-app chat.

1.2 Information Collected Automatically

  • Usage Data: Questions answered, time spent studying, accuracy rates, topics accessed, features used, and study streaks.
  • Device Information: Browser type, operating system, device type, screen resolution, and IP address.
  • Log Data: Server logs including timestamps, pages visited, and errors encountered.
  • Performance Analytics: Anonymised performance metrics to improve the Platform.

2. How We Use Your Information

We use the information we collect to:

  • Provide, personalise, and improve the OREONS Platform and its AI-driven features
  • Process your subscription payments and manage your account
  • Generate your adaptive study plans and performance analytics
  • Send you service updates, security alerts, and support communications
  • Send marketing communications (with your consent, which you can withdraw at any time)
  • Monitor and analyse usage trends to improve user experience
  • Detect and prevent fraudulent activity and ensure platform security
  • Comply with legal obligations and enforce our Terms of Service

3. Information Sharing

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following limited circumstances:

  • Service Providers: Trusted third-party vendors who assist in operating our Platform (e.g., Google Firebase for hosting and database, Stripe for payments, Resend for transactional emails). These parties are contractually bound to protect your data.
  • Legal Requirements: If required to do so by law, regulation, or valid legal process (e.g., court order).
  • Business Transfers: In the event of a merger, acquisition, or sale of all or part of our assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our Platform before your data is transferred.
  • Aggregated Data: We may share aggregated, anonymised data (e.g., "70% of students who studied Anatomy for 8+ weeks improved their scores by 30%") that does not personally identify any individual.

4. Data Storage & Security

Your data is stored on Google Firebase (Firestore) servers, which provide industry-standard encryption at rest (AES-256) and in transit (TLS 1.3). Firebase is certified under ISO 27001, SOC 2, and SOC 3.

We implement security measures including:

  • Encrypted password storage using bcrypt hashing
  • Firebase Security Rules to enforce granular access control
  • Regular security audits and vulnerability assessments
  • Multi-factor authentication for administrative access

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

We retain your data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law.

5. Cookies & Tracking

We use cookies and similar tracking technologies to enhance your experience on our Platform:

  • Essential Cookies: Required for the Platform to function (e.g., authentication session tokens). Cannot be disabled.
  • Analytics Cookies: Used to understand how visitors interact with our Platform (via Google Analytics 4, with IP anonymisation enabled). You can opt out via your browser settings.
  • Preference Cookies: Store your settings such as dark/light mode preference.

You can instruct your browser to refuse all cookies or indicate when a cookie is being sent. However, some features of the Platform may not function properly without cookies.

6. Third-Party Services

Our Platform integrates with the following third-party services, each with their own privacy policies:

7. Your Rights & Choices

Depending on your location, you may have the following rights regarding your personal data:

  • Access: Request a copy of the personal data we hold about you.
  • Rectification: Request correction of inaccurate or incomplete data.
  • Erasure: Request deletion of your personal data ("right to be forgotten").
  • Portability: Request your data in a machine-readable format.
  • Objection: Object to processing your data for direct marketing purposes.
  • Withdrawal: Withdraw consent for processing where consent is the legal basis.

To exercise any of these rights, email us at privacy@oreons.pk. We will respond within 30 days.

8. Children's Privacy

OREONS is intended for users who are 16 years of age or older. We do not knowingly collect personal information from children under 16. If you believe we have inadvertently collected such data, please contact us immediately at privacy@oreons.pk and we will delete it.

9. International Data Transfers

Your information may be transferred to and processed in countries other than Pakistan, including the United States (where Google Firebase servers operate). We ensure that all such transfers comply with applicable data protection laws and that appropriate safeguards are in place (Standard Contractual Clauses or equivalent mechanisms).

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

  • Posting the new Privacy Policy on this page with an updated "Last Updated" date
  • Sending an email notification to your registered email address
  • Displaying a prominent notice on our Platform

Your continued use of the Platform after changes are posted constitutes your acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: