Privacy Policy

Plain-language summary

This summary is a quick orientation — it does not replace the full policy below.

• You can browse public pages without an account. To save opportunities, track applications, or chat with Prometheus, you create an account.
• We collect the profile and activity information you provide, plus basic technical and log information needed to run and secure the service.
• We use your information to run the platform, personalize opportunity recommendations, power Prometheus, send messages you ask for, and keep the service secure.
• We share information only with the service providers that operate the platform (like hosting, database, email, and AI). We do not sell your personal data or share it for targeted advertising.
• You can edit your profile, delete your account with a 14-day recovery window, opt out of non-essential emails, and contact us about your data.
• PrometheanMed is intended for students 13 and older and for use in the United States.

1. Introduction & scope

PrometheanMed ("PrometheanMed," "we," "us," or "our") is the name used for this platform and its related services. This Privacy Policy describes how we handle information in connection with the PrometheanMed website at prometheanmed.org, the accounts and features available there, our Prometheus AI assistant, and the emails and support communications we send.

This policy covers information handled through those services. It does not cover third-party websites (for example, the external organization pages that opportunity listings link to), which have their own privacy practices.

2. Information we collect

We collect information you provide, information generated as you use the platform, information we receive from your chosen sign-in provider, and limited technical information collected automatically.

Account & authentication information. When you create an account, we store your email address and (for email sign-up) a password managed by our authentication provider. If you sign in with Google, we receive the basic profile information Google shares during sign-in (such as your name and email address). We do not receive your Google password.

Profile information you provide. You may add a display name and academic and interest details to personalize recommendations, including: education level, graduation year, school name, major or academic track, GPA (and target GPA range), coursework, subjects you want to strengthen, skills, research and clinical interests, career goals, MCAT timeline, availability, and logged research/volunteer hours. You may also provide location and distance preferences — city, state, ZIP code, and a search radius — used to find nearby opportunities.

We do not ask for your date of birth or exact age. Age-related eligibility is based only on the education level and graduation year you choose to provide.

Saved opportunities, tracker, and personal records. When you save an opportunity, track an application (status, notes, deadlines, follow-up reminders), log clinical or volunteer hours, record outreach contacts, or add your own private (“manual”) opportunities and deadlines, we store those records in your account.

Prometheus AI conversations. Messages you send to Prometheus, and the assistant’s replies, are stored so you can revisit your conversations. This can include any images you attach. See Section 4 for how AI processing works.

Support & feedback. If you contact us through the Contact & Feedback form, we receive your name, email address, category, subject, and message. Please do not submit medical records, government ID numbers, payment card numbers, passwords, or other highly sensitive information through the form or to Prometheus.

Notification preferences. Your reminder timing, time zone, and email opt-in settings are stored with your profile.

Automatically collected technical & log information. Like most websites, our hosting and infrastructure providers automatically record standard log and diagnostic information when you use the service — for example IP address, browser and device type, pages/actions, timestamps, and referring URL — used for security, debugging, and reliability.

Cookies & local storage. We use functional cookies and browser storage that are required for the platform to work — chiefly to keep you signed in and remember interface preferences (such as reminder settings and whether a sidebar is open). Our hosting and database providers may also set functional session, performance, or security cookies. We do not use third-party advertising cookies, and we do not run any third-party analytics or tracking product.

Email-delivery information. To send account and reminder emails reliably, we keep a limited delivery log (recipient address, message type, status). If you join a waitlist, we store the email and any name/referral source you provide.

Payment information. We do not collect or process payments. PrometheanMed is currently free to use and there is no payment processor connected to the platform. If a paid tier launches, this policy will be updated first.

3. How we use information

We use information for these specific purposes:

• Create and authenticate your account.
• Store and display your profile, saved opportunities, tracker, logged hours, notes, and personal opportunities.
• Personalize opportunity recommendations and match labels from your profile.
• Power Prometheus AI responses using relevant profile context.
• Send deadline reminders and match updates you have opted into, and account/security emails.
• Respond to your support requests and feedback.
• Detect, prevent, and investigate fraud, abuse, and security incidents.
• Debug, maintain, and improve reliability of the platform.
• Comply with legal obligations and enforce our Terms of Service.

We do not process your personal information for unrelated purposes, and we do not use it for targeted advertising.

4. AI processing (Prometheus)

Prometheus is powered by a third-party AI provider (Anthropic’s Claude API). When you chat with Prometheus, we send that provider a set of instructions plus your conversation. The instructions include limited profile context to personalize answers — currently your display name, career goals, research interests, clinical interests, and the academic details saved in your profile — along with the messages (and any images) in the conversation.

• Your conversations are stored in your account so you can revisit them, and are deleted when you delete a conversation or your account.
• We do not send your PrometheanMed account identifier to the AI provider, and we do not attach advertising or tracking metadata to AI requests.
• We do not use your conversations to train AI models ourselves. The AI provider processes content under its own terms; whether it may retain content is governed by our agreement with that provider and is under review (see below).
• You control what you share: you can reduce the personal detail in your profile and avoid typing sensitive information into chats.
• AI output can be inaccurate, incomplete, or outdated. Always review it before relying on it.

5. Opportunity & matching data

When personalization is turned on, we compare your profile (interests, specialties, skills, coursework, education level, and location preferences) against opportunity listings to rank results and show match labels such as “Matches your interests.” This comparison uses fixed rules — not AI — and produces recommendations only.

• Match labels are recommendations, not eligibility decisions or predictions of acceptance.
• Missing or incomplete profile information can make results less certain.
• You should always verify eligibility and details with the official organization before applying.

See the Match-Score Disclosure and Opportunity Information Disclaimer.

6. Sharing & service providers

We share information with a limited set of service providers that operate PrometheanMed on our behalf. Each receives only the information needed for its function, and only to provide the service to you.

• Supabase — Database, authentication, and account storage.
• Vercel — Website hosting and serverless compute; requests pass through Vercel's network.
• Resend — Transactional email delivery (verification, reminders, account notices).
• Anthropic — AI inference for Prometheus (Claude API) and for extracting public opportunity listings.
• Google — Google OAuth sign-in (via Supabase Auth), when you choose to use it.
• n8n — Backend automation and internal error/monitoring forwarding operated for PrometheanMed.

We may also disclose information when required by law, to protect the rights, safety, and security of users and the platform, or in connection with a business transfer, in which case we will continue to protect information consistent with this policy.

Sending information to the processors above is necessary to run the service and is different from selling it. We do not sell your personal data, and we do not share it for targeted or cross-context behavioral advertising.

7. Data retention & deletion

We keep information for different periods depending on its purpose:

• Active-account data. Kept while your account is active so the features work across your devices.
• Saved opportunities, tracker, hours, notes, personal opportunities, and AI conversations. Kept until you delete the specific item or your account.
• Account deletion & recovery. When you request deletion, your account enters a 14-day recovery window before it is permanently removed. During that window app access is paused and you can restore the account.
• Support & email records. Support messages and email-delivery logs are retained as operational records; when you delete your account, personal identifiers in these are removed (anonymized).
• Security & fraud-prevention logs. Kept as needed for security and to meet legal obligations.
• Backups. Deleted data may remain in routine, encrypted backups for a limited period until those backups are cycled and overwritten.
• De-identified / aggregated data. Information that no longer identifies you may be kept to understand and improve the service.

8. Security

We use reasonable technical and organizational measures to protect information, including encrypted connections (HTTPS) in transit, authentication and access controls, and row-level access restrictions so your account data is scoped to you. We limit administrative access and design the platform so that highly sensitive credentials are not exposed to your browser.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account has been compromised, contact us right away through our Contact & Feedback form.

9. Your rights & choices

You can exercise these choices directly in the product or by contacting us:

• Access & review. See your account details and profile any time in your profile and settings.
• Correct. Edit your profile information from the profile and settings pages.
• Delete your account. Start deletion from Settings → Delete account (email-verified, with a 14-day recovery window).
• Restore. Recover a scheduled deletion any time during the 14-day window, from the app or the recovery link we email you.
• Request a copy of your data. Ask us through the Contact & Feedback form and we will help you obtain a copy of your account information.
• Manage notifications. Turn deadline reminders and match updates on or off in Settings → Notifications.
• Unsubscribe from non-essential email. Opt out of reminder/update emails; we may still send essential account and security messages.
• Ask privacy questions. Use the Contact & Feedback form for any privacy request or question.

These controls are available to all users as platform features. Depending on where you live, you may also have additional legal privacy rights (see Section 11). To make any request — including access, correction, deletion, or, where the law provides one, an appeal of a denied request — use our Contact & Feedback form. We only describe processes the product can actually perform, and we verify requests against your signed-in account or the email address on file before acting.

10. Children & minors

PrometheanMed is designed for high-school and early-college students, so many of our users are minors. The service is intended for users who are at least 13 years old. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact us and we will remove it.

If you are under 18, we encourage you to involve a parent or guardian in your use of the platform, and to review this policy with them. A parent or guardian who has questions, wants to review or delete their child’s information, or wants to raise a concern can contact us through our Contact & Feedback form. We handle deletion requests involving minors through the same verified deletion and recovery process described in the Data Retention & Deletion Policy.

At registration we ask you to confirm that you are at least 13 years old. We collect only the information needed to provide the service and do not require your date of birth or identity documents. We do not knowingly use minors’ information for targeted advertising, and we do not sell it.

If we learn a user is under 13. If PrometheanMed obtains actual knowledge that an account holder is under 13, we restrict further processing of that account, stop non-essential communications, and delete the account and its personal data, keeping only the minimum record needed to handle the matter. We do not require a child to provide extra identity documents to have their information removed.

11. State & regional disclosures

Some U.S. states give residents specific privacy rights. Which laws apply to PrometheanMed depends on where our users are, the operator’s location, our data practices, and the scale of the service — this is being assessed. Rather than copy in state-specific sections the product cannot yet fully honor, we describe here what we actually do:

• We do not sell personal data and do not share it for targeted advertising.
• We honor the access, correction, and deletion choices described in Section 9 for all users.
• We do not use automated decision-making to make legal or similarly significant decisions about you; match labels are recommendations only.

If you are a resident of a state with a consumer-privacy law and want to exercise a right, use our Contact & Feedback form and we will respond consistent with applicable law.

12. International users

PrometheanMed is intended for use in the United States and is not directed to individuals outside the U.S. If you access the platform from another country, you are responsible for compliance with your local laws, and you understand your information will be processed in the United States. We have not implemented mechanisms specific to non-U.S. privacy regimes (such as the EU/UK GDPR); broader international availability would require a separate privacy review.

13. Changes & contact

We may update this Privacy Policy. When we make material changes, we will update the effective and last-updated dates and the version at the top of this page, and we may provide additional notice (for example, in the product or by email) where appropriate. The current version is 2026-07-04.

To ask a question or exercise a data right, use our Contact & Feedback form — the primary way to reach the PrometheanMed team. Requests are received by our team and verified against your account before we act.