Privacy Policy
Last updated: 26 August 2026 · Applies to the MedUp mobile app and medup.com.ng
The short version. We collect the minimum we need to give you an account, show you the right curriculum, and keep your progress safe across devices. We do not sell your data, we do not run advertising, and we do not build advertising profiles from your study activity. You can ask us to delete your account and everything in it at any time by emailing support@medup.com.ng.
1. Who we are
MedUp ("MedUp", "we", "us", "our") provides a mobile application and website that help
students in Nigeria revise for medical and allied health examinations. This policy
explains what personal data we handle when you use the MedUp app (Google Play package
com.maxetech.medup) or visit medup.com.ng.
For the purposes of the Nigeria Data Protection Act 2023 (NDPA), MedUp is the data controller for the personal data described below. If you are outside Nigeria, we handle your data in line with this policy and applicable local law.
You can reach us about anything in this policy at support@medup.com.ng.
2. What we collect
We collect only what the app needs to function. We do not ask for health data about you or anyone else.
2.1 Information you give us
| Data | Where it comes from | Why we need it |
|---|---|---|
| Email address | Sign-up, or your Google account if you use Google Sign-In | To create and secure your account, and to reach you about your account |
| Display name | You, during onboarding | To personalise the app and to label you on leaderboards |
| University, programme and level (year of study) | You, during onboarding | To show you the correct curriculum for your school and year |
| Registered units | You, when you register the units you are taking | To scope everything you browse and practise to your own syllabus |
| Study goals | You, when you set a goal | To build your daily plan and track whether you are on course |
| Support correspondence | You, when you email us | To answer you and keep a record of the issue |
2.2 Information created as you use the app
- Practice activity — the questions you were served, the options you selected, whether each was correct, and how long you took.
- Flashcard reviews — how you graded each card and the review schedule that follows from it.
- Mastery and progress — your level per lesson, unit and course, your streak, your points and any badges you earn.
- Mastery Challenge attempts — the result of each challenge test.
This record is append-only: past attempts are written once and never edited afterwards. It is what makes your progress reliable and lets your work sync without conflicts between devices.
2.3 Technical information
- Device and app information — app version, operating system version and device model, used for diagnostics and to fix crashes.
- Push notification token — an anonymous device identifier issued by our notifications provider, only if you allow notifications.
- Purchase and entitlement records — if you subscribe, a record that a valid purchase exists and when your access expires.
We do not collect your contacts, your photos, your precise location, your call or SMS logs, or your browsing activity in other apps.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis under the NDPA |
|---|---|
| Creating your account, authenticating you and keeping it secure | Performance of a contract with you |
| Delivering the curriculum, practice sessions and flashcards you asked for | Performance of a contract with you |
| Storing and syncing your progress across your devices | Performance of a contract with you |
| Showing leaderboards and awarding badges | Performance of a contract; you can opt out of leaderboards in Settings |
| Sending study reminders and notifications | Your consent, which you can withdraw at any time |
| Verifying subscriptions and preventing fraudulent access | Performance of a contract; our legitimate interest in protecting the service |
| Diagnosing crashes and improving the app | Our legitimate interest in a service that works |
| Understanding, in aggregate, which topics students find hardest | Our legitimate interest in improving the question bank |
| Complying with law and responding to lawful requests | Legal obligation |
We do not use your personal data for advertising, we do not sell it, and we do not share it with data brokers.
4. Data stored on your device
MedUp is offline-first. A copy of the content you have access to, together with your own progress, is stored in a database inside the app's private storage on your phone. That local copy is what the app reads from, which is why it works with no network.
Data held on your device is protected by your operating system's app sandbox. Deleting the app removes the local copy. It does not delete your account on our servers — see Your rights for that.
5. Who we share data with
We share personal data only with service providers who process it on our behalf, under contract, and only for the purposes below.
| Provider | What it handles |
|---|---|
| Supabase (hosting, database and authentication) | Your account, profile, registrations, goals and progress records |
| Google — Google Sign-In | Verifying your identity if you choose to sign in with Google. Google shares your email address and name with us; we do not receive your Google password. |
| Google Play Billing | Processing any subscription payment. Google handles the payment itself — we never see or store your card or bank details. |
| OneSignal | Delivering push notifications, if you have allowed them. Receives a device token, not your study content. |
We may also disclose personal data where we are required to by law, by a court, or by a competent regulator, and where necessary to establish, exercise or defend legal claims.
If MedUp is ever involved in a merger, acquisition or sale of assets, your data may be transferred as part of that transaction. We will tell you before it happens and before your data becomes subject to a different privacy policy.
Leaderboards. If you take part, other students may see your display name, your points and your rank. Nothing else about you is shown. You can leave the leaderboard at any time in Settings, or change the name you are shown under.
6. Where your data is stored
Our infrastructure providers operate data centres outside Nigeria, so your personal data may be stored and processed abroad. Where that happens we rely on the transfer provisions of the NDPA and on contractual protections with our providers requiring them to protect your data to a standard consistent with this policy.
7. How long we keep it
- Account and profile data — for as long as your account is open.
- Practice history, mastery and goals — for as long as your account is open, because this is what your progress is made of.
- Purchase and entitlement records — for as long as required for accounting, tax and dispute-resolution purposes.
- Support emails — for up to 24 months after the issue is closed.
When you delete your account we delete or irreversibly anonymise your personal data within 30 days, except where we are legally required to keep certain records for longer. Anonymised, aggregated statistics that cannot identify you — for example "68% of students get this question wrong" — may be retained indefinitely to improve the question bank.
8. Your rights
Under the NDPA you have the right to:
- Access the personal data we hold about you, and receive a copy of it.
- Rectify data that is inaccurate or incomplete — most of this you can do yourself in Settings.
- Erase your data, by deleting your account.
- Restrict or object to certain processing, including anything based on our legitimate interests.
- Portability — receive your data in a structured, commonly used, machine-readable format.
- Withdraw consent at any time where we rely on it, such as for notifications. Withdrawing consent does not affect processing carried out before you withdrew it.
- Lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe we have mishandled your data.
To exercise any of these, email support@medup.com.ng from the address on your account. We will respond within 30 days. We may need to verify your identity first, and we will not charge you for a reasonable request.
Deleting your account
You can request deletion in the app under Settings → Account, or by emailing support@medup.com.ng with the subject line "Delete my account". Deletion is permanent: your progress, streak, badges and history cannot be recovered afterwards. An active subscription must be cancelled separately in Google Play — deleting your MedUp account does not cancel it.
9. How we protect your data
- All traffic between the app and our servers is encrypted in transit using TLS.
- Data at rest is encrypted by our hosting provider.
- Database access is governed by row-level security policies, so an account can only ever read its own records.
- We never store passwords ourselves; authentication is handled by our provider, and passwords are stored only as salted hashes.
- Access to production systems is limited to the people who need it.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the NDPC and affected users as required by the NDPA.
10. Children and young users
MedUp is intended for students in tertiary education and is not directed at children under 13. If we learn that we have collected personal data from a child under 13 without appropriate consent, we will delete it. If you believe a child has given us data, contact support@medup.com.ng.
11. Notifications
With your permission, MedUp sends study reminders. Most of these are scheduled on your device from a plan the app has already worked out, and are delivered without contacting our servers. Some are delivered as push notifications through OneSignal.
You can turn reminders off inside MedUp under Settings → Notifications, or revoke notification permission entirely in your phone's system settings. We will still send you essential service emails about your account or a security issue.
12. This website
medup.com.ng is a static informational site. It sets no advertising or tracking cookies and embeds no third-party trackers. Our hosting provider keeps standard server logs — including IP address, request time, page requested and user agent — for security and troubleshooting, retained for a short period and not used to profile you.
Clicking through to Google Play takes you to a Google-operated page governed by Google's privacy policy, not this one.
13. Changes to this policy
We may update this policy as the app changes or the law does. The "Last updated" date at the top always reflects the current version. If a change materially affects your rights or how we use your data, we will tell you in the app or by email before it takes effect. Continuing to use MedUp after a change takes effect means you accept the updated policy.
14. Contact us
Questions, requests or complaints about privacy at MedUp:
- Email: support@medup.com.ng
- Web: medup.com.ng
If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission (NDPC).
See also our Terms of Use.