White Coat World (“we,” “us,” or “our”) operates a pre-health admissions guidance platform. It may be licensed to academic departments in the future, to provide to their students. Students are not charged for the core features and are not shown advertising; section 3, and Section 6 of our Terms of Use, explain how we would tell you before either changed.
Where a student is affiliated with a partner institution that has signed an agreement with us, that institution is the data controller and FERPA record owner, we act as a School Official under 34 CFR § 99.31(a)(1)(i)(B) of the Family Educational Rights and Privacy Act, and we process those records as a processor on its documented instructions. That designation takes effect only through such a signed agreement. No institution has signed such an agreement yet.
Until a student’s institution has signed such an agreement, that student holds their account directly with us: they create it themselves, they upload their own records, and we hold that information as the data controller under their own consent rather than a school’s. This is a transitional arrangement rather than the destination, and while it lasts the student alone controls who sees their work — no institution can reach it without a consent the student grants and can revoke. In every case we access student education records only for legitimate educational purposes, and we never sell or license student data to third parties.
You can create an account two ways, and what we collect differs slightly.
Google sign-in: we receive your email address and display name from Google. We do not receive or store your Google password. Your Google sub identifier is immediately hashed with SHA-256 into a deterministic UUID — preventing user enumeration if our records were ever disclosed.
Email and password: we store your email address and a password. We never store the password itself. It is converted to an Argon2id hash — a one-way transformation that cannot be reversed back into your password, even by us. We cannot tell you what your password is, and we will never send it to you. You must verify your email address before your first password sign-in.
If you turn on two-factor authentication, we store the secret your authenticator app uses, encrypted at rest with AES-256-GCM under a key held outside the database. Your ten backup recovery codes are stored only as SHA-256 hashes — we can verify one you enter, but we cannot read them back or re-display them, so keep your copy.
Email-verification and password-reset links contain a single-use token. We store only a SHA-256 hash of that token, and it expires quickly (24 hours for verification, 1 hour for password reset).
When you set or change a password, we check whether it appears in the public Have I Been Pwned breach corpus. This check is designed so that your password never leaves our servers: only the first five characters of its SHA-1 digest are sent, and the service cannot determine which password was checked.
If you choose to add a phone number during onboarding, we store it and use it only for account security — recovery and one-time verification codes. It is never used for marketing, never shown to other users, and never shared with your institution. One-time codes themselves are stored as SHA-256 hashes, expire after 5 minutes, and lock out after 5 failed attempts. You can leave this blank.
You can create a link that lets someone outside White Coat World read your personal statement and leave comments — a mentor, a professor, a family member who has no account here. Because it has to work for someone with no account, the link itself is the only credential: anyone who has the URL can open it, read the full copy of your essay saved at the moment you created the link, and see the comments other reviewers have left. There is no sign-in, and we cannot tell who opened it. Treat it like a door key, and send it only to people you mean to give it to.
You choose how long a link lasts (14 days by default, 60 at most), and you can revoke it at any time. Revoking is a real deletion, not a flag: the link, the saved copy of your essay, and every comment left on it are removed together.
If you leave a comment as a reviewer, we store the name you type and, if you provide one, your email address, so the student knows who the feedback is from. That information is deleted with the link.
GPA, test scores, clinical hours, volunteer hours, research hours, shadowing hours, experience descriptions, personal statement text, letters of recommendation metadata, and target school lists. This data is used exclusively to generate your gap analysis and admissions guidance.
Transcripts and other uploaded files (PDF, JPEG, PNG, WebP; max 10 MB) are validated against their magic bytes and stored in private Supabase object storage with AES-256 encryption at rest. The file is stored as you uploaded it. For PDFs we also save the text we extract, after a scrubber has removed names, Social Security numbers, student ID numbers, email addresses and phone numbers. Text from an upload is scrubbed again before it is sent to our AI provider (section 5).
When you accept a legal agreement, we record which document and version you accepted, when, a cryptographic digest of the published document, and — at the moment of acceptance only — your IP address and browser user-agent string. This is the record that establishes an agreement was formed. See section 7 for how long it is kept and what happens to it when you delete your account.
We use PostHog for product analytics. Events (for example “report generated” or “experience saved”) are tied to a pseudonymous code, never your account identifier itself, your name or your email. The code is made from your account identifier with a secret key that only our servers hold, so it cannot be traced back to your account without that key. We do not send application content, grades, names or email addresses to PostHog.
If you have a student account: during your first week after signing up, on each day you use White Coat World while signed in, we note the date (just the date, not the pages you visit, the time or your IP address). We use it only to count, in total, how many new students come back. It is erased when you delete your account and included in your data export.
Your semester to-do list ticks an item only when White Coat World can see the step was done, so we keep a few small records for it:
These records are kept until you delete your account, erased with it, and included in your data export.
We run surveys in the app. In the future, an institution or organization you are affiliated with may also publish surveys here; none does today. Your answers, and the fact that you were invited and whether you completed it, are stored and are visible to whoever published that survey.
Most surveys are voluntary. If institutions publish surveys here in the future, an institution could mark one required, which would stay pinned in your feed until it is completed and which you could not dismiss outright. Even in a required survey you may decline any individual question. A required survey does not lock you out of the platform and does not restrict any other feature. Marking a survey required would be an institutional decision, and the institution would attest when doing so that its own IRB and FERPA policies permit it.
When you use the free exam prep tools, we store your work: which practice tests and question sets you took, the answer you gave to each question and how long you spent on it, your raw score, the questions you flagged to revisit, and your progress through lessons and flashcards. This is what lets you pick up where you left off and see where you are improving.
Separately and entirely voluntarily, you may tell us the score you actually received on a real exam. We ask because it is the only way to know whether our practice material helps. Your individual score is never published, never shown to other students, and never attached to your name in anything an institution sees — it is used only inside aggregate statistics. If you delete your account, that record is hard-deleted along with the rest of your practice history; only aggregate figures already calculated remain, and they are never reconstructed back to you.
For students, we record how long you spend on the browsing surfaces of the community layer — the feed, Pills, and Explore — as a running daily total. It exists to enforce a wellbeing limit rather than to profile you: past a daily cap those browsing surfaces are paused for the rest of the day. Nothing you actually came here to do is affected — your application work, messages, and surveys are never capped and never counted.
We keep a per-day total only. This is not sold, not shared with your institution as an individual record, and not used for advertising.
White Coat Connect is our community layer, and we store what you create in it: your posts and the photos or video attached to them, your comments and replies, your Pills (short videos) and their transcripts, your Daily Doses, anything you write in a cohort or group, and your direct messages. We also store the actions that make a feed work — likes, saves, reposts, who you follow and who follows you, who you have blocked or muted, what you reported, and the notifications generated for you. Your community profile itself is stored too: display name, username, avatar, bio, interests, and an optional location if you add one.
Direct messages are stored, not end-to-end encrypted. They are encrypted in transit and at rest, and we do not read them in the ordinary course of running the platform, but we are technically able to and will where we must — to investigate a report, to comply with a legal obligation, or to act on a safety risk. Please do not treat a message here as a private channel for anything you would not want a platform operator to be capable of seeing. Our mentoring feature closed on October 8, 2026, and no new mentoring requests can be sent. Requests made before then, the notes attached to them, and thank-you messages are stored the same way and kept until you delete your account.
We use this to operate the community — to show you a feed, deliver your messages and notifications, and enforce our Acceptable Use Policy. It is not used for advertising, never sold, and not used to train AI models. Your institution does not get a window into your posts or messages: what it can see is described in section 6. If you delete your account, all of it is hard-deleted — see section 7. Your data export includes the posts, comments, Pills and messages you wrote (only what you wrote, never what other people wrote). Section 8 lists what the export does not include.
Today there is no advertising on White Coat World, and students pay nothing for the core features. We do not load Google AdSense, advertising networks, tracking pixels, retargeting scripts, or marketing cookies, and today we do not share your personal information with advertisers or data brokers. What will not change: we never sell your personal information, and downloading your data and deleting your account will always be free. If we ever decided to show advertising, or to charge students for a core feature, we would tell you by email and in the app at least 30 days before it took effect, as Section 6 of our Terms of Use describes, so you could download your data and close your account first. The only third-party embeds anywhere on the site are video players: the introductory video on our public homepage, and the lesson videos in the Extra Terrestrial Tests classroom, which load nothing until you press play. Both are hosted on YouTube — see section 9.
We never sell student data to third parties or share it with advertisers, and we do not use it to train or fine-tune AI models. Our AI provider, Google, handles what we send under its paid Gemini API terms, which do not let it use that data to improve its products (section 5).
We built a way to study, in aggregate, whether parts of the platform (such as the Planner) help students stay on track. We are not collecting data for it: collection is switched off, and no study is running. The framework stays in place in case we run one later. If we ever do, we will update this policy and ask you to accept it before anything is collected.
Any study would use a pseudonymised extract, anything shared would be aggregate only, and deleting your account removes your records from it.
Our AI features (gap analysis, school matching, personal statement coaching, feedback on the interview practice answers you type, reading your transcript, and the other coaching tools) send the text they need to Google's Gemini API. Before it is sent, it passes through our scrubber, which removes contact details and ID numbers (and, for uploaded documents, your name), and it is length-capped.
Google handles what we send under its paid Gemini API terms. Under those terms Google does not use it to improve its products; it keeps it only to detect abuse. We do not use your data to train or fine-tune AI models ourselves.
Built so that an institution that requires it can have its students' AI requests processed by Microsoft Azure OpenAI instead of Google. It is not active today: no institution has selected it, so no data is sent to Microsoft. We list it so you know before it is ever turned on.
When a student connects White Coat World to ChatGPT, the data the student chooses to share, limited to the permissions they approve, is returned to their ChatGPT session and handled under the terms of their ChatGPT account or workspace. This connection is in early access: today it is live only for the founder's own account, and other students can connect only by joining through the early-access step.
SOC 2 Type II and ISO 27001 certified. All environment secrets are stored in Vercel's encrypted vault — no credentials are committed to source code.
SOC 2 Type II certified. PostgreSQL with AES-256 encryption at rest. Our Supabase plan does not include backups, so we make our own (see Backblaze and GitHub below).
Stores our encrypted database backups, in the United States. Backups are normally taken every night. They paused from October 19 to November 1, 2026, while the service that runs them had run out of free monthly time. Each backup is encrypted before it leaves our backup job, with a key we keep offline, so Backblaze cannot read it. We keep 7 daily and 4 weekly copies, so a copy is normally deleted within 28 days; when backups pause or fail, older copies are kept until new ones replace them. Backups cover the database only: files you upload are not backed up. Each time it runs, the backup job checks that the copy restores into a temporary database, but we have not yet practised a full recovery from one.
Runs our backup job (normally every night). For a few minutes each time it runs, GitHub's temporary build machine holds an unencrypted copy of the database while it makes and checks the backup; that machine is deleted when the job ends. GitHub also keeps a second encrypted copy of each backup for 7 days.
Faculty notification emails and account emails (verification, password reset). No student PII is included in email bodies beyond first name and the section a review was requested for; account emails carry a single-use, short-lived link.
Resend delivers our transactional email through Amazon SES (us-east-1), so SES receives the recipient address and message content of those emails.
The optional location field geocodes the text a user types through OpenStreetMap Nominatim, from their browser. Provider verification sends the entered search terms to the public CMS NPI Registry. Neither is part of the academic profile, and neither receives an account identifier.
Redis service used to enforce rate limits and cache session-revocation state. The keys it holds are derived from IP addresses, account identifiers, and — for the one-time-code limiter — phone numbers. No academic profile content, application materials, or uploaded documents are stored there, and entries expire automatically after a short window.
SMS delivery of one-time security codes is built against Twilio. It is not active today — no Twilio credentials are configured, so no text messages are sent and no phone number is transmitted to Twilio. We disclose it because turning SMS delivery on would engage Twilio as a sub-processor of your phone number, and you should know that in advance rather than after the fact.
Application error reporting. When something breaks, a report of the error (what failed, and where in the code) is sent to Sentry. Personal-information collection is turned off, and every report is scrubbed before it is sent: request contents, cookies, headers and database values are removed.
Server-side product analytics — which features are used and how often — tied to a pseudonymous account identifier rather than your name or email, as described under “Usage Analytics” above. It receives product events, never your academic content: no transcript, GPA, personal statement, experience, or advising material is sent to PostHog. It is named here as well so that this list, the Security page and our Data Processing Agreement describe exactly the same set of sub-processors.
Consulted when you set or change a password, to warn you if that password has appeared in a known public breach. Only the first five characters of the password's SHA-1 digest are sent — the password never leaves our servers, your identity is not transmitted, and the service cannot determine which password was checked.
Powers autocomplete in the optional location field in the social layer. When you type in that field, the text you type is sent from your browser to Google. It is used only for that field and is not part of your academic profile or advising workflow.
Our public marketing homepage embeds an introductory video hosted on YouTube, which loads with the page and sets Google cookies for visitors — including visitors who do not have an account.
Video lessons in the Extra Terrestrial Tests classroom are also hosted on YouTube, on signed-in pages. The lesson player does not load until you press play. A lesson you have not started is a placeholder card drawn entirely by us, with no YouTube frame, no YouTube script and no thumbnail, so opening a chapter sends Google nothing. When you press play, the video loads through youtube-nocookie.com and Google may set cookies. The only information that reaches Google is the identifier of the video you chose to watch — never your name, your practice answers, your scores, your progress, or anything else from your account. How far through a lesson you are is recorded by us, on our own servers, and is not shared with Google.
Neither embed is an advertising or tracking integration.
By default, no faculty member can see your profile. You must explicitly opt in to share your data with a specific institution. Consent is:
This section is about sharing with an institution. It is not the only way your work can leave your account: a personal-statement review link is a separate choice you make yourself, it is not institution-scoped, and it does not require the reader to have an account or to sign in. See “Personal Statement Review Links” in section 2.
| Data Type | Retention Period | Disposal Method |
|---|---|---|
| Academic profile, experiences, schools | Until account deletion | Hard delete on erasure request |
| AI gap analysis reports | Until account deletion | Hard delete on erasure request |
| Uploaded documents (transcripts) | Until account deletion | Hard delete from object storage |
| Practice test attempts, individual answers, and study progress | Until account deletion | Hard delete on erasure request |
| Self-reported real exam scores (voluntary) | Until account deletion | Individual record hard-deleted on erasure; only aggregate statistics already calculated remain, and the aggregate is never reconstructed back to an individual |
| Application plan (Planner) — terms, planned courses, milestones, notes, and the saved history of your edits | Until account deletion | Hard delete on erasure request; included in your data export |
| Semester To-Do List records — coaching runs (time and draft length only, never text), school pages you opened, classes you added, and when each item was first done | Until account deletion (a class, until you remove it) | Hard delete on erasure request; included in your data export |
| First-week visit dates (the date only, days 1 to 7 after signup) | Until account deletion | Hard delete on erasure request; included in your data export |
| Faculty comments and personal-statement annotations about you | Until account deletion, or 30 days after the faculty member deletes one | Deleted comments and annotations are hard-deleted by the nightly purge; the rest are hard-deleted on erasure request |
| Personal-statement review links — the saved copy of your essay, plus each external reviewer’s name and optional email | Until the link expires (14 days by default, 60 maximum), you revoke it, or your account is deleted | Revoking hard-deletes the link, the saved essay copy, and every comment on it together; anyone holding the URL can read it until then |
| Community content — posts, comments, Pills and their transcripts, Daily Doses, cohort and group messages, and uploaded photos and video | Until account deletion | Hard deleted on erasure request, including the underlying files in object storage |
| Direct messages, and the conversations they belong to | Until account deletion | Hard deleted on erasure request. Stored, not end-to-end encrypted — see section 2 |
| Community engagement and graph — likes, saves, reposts, views, follows, blocks, mutes, reports, notifications, and your community profile | Until account deletion | Hard deleted on erasure request |
| Mentoring requests, the note attached to them, and thank-you messages, from before the mentoring feature closed on October 8, 2026 | Until account deletion | No new ones can be created; existing records are hard deleted on erasure request |
| Soft-deleted records (experiences, reports) | 30 days after soft-delete | Automatic purge via cron |
| Audit log entries | 1 year | Automated rolling deletion after 12 months |
| Legal acceptance record (which document, which version, when, digest of the published document) | Retained after account deletion | IP address and browser details erased on deletion; the acceptance itself is retained as proof that an agreement was formed |
| Account-closure audit entry (account identifier + closure timestamp) | 1 year after deletion | Automated rolling deletion after 12 months |
| Encrypted database backups (made by us, normally every night, stored with Backblaze) | Normally up to 28 days (7 daily and 4 weekly copies); longer when backups pause, because older copies are kept until new ones replace them | Deleted records leave the backups as they age out; backups are never restored to bring back a deleted account |
| Verifying supervisor’s IP address (hour verification only) | Until you delete the experience or your account | Recorded only when a supervisor confirms your hours, to detect self-verification; deleted with the experience record |
| Acceptance stats you choose to contribute (stored without your name, linked to your account by a one-way code) | Until account deletion | Hard delete on erasure request; included in your data export |
| Unsaved Planner draft (in your browser, on your own device) | Until you save, sign out, or delete your account | Removed from the browser by the app; not sent to us until you save — see section 9 |
| Session tokens (JWT) | 7 days | Expire automatically; revoked early on password reset or 2FA change |
| Password hash, 2FA secret, recovery codes | Until account deletion | Hard delete on erasure request |
| Phone number (if provided) | Until removed or account deletion | Hard delete on erasure request |
| One-time codes (email, password reset, SMS) | 1–24 hours depending on type | Stored hashed; expire and are purged automatically |
What survives deletion, and why. Two records outlive your account, and we would rather name them than let you discover them: the acceptance record described in section 2, and a single audit entry noting that an account with your identifier was closed and when. Neither contains your academic work, your writing, your documents, your credentials, or your contact details. We keep the first because obligations in the Terms survive termination and a record of agreement is worthless if it vanishes the moment a dispute becomes likely; we keep the second because an institution auditing us needs to be able to see that a deletion actually happened. The closure entry is purged on the normal one-year audit-log schedule.
Backups are a lag, not an exception. Deletion removes your data from our own databases immediately. Our product analytics provider, PostHog, holds only a pseudonymous code made from your account identifier (see “Usage Analytics” in section 2) and usage events (never your name, email or application content); deletion tells it to erase them, and it does so in a weekly batch, so they are gone within about a week. Our encrypted database backups still contain a copy until they age out, normally within 28 days (longer when backups pause or fail, as they did from October 19 to November 1, 2026, because older copies are kept until new ones replace them), after which no copy remains anywhere. We never restore a backup to bring back a deleted account, and nobody queries backups to answer a question about you. We name this because “deleted instantly and everywhere” would not be true, and a school's privacy reviewer will ask.
Inside the application we set only strictly necessary cookies: a session cookie for authentication (HttpOnly, Secure, SameSite=Lax), a CSRF-protection cookie for the sign-in flow, and a small number of cookies that remember interface preferences. Our product analytics (PostHog) runs entirely server-side — there is no in-browser analytics script, so no analytics cookie is set on your device.
Unsaved Planner changes. While you edit your Planner, a draft of the changes you have not saved yet is kept in your browser's storage on that device, so it can be recovered if the page closes before you save. It is removed when you save, when you sign out, and when you delete your account. Until you save, it stays on your device and is not sent to us.
Two exceptions, both YouTube video players. The introductory video on our public marketing homepage loads with the page and sets Google cookies for anyone who visits it. Lesson videos in the Extra Terrestrial Tests classroom sit on signed-in pages, but load nothing until you press play — if you never press play, no YouTube cookie is ever set on a signed-in page. Beyond those two players, no advertising cookies, tracking pixels, or third-party marketing scripts are loaded anywhere on the site. See our Cookie Policy for the full breakdown.
We may update this policy to reflect changes in our practices or legal requirements. This policy is versioned, and material changes require you to accept the updated version in the app before continuing to use the Platform. For minor, non-material changes, continued use after the effective date constitutes acceptance.
Privacy questions, data export requests, or institutional Data Processing Agreement inquiries: our contact form or privacy@whitecoatworld.org
Security vulnerability reports: our contact form or security@whitecoatworld.org
Institutional Partners
If you represent a university and need a HECVAT questionnaire (in preparation), a Data Processing Agreement (DPA), or a FERPA addendum, please use our contact form or write to security@whitecoatworld.org. See also our Security & Data Privacy statement.