White Coat World (“we,” “us,” or “our”) operates a pre-health admissions guidance platform. We act as a School Official as defined in 34 CFR § 99.31(a)(1)(i)(B) of the Family Educational Rights and Privacy Act (FERPA), meaning we access student education records only for legitimate educational purposes and never sell or license student data to third parties. Where a student is affiliated with a partner institution, that institution is the data controller and FERPA record owner; we process those records as a processor on its documented instructions.
You can create an account two ways, and what we collect differs slightly.
Google sign-in: we receive your email address and display name from Google. We do not receive or store your Google password. Your Google sub identifier is immediately hashed with SHA-256 into a deterministic UUID — preventing user enumeration if our records were ever disclosed.
Email and password: we store your email address and a password. We never store the password itself. It is converted to an Argon2id hash — a one-way transformation that cannot be reversed back into your password, even by us. We cannot tell you what your password is, and we will never send it to you. You must verify your email address before your first password sign-in.
If you turn on two-factor authentication, we store the secret your authenticator app uses, encrypted at rest with AES-256-GCM under a key held outside the database. Your ten backup recovery codes are stored only as SHA-256 hashes — we can verify one you enter, but we cannot read them back or re-display them, so keep your copy.
Email-verification and password-reset links contain a single-use token. We store only a SHA-256 hash of that token, and it expires quickly (24 hours for verification, 1 hour for password reset).
When you set or change a password, we check whether it appears in the public Have I Been Pwned breach corpus. This check is designed so that your password never leaves our servers: only the first five characters of its SHA-1 digest are sent, and the service cannot determine which password was checked.
If you choose to add a phone number during onboarding, we store it and use it only for account security — recovery and one-time verification codes. It is never used for marketing, never shown to other users, and never shared with your institution. One-time codes themselves are stored as SHA-256 hashes, expire after 5 minutes, and lock out after 5 failed attempts. You can leave this blank.
GPA, test scores, clinical hours, volunteer hours, research hours, shadowing hours, experience descriptions, personal statement text, letters of recommendation metadata, and target school lists. This data is used exclusively to generate your gap analysis and admissions guidance.
Transcripts and other uploaded files (PDF, JPEG, PNG, WebP; max 10 MB) are validated against their magic bytes, passed through a PII scrubber that strips names, SSNs, student ID numbers, email addresses, and phone numbers, then stored in Supabase object storage with AES-256 encryption at rest.
When you accept a legal agreement, we record which document and version you accepted, when, a cryptographic digest of the published document, and — at the moment of acceptance only — your IP address and browser user-agent string. This is the record that establishes an agreement was formed. See section 7 for how long it is kept and what happens to it when you delete your account.
We use PostHog for privacy-respecting product analytics. Events are anonymized (e.g., “report generated,” “experience saved”). No PII is transmitted to PostHog.
White Coat World is 100% ad-free. We do not load Google AdSense, advertising networks, tracking pixels, retargeting scripts, or marketing cookies. Student browsing behavior and profile data are never shared with advertisers. This policy is permanent and a hard requirement for FERPA-aligned institutional deployments. The one third-party embed anywhere on the site is the introductory video on our public homepage, which is hosted on YouTube — see section 9.
We never use student data to train or fine-tune AI models, sell data to third parties, or share data with advertisers.
Your academic profile text (capped at 3,000 characters per prompt) is passed through our PII scrubber before being sent to Google Gemini Flash for gap analysis. Google's API terms prohibit training on API inputs. We do not use student data to fine-tune models.
SOC 2 Type II and ISO 27001 certified. All environment secrets are stored in Vercel's encrypted vault — no credentials are committed to source code.
SOC 2 Type II certified. PostgreSQL with AES-256 encryption at rest, point-in-time recovery, and geographic redundancy.
Faculty notification emails and account emails (verification, password reset). No student PII is included in email bodies beyond first name and the section a review was requested for; account emails carry a single-use, short-lived link.
Redis service used to enforce rate limits and cache session-revocation state. The keys it holds are derived from IP addresses, account identifiers, and — for the one-time-code limiter — phone numbers. No academic profile content, application materials, or uploaded documents are stored there, and entries expire automatically after a short window.
SMS delivery of one-time security codes is built against Twilio. It is not active today — no Twilio credentials are configured, so no text messages are sent and no phone number is transmitted to Twilio. We disclose it because turning SMS delivery on would engage Twilio as a sub-processor of your phone number, and you should know that in advance rather than after the fact.
Application error reporting, configured with personal-information collection disabled and an additional scrubbing pass on every event before it is sent. Like SMS, this is currently inactive — no Sentry connection is configured, so no error data leaves the application today.
Consulted when you set or change a password, to warn you if that password has appeared in a known public breach. Only the first five characters of the password's SHA-1 digest are sent — the password never leaves our servers, your identity is not transmitted, and the service cannot determine which password was checked.
Powers autocomplete in the optional location field in the social layer. When you type in that field, the text you type is sent from your browser to Google. It is used only for that field and is not part of your academic profile or advising workflow.
Our public marketing homepage embeds an introductory video hosted on YouTube, which sets Google cookies for visitors to that page — including visitors who do not have an account. This is the only third-party embed on the site. It is not an advertising or tracking integration, and it does not appear on any signed-in page or anywhere your student data is handled.
By default, no faculty member can see your profile. You must explicitly opt in to share your data with a specific institution. Consent is:
| Data Type | Retention Period | Disposal Method |
|---|---|---|
| Academic profile, experiences, schools | Until account deletion | Hard delete on erasure request |
| AI gap analysis reports | Until account deletion | Hard delete on erasure request |
| Uploaded documents (transcripts) | Until account deletion | Hard delete from object storage |
| Soft-deleted records (experiences, reports) | 30 days after soft-delete | Automatic purge via cron |
| Audit log entries | 1 year | Automated rolling deletion after 12 months |
| Legal acceptance record (which document, which version, when, digest of the published document) | Retained after account deletion | IP address and browser details erased on deletion; the acceptance itself is retained as proof that an agreement was formed |
| Account-closure audit entry (account identifier + closure timestamp) | 1 year after deletion | Automated rolling deletion after 12 months |
| Encrypted database backups (point-in-time recovery) | Up to 7 days | Deleted records age out of the recovery window automatically; backups are never restored to bring back a deleted account |
| Verifying supervisor’s IP address (hour verification only) | Until you delete the experience or your account | Recorded only when a supervisor confirms your hours, to detect self-verification; deleted with the experience record |
| Anonymous benchmark contributions | Indefinite (no PII) | PII stripped at contribution time; aggregate data retained |
| Session tokens (JWT) | 7 days | Expire automatically; revoked early on password reset or 2FA change |
| Password hash, 2FA secret, recovery codes | Until account deletion | Hard delete on erasure request |
| Phone number (if provided) | Until removed or account deletion | Hard delete on erasure request |
| One-time codes (email, password reset, SMS) | 1–24 hours depending on type | Stored hashed; expire and are purged automatically |
What survives deletion, and why. Two records outlive your account, and we would rather name them than let you discover them: the acceptance record described in section 2, and a single audit entry noting that an account with your identifier was closed and when. Neither contains your academic work, your writing, your documents, your credentials, or your contact details. We keep the first because obligations in the Terms survive termination and a record of agreement is worthless if it vanishes the moment a dispute becomes likely; we keep the second because an institution auditing us needs to be able to see that a deletion actually happened. The closure entry is purged on the normal one-year audit-log schedule.
Backups are a lag, not an exception. Deletion removes your data from our live systems immediately. Encrypted disaster-recovery backups still contain a copy until they age out of the recovery window — currently up to seven days — after which no copy remains anywhere. We never restore a backup to bring back a deleted account, and nobody queries backups to answer a question about you. We name this because “deleted instantly and everywhere” would not be true, and a school's privacy reviewer will ask.
Inside the application we set only strictly necessary cookies: a session cookie for authentication (HttpOnly, Secure, SameSite=Lax), a CSRF-protection cookie for the sign-in flow, and a small number of cookies that remember interface preferences. Our product analytics (PostHog) runs entirely server-side — there is no in-browser analytics script, so no analytics cookie is set on your device.
One exception, on the public marketing homepage only: the embedded introductory video is hosted on YouTube, and that embed sets Google cookies for anyone who visits that page. It is not present on any signed-in page. Beyond that embed, no advertising cookies, tracking pixels, or third-party marketing scripts are loaded anywhere on the site. See our Cookie Policy for the full breakdown.
We may update this policy to reflect changes in our practices or legal requirements. This policy is versioned, and material changes require you to accept the updated version in the app before continuing to use the Platform. For minor, non-material changes, continued use after the effective date constitutes acceptance.
Privacy questions, data export requests, or institutional Data Processing Agreement inquiries: privacy@whitecoatworld.com
Security vulnerability reports: security@whitecoatworld.com
Institutional Partners
If you represent a university and need a HECVAT questionnaire (in preparation), a Data Processing Agreement (DPA), or a FERPA addendum, please contact security@whitecoatworld.com. See also our Security & Data Privacy statement.