Privacy Policy

Who we are

School of MedTech is a free student project run by WalexLabs, a small independent project. WalexLabs isn't a registered company (yet), so the person behind it is responsible for your data (the "controller", in GDPR language) and will identify themselves to a data protection authority whenever one asks.

Questions, requests or worries? Write to hello@walexlabs.com and a real person will answer.

What we collect, and why

• From Google when you sign in: your email address and your name. We keep these privately, to run your account and to deal with a complaint if one ever comes up.
• What you choose: a username and a badge colour. Everyone can see these.
• What you write: forum threads, replies and likes. Everyone can read them.
• Your confirmations: the date you said you're 18 or older and happy with our guidelines, and your choice about email updates (with the date and the exact wording you saw).
• Notifications: when someone replies to your question, or your reply is marked as the answer, we keep a small note for you inside the site. They are deleted with your account.
• Searches: what you type in the forum search is used to find posts and is not stored.
• If a post is reported: a copy of that post and who wrote it, so we can handle the report fairly, even if the post or account is deleted later.
• Basic technical logs (like IP addresses) that our hosting and database providers keep to run and protect the site. We don't use them to track you.

Who sees what

• Everyone, even signed out: your username, badge colour and your posts.
• Other members: exactly the same, nothing more. Your real name and email stay private.
• Us: your real name and email. We look only to keep the forum safe, answer reports, and meet legal duties. We say this openly so "hidden identity" never means "nobody can ever be accountable".

Our reasons (the legal bit, in plain words)

• Running your account and keeping the forum safe: this is what you signed up for, and it's a fair interest we share.
• Email updates: only because you said yes (consent). You can take it back any time.
• Keeping a copy of reported posts: so we can handle complaints and, if ever needed, defend or pursue a legal claim.

Who helps us run this

• Supabase stores our database, on servers in Ireland (EU). Supabase's data processing terms use the EU's standard contractual clauses.
• Vercel hosts the website and may process data outside the EU, including in the US. We use Vercel's free plan, so we rely on Vercel's standard terms and privacy policy; Vercel's separate data processing agreement is offered on its paid plans.
• Google signs you in. For that step, Google's own privacy policy applies.

We don't sell your data and we don't use advertising or analytics tools.

How long we keep it

Until you delete your account. Deleting it removes your name, email, username, posts, replies, likes and consent records.

One exception: if a post of yours was reported, we keep a copy of that post and who wrote it until the report is closed plus 12 months, in case we need it for a complaint or legal claim. Then we delete it.

Your rights

You can ask to see your data, correct it, delete it, limit how we use it, object to how we use it, take a copy with you, or take back a consent. Most of it you can do yourself on your Profile page (change your username and badge, download your data, switch email updates on or off, delete your account). For anything else, email hello@walexlabs.com. We'll reply within one month.

If you're not happy

Tell us first, we'd love the chance to fix it. You can also complain to Italy's data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or to the authority in your own country.

Cookies

Only the small cookies that keep you signed in. No ads and no tracking of you. We count visits with Umami, a privacy-friendly tool that uses no cookies and does not follow you around: it only tells us which pages are visited, what kind of device and country the visit came from, and which link brought people here (for example Instagram). It respects your browser's Do Not Track setting. Nothing here needs your consent, so there's no cookie banner to click away.

Age

This forum is for people who are 18 or older.

Changes

If we change something that matters, we'll update the date and version at the top of this page and mention it in the forum.