Privacy Policy
This policy explains what information MESOMIND collects when you use the website at mesomind.online and the MESOMIND apps (together, the “Service”), why we collect it, who else processes it, how long it is kept, and the choices and rights you have. We have tried to write it plainly. If anything is unclear, write to support@mesomind.online.
In short: we collect what we need to run your account and the features you use. We never sell your information, there is no advertising and no third-party analytics or tracking, and we do not use what you write, upload or record to train AI models. You can delete your account, and what is stored with it, at any time.
1. Who is responsible for your information
The Service is published and operated by MESOMIND, which is the controller of the personal information described in this policy. For any question about it, or to use any of the rights in section 9, write to support@mesomind.online. Where an app is distributed through a store by a service provider on MESOMIND’s behalf, that provider handles the submission only; MESOMIND remains responsible for your information.
2. What we collect
Your account
On the website you sign in with Google (the apps also offer Apple). We receive your email address, a unique account identifier and, if Google shares them, your name and profile picture. When you set up your account we ask for your first name, last name and stage of study, and we confirm your email address by sending it a six-digit code. In the app you may also choose to give a phone number.
What you put into the Service
- AI Tutor conversations — your questions, the answers, and any photo or document you attach. Documents such as PDFs and Office files are turned into text in your browser, and that text is what is sent.
- Voice dictation — a short recording from your microphone, turned into text for the AI Tutor.
- Audio Notes — recordings you upload, and the transcripts and notes made from them.
- Video Notes — the notes generated from a video you choose, with that video's identity.
- In the app: your notes and annotations, flashcards, bookmarks, documents in your library, and lecture progress.
Some things stay only on your device and never reach our servers: your Question Bank progress and bookmarks on the website, the ratings you give answers, and your list of videos with how far through each you are.
If you share an AI Tutor answer, the answer is packed into the link itself and is not stored by us — but anyone you give the link to can read it.
Payments (website only)
To buy a plan you transfer the fee yourself and upload a screenshot or receipt of the transfer. We store that image in private storage, together with your account email, the plan, the amount and the status of your request. Our team is sent a private link to it so the payment can be checked, and we keep a fingerprint of the image so that the same receipt cannot be used twice. It is used for nothing else. We never receive or store card numbers or banking passwords. Please crop out anything on a receipt that is not needed to identify the transfer. The Android app does not sell anything and collects no payment information.
How the Service is used
To run the Service fairly, protect it from abuse and plan its capacity, we record when a signed-in student first visits on a given day, and count their AI requests, audio and video notes and the videos they start (not which videos) — with the name and stage they gave us, their email address, and whether they used the website or an app. These counts are seen only by our own team. Our servers also keep usage counters for the free plan’s allowance and the fair-use limits described in the Terms. Your IP address is used briefly, in memory only, to limit abuse, and is not stored with any of this.
Your agreement to these documents
When you accept the Terms of Service and this policy on the website, we record which version you accepted, the statements you ticked, the time, your email address and your browser’s user-agent string, as evidence of your agreement.
Technical information
Like every website, our hosting provider receives technical information with each request — such as your IP address, browser type and the pages requested — and keeps it in short-lived logs used for security and to investigate faults. We do not use it to build a profile of you.
Stored on your device
The Service keeps information in your browser’s local storage, IndexedDB and cache so that you stay signed in, your conversations and notes open quickly and work offline, uploads can resume, and your preferences — such as light or dark mode — are remembered. These are strictly necessary for the Service to work; we use no advertising or tracking cookies. Clearing your browser’s site data removes them.
What we do not collect
There is no advertising in MESOMIND, no advertising identifier is read, and no third-party analytics or tracking tools are used. We never request your location, and we never read your contacts, call history, messages or the list of apps on your device. The camera, microphone and photos are used only when you choose a feature that needs them, and declining leaves the rest of the Service working.
3. Why we use it
- To provide the Service you asked for — signing you in, storing and syncing your work, answering your questions, transcribing recordings, generating notes, applying your plan and checking your payment. This is necessary to perform our agreement with you.
- To keep the Service safe and fair — preventing fraud, receipt reuse and abuse, enforcing usage limits and our Terms, and securing our systems. This is in our legitimate interests and yours.
- To understand and improve the Service — through the usage counts described above. This is in our legitimate interests.
- To communicate with you — verification codes, messages about your payment or account, and replies when you contact us.
- To meet legal obligations — keeping records we are required to keep and responding to lawful requests.
We do not sell your personal information and we do not use it for advertising. No decision with legal or similarly significant effects is made about you by automated means alone — every payment, for example, is reviewed by a person.
4. AI features and your information
When you use the AI Tutor, your question, the earlier messages in that conversation and anything you attach are sent to the AI model service listed in section 5 so that an answer can be written. To find reference pictures and sources, search terms based on your question are sent to search and image services. Audio you upload or dictate, and the audio of a video you generate notes from, is sent to a transcription service. These providers process the information to provide the feature to you.
We do not use your content to train AI models. Our providers process it under their own service terms. Please do not put sensitive personal information — and never anything that could identify a patient — into a question, an attachment or a recording.
5. Who else processes your information
We use the following service providers. Each receives only what it needs for its part of the Service.
| Provider | What it does, and with what |
|---|---|
| Google Firebase | Sign-in, and the database that holds your account, profile, plan, saved conversations and notes. |
| Vercel | Hosting of the website and its servers; private storage for payment receipts, and for uploaded audio until it has been handed to the transcription service. |
| APIMaster | The AI model service that runs the language models (currently OpenAI GPT models) behind the AI Tutor: it receives your questions, the conversation so far, attached photos and the text of attached documents, and the transcripts that notes are written from. Your name and email address are not sent. |
| Google Gemini | A back-up check that a reference picture matches what you asked for (it receives the picture and the words of your request); and, in the app, reading the handwriting in library pages. |
| AssemblyAI | Transcribing audio you upload to Audio Notes, voice dictation, and the audio of a video you generate notes from. Each recording and transcript is deleted from AssemblyAI after use, and within two days at most. |
| Serper | Web search and reading web pages, when a question needs a current source. Only search terms and page addresses are sent. |
| Webshare | A network used to fetch a video's audio from YouTube when you generate notes from it. It receives no information about you. |
| Wikimedia Commons and the U.S. National Library of Medicine (Open-i) | Open image libraries searched for reference pictures. Only search terms based on your request are sent. |
| Google (YouTube) | Video search and video details, and playback through YouTube's embedded player, which your browser loads directly from Google. |
| Resend and Google Gmail | Sending your email verification code, and sending our team notice of a payment (your account email, the plan, the amount and a private link to your receipt). |
Videos are played through YouTube’s embedded player, which your browser loads from Google; Google receives your IP address and may set its own cookies under its own privacy policy. Links that take you to another website are governed by that website’s policy.
We may also disclose information when the law requires it, to protect the rights, safety or property of our students, the public or MESOMIND, or as part of a reorganisation or sale of the Service — in which case this policy will continue to protect it.
6. International transfers
Our providers operate in several countries, including the United States and countries in Europe, so using MESOMIND means your information is processed outside the country you live in. We choose established providers that protect the information they handle with recognised security measures.
7. How long we keep it
- Your account, profile, conversations and notes: until you delete them or your account.
- Uploaded audio: deleted from our storage as soon as the transcription service has it; the service deletes its copy and the transcript after use, and within two days at most.
- An answer still being written: kept for up to 24 hours so that it survives a refresh.
- Payment receipts and payment records: for as long as your account exists, so that any question about a payment can be answered.
- Usage counts and usage counters: for as long as your account exists.
- Your record of accepting these documents: for as long as your account exists.
- Hosting logs: for a short period set by our hosting provider.
When you delete your account we delete your sign-in, your profile and saved work, your plan, your payment requests and receipts, your usage records and your acceptance record. Some things cannot be or are not removed: emails already sent; copies kept in your own browser or device until you clear them; our internal log of plan changes we made by hand; reports made about conduct in study rooms; site-wide totals that do not identify you; and short-lived hosting logs.
8. Security
Information travels over encrypted HTTPS connections. Sign-in is handled by Google Firebase, so we never see or store your Google password. Your saved work can be read only by your own signed-in account and by our own administrative tools where that is needed to run and support the Service. Uploaded audio and payment receipts are kept in private storage rather than at public addresses, and paid features check your sign-in on our servers. If we ever become aware of a security incident that affects your information, we will let you know as the law requires.
9. Your rights and choices
Depending on where you live, you may have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct information that is wrong or incomplete;
- delete your account and what is stored with it — from Profile, or from the account deletion page, which works even if you no longer have the app;
- object to, or ask us to restrict, some uses of your information;
- receive your information in a portable format;
- withdraw your consent where we rely on it — which does not affect anything done before you withdrew it.
To use any of these rights, write to support@mesomind.online from the email address on your account. We will reply within 30 days. You may also complain to the data-protection authority where you live.
10. Children
MESOMIND is made for medical students and is not directed at children. You must be at least 16 to use it, and students under 18 need a parent or guardian’s permission. We do not knowingly collect information from anyone under 16; if you believe a child has created an account, write to support@mesomind.online and we will delete it.
11. Changes to this policy
If we change this policy materially, we will update the effective date and version at the top and ask you to review and accept the new version before you continue using the Service. Minor changes take effect when they are published.
12. Contact
Questions, requests and complaints about privacy all go to the same place: support@mesomind.online. See also our Terms of Service.