Privacy Policy

1. Who we are

This Privacy Policy explains how CresMD (“CresMD”, “we”, “us”) collects, uses, shares, and protects personal information when you visit www.cresmd.co, create an account, buy or use our courses, digital downloads, memberships, communities, coaching or booked sessions, or otherwise get in touch. CresMD is an independent Canadian medical education practice based in Alberta, and we are accountable for your personal information under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and the provincial privacy laws that apply to us. Privacy questions and requests go to [email protected].

2. Information we collect

Information you give us: your name, email address, and anything else you enter at sign-up or in your profile; your billing details and country; the content of messages, discussion posts, support requests, and coaching bookings; anything you choose to tell us about your training background or examination goals; and your answers to surveys, quizzes, and assignments.

Information created when you use our Services: enrolment and order records, lesson and video progress, quiz and mock-examination results, certificates, downloads, login times, and our correspondence with you.

Information collected automatically: IP address, the approximate location it suggests, device and browser type, operating system, the page that referred you, pages viewed, time on page, and similar analytics gathered through cookies and comparable technologies.

Payment information: card and banking details are collected and handled directly by our payment providers. We receive only limited confirmation data such as the last four digits, the card brand, the amount, and whether the payment succeeded. We never see or store your full card number.

We do not ask for, and do not want, sensitive information such as health data, government identification numbers, or examination-body identifiers. Please do not send these to us or post them in our communities.

3. Why we use it, and our legal basis

We use personal information to create and run your account; to deliver what you have bought and keep track of your progress; to take payment, issue receipts, and handle refunds, disputes, and chargebacks; to answer you and provide support; to run and moderate our discussions and communities; to send service messages you cannot opt out of, such as receipts, access details, and important changes; to send marketing emails where you have agreed to them, which you can stop at any time; to measure and improve our teaching, our website, and our advertising; to detect, investigate, and prevent fraud, account sharing, content piracy, and abuse; and to meet our legal, tax, and accounting obligations. Where the GDPR or UK GDPR applies to you, we rely on performance of a contract, your consent (for marketing and non-essential cookies), our legitimate interests in keeping our platform secure, preventing misuse, and improving what we offer, and compliance with legal obligations.

4. Cookies and similar technologies

We use strictly necessary cookies to keep you logged in, hold your cart, and keep the site secure; analytics cookies to understand how the site is used; and advertising and remarketing technologies so that our ads reach relevant audiences and we can measure whether they worked. Depending on the page, these may include tools provided by Thinkific, which hosts our courses, and by analytics and advertising partners such as Google, Meta, LinkedIn, and Microsoft. The exact set changes from time to time as we adjust our teaching and our marketing. You can control cookies through your browser settings and through the opt-out tools each provider offers, although blocking strictly necessary cookies will stop parts of the site from working.

5. Who we share it with

We do not sell your personal information. We share it only with the service providers who help us run CresMD, and only as far as they need it: our course platform and website host, payment processors, email and marketing tools, video hosting and content delivery, analytics and advertising partners, scheduling and communication tools, and professional advisers such as our accountant. We may also share information where the law, a court, or a regulator requires it, to establish or defend a legal claim, to protect our rights or anyone’s safety, and to a new owner if CresMD is ever transferred or sold.

6. International transfers

We are based in Canada, and our providers may store or process personal information in Canada, the United States, the European Union, and elsewhere. Information held outside your own country may be accessible to the courts, law enforcement, and national security authorities of that country under its laws. Where it is required, we put appropriate safeguards in place, such as standard contractual clauses, and we expect our providers to protect your information to a comparable standard.

7. How long we keep it

We keep account and learning records for as long as your account is active and for a reasonable period afterwards, so that you can come back to your material and so that we can deal with any dispute. We keep transaction and tax records for as long as Canadian tax and accounting rules require, currently at least six (6) years. We keep evidence about refunds, chargebacks, and content misuse for as long as we may need it to bring or defend a claim. Marketing records are kept until you unsubscribe, and for a short period afterwards so that we can honour your opt-out. When we no longer need information, we delete it or anonymise it irreversibly.

8. Your rights

Subject to the limits of the law that applies to you, you may ask us to give you access to the personal information we hold about you; correct anything inaccurate or incomplete; delete information we no longer have a lawful reason to keep; restrict or object to certain uses, including direct marketing and profiling for advertising; give you a copy of the information you provided in a portable format; and withdraw your consent at any time, without affecting anything we have already done lawfully. To exercise any of these, email [email protected] from the address on your account. We will respond within thirty (30) days, or tell you if we need longer. We may need to confirm who you are first, and we may decline a request where the law allows, for example where the information is subject to legal privilege or where releasing it would reveal someone else’s information.

9. Marketing emails

We send marketing emails only where you have agreed to them or where Canada’s Anti-Spam Legislation otherwise allows it. Every marketing message carries an unsubscribe link and our contact details. Unsubscribing does not stop transactional messages such as receipts and course access notifications.

10. Security

We use technical and organisational measures appropriate to the sensitivity of the information, including encryption in transit, access controls, a small number of tightly restricted administrative accounts, and care in choosing the providers we work with. No system is completely secure and we cannot promise absolute safety. You are responsible for keeping your password confidential and for activity on your account. If a breach happens that creates a real risk of significant harm, we will notify the people affected and the relevant authorities as the law requires.

11. Children

What we offer is intended for adults. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us information, contact us and we will delete it.

12. Other people’s sites

Our site links to third-party websites, tools, and social platforms that we do not control. This Policy does not apply to them, and we encourage you to read their own privacy notices.

13. Changes to this Policy

We may update this Policy from time to time. The current version is always posted on this page with the date it took effect. Where a change is significant, we will take reasonable steps to let you know.

14. Contact and complaints

[email protected]

If you are not satisfied with how we have handled your request, you can complain to the Office of the Privacy Commissioner of Canada, to your provincial privacy regulator, or, if you are in the EU or UK, to your local supervisory authority.