Privacy Policy

1. Introduction

E3 Learning ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at e3learn.com (the "Site"), use the E3 Learning app for iPhone, iPad and Android (the "App"), and use our educational services, including MedAssist, our AI tutor.

By accessing or using E3 Learning, you agree to this Privacy Policy. If you do not agree with the terms of this policy, please do not access the Site.

2. Information We Collect

2.1 Information You Provide

We may collect information you voluntarily provide when you:

• Create an account (email address, name, password)
• Subscribe to our services (payment information processed by Stripe)
• Complete your profile (your credential, license number, state and expiration date, time zone, and whether to appear on the weekly leaderboard)
• Contact us (email correspondence)
• Participate in quizzes or track continuing education, including certificates and license details you upload
• Use MedAssist: the questions you ask, your answers in practice scenarios, the research topics you choose, and the responses generated for you
• Report a quiz question or an AI-generated answer

2.2 Information Collected Automatically

When you use the Site or the App, we may automatically collect:

• Device information: your browser's user agent, which names your browser and its version and your operating system
• Usage data (pages visited, time spent, quiz performance)
• IP address and approximate location
• How you arrived at the Site: the page that linked you, the page you landed on, and any campaign tags or ad-click IDs in the link
• Cookies and similar technologies, such as your browser's local storage (see section 6)
• In the App: your IP address and the time of each request; a generic label that identifies requests as coming from the App (it does not include your device model or app version); the time zone your device reports when you create an account, so daily limits and streaks follow your local day; and how you use practice and MedAssist. Apart from the subscription page the App shows on iPhone and iPad, which sends your device type and iOS version in its browser user agent like any page of our website, we see your device type, operating system and app version only in the statistics and crash reports that Apple and Google make available to us; the App itself sends no crash or error reports.

2.3 Information from Third Parties

We receive information from the services that process your purchases: Stripe tells us whether your payment succeeded, the amount charged and, when it has one, the country of your billing address. If our Android app links you to our website to buy a subscription (section 5), Google Play also gives us a reporting token for that sale. We do not offer sign-in through other companies.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our educational services
• Process transactions and manage subscriptions
• Track your learning progress and quiz performance
• Send service-related communications (account verification, subscription updates), the learning emails you ask for, and product news and offers, which are on for every account until you turn them off or unsubscribe
• Personalize your learning experience
• Analyze usage patterns to improve content
• Measure which of our ads and links lead to sign-ups and subscriptions
• Comply with legal obligations
• Prevent fraud and ensure security

4. MedAssist and AI Processing

MedAssist answers with artificial intelligence. When you use it, the text you send (questions, scenario answers and research topics) and your selected study level are processed to generate a response:

• Our AI service: MedAssist normally runs on servers operated by E3 Learning.
• Third-party AI providers: When our servers are busy or unavailable, your text may be sent to OpenRouter, a third-party AI routing service, and the AI model provider it selects, solely to generate your response.

The App asks for your agreement before your first MedAssist request. Your conversations are saved to your account so you can return to them; you can delete any conversation at any time, and deleting your account deletes all of them.

Do not enter patient names or other information that could identify a patient. MedAssist is a study tool, not a medical device, and is not intended for patient-specific care.

5. How We Share Your Information

We do not sell your personal information. We may share information with:

• Service Providers: Third parties that help us operate our services (e.g., Stripe for payments, Cloudflare for hosting, and our email provider)
• Cloudflare (hosting and site analytics): Cloudflare, Inc. hosts and delivers our website, so it receives what your browser sends with every request, such as your IP address and your browser's user agent. Cloudflare also adds its Web Analytics script to every page of our website, including the subscription page the App shows on iPhone and iPad. For each page you view, the script sends Cloudflare the page's address and the address of the page that linked you (both without anything after a "?" or "#"), your browser and operating system versions, and measurements of how quickly the page loaded and responded. It sets no cookies and stores nothing on your device. Cloudflare also carries the traffic between the App and our servers (api.e3learn.com and medassist.e3learn.com), so it receives your IP address and the content of those requests too. Cloudflare handles this information under its own privacy policy.
• AI Providers: As described in section 4, when MedAssist's own servers cannot answer
• Advertising Measurement (Site only): Our website uses the Google Ads tag and the Reddit Pixel to measure visits, sign-ups and subscription purchases that come from our ads. When you create an account on the website, a hashed (one-way encoded) copy of your email address may be sent to Google and Reddit to match the sign-up to an ad. Both tools also look for email addresses on our pages. The Google tag can send Google a hashed copy of an email address you type into a form, such as when you sign up, sign in or reset your password, or that a page shows you, such as your purchase receipt or the account menu when you are logged in. Reddit's pixel does the same for email addresses typed into forms, keeps the hashed copy in a cookie on our website (_rdt_em) for 90 days and sends it with your later visits from that browser. Both use these copies to help match visits, sign-ups and purchases to ad clicks. We use these tools, and the Meta and OpenAI tools described below, to measure our ads. Wherever our website loads the Google tag, it tells Google not to use your visit for personalized advertising. Our website gives Reddit, Meta and OpenAI no such instruction; they use what their tools collect under their own privacy policies (for Meta's controls, see section 6). The App itself contains no advertising code; section 6 describes the page of our website it shows.
• Meta Pixel (Site only): Our website also uses the Meta Pixel from Meta Platforms, Inc., the company behind Facebook and Instagram, to measure our ads on those services. It tells Meta which pages of our website you view and when you sign up or buy a subscription, along with your IP address, your browser's user agent and the Meta cookies described in section 6. We turn off the pixel's automatic events, so it does not report the buttons you click. Sign-up and purchase reports include your E3 Learning account ID, and purchase reports include the plan, price and currency.
• Meta Conversions API: When you create an account, confirm your email address or start a paid subscription, our server also sends it directly to Meta, so it can be counted even if your browser blocks the pixel. The report contains a hashed (one-way encoded) copy of your email address and a hashed copy of your E3 Learning account ID, which Meta uses to connect the report to the ad you saw or clicked; your account ID itself, inside the event reference that lets Meta count a sign-up or purchase only once when both the pixel and our server report it; and the Meta browser and ad-click IDs if your browser gave them to us. A sign-up or email-confirmation report also contains your IP address, your browser's user agent and the web address your browser sent with the request (the "Referer", normally just https://e3learn.com/); a subscription report also contains the plan, price, currency and our subscription reference number. Our server sends these reports only for accounts created on our website, never for accounts created in the App. Meta handles this information under its own privacy policy. See section 6 for your choices.
• ChatGPT Ads (Site only): Our website also loads OpenAI's measurement pixel for ads in ChatGPT, to measure sign-ups that come from those ads. On every page you view, the pixel reports the page's address, the page you came from and its browser ID to OpenAI. The pixel sets two cookies on our website: __obref, a random ID for your browser that lasts a year, and, when you arrive from one of those ads, __oppref, OpenAI's ad-click reference. When you create an account on the website, both our website and our server report the sign-up to OpenAI, with your E3 Learning account ID inside an event reference that lets OpenAI count it only once. Our server's report also contains a hashed (one-way encoded) copy of your email address and of your account ID, the browser ID and ad-click reference if your browser has them, your IP address, your browser's user agent and the Referer described above. Our server sends this report only for accounts created on our website, never for accounts created in the App. OpenAI handles this information under its own privacy policy.
• Google Play: If you start a subscription on our website through the link in our Android app, Google Play's external content links program requires us to report the sale to Google. The report of your first payment contains the transaction time, the amount before tax, the tax, the country of your billing address (the United States when we do not have one), the external transaction token Google Play issued for the link and our reference number for the payment. Each renewal is reported the same way, linked to the first payment instead of the token, and each refund with its time and, for a partial refund, its amount. These reports do not contain your name or email address. Google handles this information under its own privacy policy.
• Icons, fonts and embedded media: Most pages of our website, including the subscription page the App shows, load their icons from unpkg.com, and our /start and /app pages load a font from Google Fonts. Some reference pages show YouTube videos in YouTube's privacy-enhanced mode (youtube-nocookie.com), and a few ECG pages show images hosted by Life in the Fast Lane (litfl.com); these load when you open or scroll to the part of the page that contains them. When MedAssist shows a diagram in the App, the App downloads the Mermaid diagram library from jsDelivr (cdn.jsdelivr.net). In each case your browser or the App fetches the file directly, so that service receives your IP address and your browser's user agent, and a page of our website also sends its address (https://e3learn.com/). Once a YouTube video plays, Google handles it under its own privacy policy.
• Legal Requirements: When required by law, court order, or governmental authority
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Your Consent: When you explicitly authorize sharing

6. Cookies and Tracking

We use cookies and similar technologies, such as your browser's local storage, to:

• Keep you logged in to your account
• Remember your preferences
• Understand how you use our Site, with our own analytics and our host's (section 5)
• Learn how you found us, such as the link or ad you arrived from
• Measure our ads (on the Site only; see section 5)

Our own analytics and attribution

We do not share these with other companies, with one exception: our server's reports to Meta and OpenAI (section 5) include the ad-click ID that company added to the link you arrived from: OpenAI's when you sign up, and Meta's when you sign up, when you confirm your email address and when you start a paid subscription.

• e3_anon_id (local storage): a random ID created on your first visit. It connects your page views, the steps you take toward signing up, practicing and subscribing, and how you arrived, so we can see how visitors use the Site. With each page view we record the page, its title and section, the page that linked you and your browser's user agent; when you are logged in, we record your page views, and how long you stayed, under your account. If you create an account on the website, we keep this ID with your account, which links what we recorded under it before you signed up to your account.
• e3_attribution (local storage) and e3_attr (a cookie that lasts one year and is renewed each time you visit): how you first arrived at our website and the most recent ad or campaign link you arrived from. Each holds the page that linked you, the page you landed on, the date and time, any campaign tags in the link (including the audience and case labels in our own ad links), and any ad-click IDs that Google, Reddit, Meta, Microsoft or OpenAI added to it. We send this to our servers, and if you create an account on the website we keep it with your account, together with the Meta and OpenAI browser and ad-click IDs from their cookies, so we can tell which ads and links lead to sign-ups.

Advertising tools

The Google tag, the Reddit Pixel, the Meta Pixel and OpenAI's pixel set their own cookies on our website to recognize your browser and the ad you clicked. The Meta Pixel sets two: _fbp, which identifies your browser, and _fbc, which stores the ad-click ID when you arrive from a Meta ad. OpenAI's pixel sets __obref, a random ID for your browser, and, after an ad click, __oppref. Reddit's pixel keeps a hashed copy of an email address typed into our forms in _rdt_em (section 5). Cloudflare's Web Analytics (section 5) sets no cookies and stores nothing on your device.

Your choices

Our website does not have a setting to turn these off. In your browser, you can:

• Block cookies and site data for e3learn.com. Nothing described in this section is stored on your device, so the advertising tools cannot use cookies on our website to recognize your browser. They still load, and the Google tag, the Reddit Pixel, the Meta Pixel and OpenAI's pixel still report your visit; whether their own cookies from their websites are sent with those reports depends on your browser's third-party cookie settings. Our own analytics still count each page you view, but with a new random ID for each page, so they cannot connect your visits to each other. Blocking may limit some Site functionality, such as staying logged in.
• Delete cookies and site data for e3learn.com to remove what is already stored. Delete both: e3_attr and e3_attribution restore each other, so deleting only cookies, or only site data, does not remove them.
• Use a content blocker that blocks advertising scripts. It stops the advertising tools from loading; it may not stop our own analytics, which load from our own website.

None of these stops the reports our server sends to Meta and OpenAI (section 5) or removes what our servers have already recorded. Deleting your account (section 9) deletes the attribution record kept with your account, but the records our servers keep under your browser's random ID, such as page views and how you arrived, stay without a link to your account; Delete your account lists what is kept. If you have a Facebook or Instagram account, you can review and limit how Meta uses activity from other websites, such as ours, to show you ads in Meta's ad preferences and under Your activity off Meta technologies.

In the App

The App does not use cookies for advertising and contains no advertising or analytics code from other companies. On iPhone and iPad it shows one page of our website inside the App, your subscription page: that page loads none of the advertising tools and stores neither e3_attr nor e3_attribution, but like every page of our website it runs Cloudflare's Web Analytics and loads its icons from unpkg.com (section 5). Our servers record how the App is used with our own first-party analytics, for example when you sign up and when you start and finish a practice session. New subscriptions are not sold inside the App: when the App offers a plan, it opens our website or our payment processor's checkout in your web browser, and the confirmation page you see after paying is a page of our website. There this policy's description of the Site applies, including the purchase reports in section 5 if you are logged in to our website in that browser. If you already subscribe, the subscription page the App shows on iPhone and iPad can change your plan, and Stripe charges any difference there. Our server never reports the sign-ups or purchases of accounts created in the App to Meta, OpenAI or any other ad platform; the Google Play sales reports in section 5 are the only reports about App purchases.

7. Data Security

We implement reasonable technical and organizational measures to protect your information, including:

• Encryption of data in transit (HTTPS/TLS)
• Secure password hashing
• Regular security assessments
• Limited access to personal data

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security of your data.

8. Data Retention

We retain your information for as long as your account is active or as needed to provide services. We may retain certain information as required by law or for legitimate business purposes, such as:

• Maintaining records of transactions
• Resolving disputes
• Enforcing our agreements
• Complying with legal obligations

9. Your Rights and Choices

Depending on your location, you may have the right to:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data (subject to legal requirements)
• Portability: Request your data in a portable format
• Opt-out: Unsubscribe from marketing communications

You can delete your account and its data yourself, in the App (Profile, then Delete account) or on the Site (account settings). See Delete your account for what is deleted and what is kept.

To exercise these rights, contact us at [email protected].

10. Children's Privacy

E3 Learning is not intended for users under 18 years of age. We do not knowingly collect information from children. If you believe we have collected information from a minor, please contact us immediately.

11. Third-Party Links

Our Site may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.

12. International Users

E3 Learning is operated in the United States. If you are accessing the Site from outside the U.S., your information may be transferred to and processed in the United States, where data protection laws may differ from your jurisdiction.

13. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by posting the new policy on this page and updating the "Last Updated" date. Your continued use of the Site after changes constitutes acceptance of the updated policy.