Privacy Policy

Information we collect

• Account information: name, email address, and credentials you provide when you register or are invited to the Service.
• Learning data: courses, enrollments, progress, exam attempts, and certificates associated with your account.
• Organization data: information provided by administrators of organizations (“tenants”) that use the Service.
• Payment information: payments are processed by Stripe; we do not store full card numbers. We receive limited transaction and payout information needed to fulfill orders.
• Zoom integration data: if an administrator connects a Zoom account, we receive and store that Zoom account’s email address and user ID, OAuth access and refresh tokens, granted scopes, and token expiry, plus the meeting ID and join link for sessions scheduled through the Service. See “Zoom integration” below.
• Usage and device data: standard log data such as IP address, browser type, and pages viewed, used to operate and secure the Service.

How we use information

We use information to provide and improve the Service, authenticate users, deliver courses and certificates, process payments, schedule and share live sessions, provide support, and comply with legal obligations.

Zoom integration

When an administrator connects their organization’s Zoom account, we use the Zoom API solely to schedule meetings on that account (create a meeting) and to read back the meeting details we created (meeting ID and join link) so the join link can be shared with enrolled learners. We request only the scopes necessary for this: meeting:write:meeting and meeting:read:meeting. We do not access recordings, participant lists, attendance, chat, or meeting content.

Zoom OAuth tokens are stored encrypted at rest, on our servers only. They are never exposed to end users’ browsers, never shared with third parties, and never written to logs. Each organization’s data is isolated from other organizations.

You may disconnect Zoom at any time from the admin settings, which deletes the stored tokens. If you remove the app from your Zoom account, Zoom notifies us and we delete the associated tokens in accordance with Zoom’s data compliance requirements.

How we share information

We do not sell personal information. We share information only with service providers that help us operate the Service (for example, Stripe for payments, Zoom for scheduling, and our hosting and database providers), and when required by law. Service providers are permitted to use the information only to provide services to us.

Data retention and deletion

We retain information for as long as needed to provide the Service and to meet legal, accounting, or reporting requirements. Certificates and related records may be retained as durable records of credentials earned. You may request deletion of your personal information by contacting us; some records may be retained where required by law.

Children’s privacy

Certain courses are designated for minors and collect minimal information with parental consent where required (including under COPPA for children under 13). We do not knowingly collect more information than necessary for these courses, and minors are never listed in public directories.

Security

We use technical and organizational measures including encryption in transit and at rest, row-level data isolation between organizations, and strict server-side handling of credentials. No method of transmission or storage is completely secure, but we work to protect your information.

Your choices

You may access or update your account information, and you may contact us to request deletion of your data or to ask questions about this policy.

Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the effective date above.

Contact

Rehberg Innovations, LLC d/b/a Sports Medicine Digital — support@sportsmedicinedigital.com