Privacy Policy

Last updated: July 19, 2026

1. What We Collect

When you create an Academy account, we collect your name and email address. As you use a program, we store your assessment responses, lesson completion status, roadmap progress, and content you enter into builder tools (e.g. resume drafts, personal statements, offer drafts). If you submit a document for coach review, that file is stored privately and is never shared beyond you and your coach. If you order a print edition of a book, we collect the shipping address and phone number you provide at checkout and share it with our print fulfillment partner (Lulu) solely to produce and ship your order. If you sign up for our newsletter, we collect your email address for that purpose alone.

2. What We Do Not Collect

We do not knowingly collect protected health information (PHI) or real patient data. Prior authorization cases used in Academy programs are fictional, and users are instructed never to enter real patient information. We do not store payment card details — all payment processing is handled directly by Stripe, and we only receive a transaction confirmation and reference IDs, never your card number. We do not use advertising or analytics tracking cookies; the site does not run third-party ad trackers.

3. How We Use Your Data

Your data is used to: operate your account and save your progress across devices; verify your enrollment in purchased programs; process and ship print orders; send transactional emails (verification, password reset, order and enrollment confirmation, coach-review updates); and, in aggregate/anonymized form, to understand where students commonly get stuck so we can improve program content. If you opt into our newsletter, we send periodic educational content and updates about new books, programs, or resources — you can unsubscribe at any time using the link in every email.

4. Who Can See Your Data

Your individual account, progress, and submission records are visible only to you and to DocTayo administrators, enforced at the database level (Row Level Security) so other students can never see your data. Coach-review submissions are visible to you and the coach reviewing your submission. We do not sell your personal data to third parties.

5. Third-Party Services

We use Supabase for authentication, database, and file storage; Stripe for payment processing; Resend for transactional and newsletter email delivery; and Lulu for on-demand print production and shipping of physical books. Each of these providers processes data on our behalf under their own privacy and security terms.

6. Cookies

DocTayo does not use advertising or analytics tracking cookies. The site may use strictly necessary cookies for functions like keeping you signed in to the Academy — these are required for the site to work and are not used to track you across other websites.

7. Your Rights

You may request a copy of your personal data or request account deletion at any time by emailing privacy@doctayo.com. We will respond within 30 days. Account deletion permanently removes your profile, progress, and submissions and cannot be undone. You can unsubscribe from marketing emails at any time without affecting transactional emails tied to an active purchase or account.

8. Data Retention

We retain account data for as long as your account is active. Certificates already issued may be retained in anonymized form (certificate number and verification code only, no personal data) to preserve the integrity of the public certificate verification page even after an account is deleted.

9. Security

Data is protected using industry-standard encryption in transit and at rest, database-level Row Level Security policies, and private file storage with access restricted to the file's owner and authorized administrators.

10. Minimum Age

DocTayo services are intended for users 18 and older. We do not knowingly collect data from anyone under 18.

Applicants under 18 — for example, students applying to direct-entry pharmacy programs — may use DocTayo services only through an account created and supervised by a parent or legal guardian. In that case, we treat the parent or legal guardian as the account holder for purposes of this Privacy Policy, and any data collected is collected from and about that account under their supervision.

11. Changes to This Policy

We may update this policy from time to time. Continued use of the site after an update constitutes acceptance of the revised policy.

12. Contact

Questions about this policy: privacy@doctayo.com