1. Who We Are

Rounds (“we,” “our,” “us”) operates the clinical reasoning training platform available at roundslive.com. The service is provided by an independent developer/team based in Nigeria. We are committed to protecting your privacy and handling your personal data in accordance with the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation (NDPR).

2. What Data We Collect

We collect the following categories of personal data:

2.1 Information you provide

Account data: username, email address, and encrypted password.
Profile data: username and any information you choose to share.
Content you submit: case discussion comments and other voluntary submissions.

2.2 Information collected automatically

Usage data: cases attempted, scores, responses submitted, time spent, and feature interactions.
Device data: browser type, operating system, and IP address (anonymised where possible).
Session data: authentication tokens and preferences stored in cookies.

3. How We Use Your Data

We use your personal data for the following purposes:

To create and manage your account.
To deliver personalised AI-driven feedback and scoring.
To track your performance and display progress analytics.
To enable community features such as case discussions.
To improve the Platform through analysis of usage patterns.
To review anonymised session transcripts for AI quality assurance, accuracy improvement, and prevention of misuse.
To communicate important service updates or changes.
To prevent abuse, enforce our Terms of Service, and comply with legal obligations.

4. Legal Basis for Processing

Under the NDPA, we process your data on the following bases:

Consent: you consent by creating an account and accepting these terms.
Contractual necessity: processing is necessary to provide the service you have signed up for.
Legitimate interests: improving the Platform, ensuring security, and preventing misuse.

5. Data Sharing and Third Parties

We use the following third-party services to operate the Platform. Where data is transferred outside Nigeria, we ensure appropriate safeguards as required by the NDPA:

Supabase: authentication, database, and real-time features. Data is stored on US-based servers with appropriate safeguards. Supabase Privacy Policy.
Vercel: hosting and deployment. Vercel Privacy Policy.
xAI (Grok): AI-powered feedback generation. No personally identifiable information is shared in API requests. xAI Privacy Policy.

We do not sell your personal data to third parties. We do not share your data for advertising or marketing purposes.

6. Session Review for Quality Assurance

To ensure the accuracy of AI-generated feedback and to maintain the integrity of the Platform, authorised members of our review team may access session transcripts — including the conversation between you and the AI, your scores, and the AI’s feedback. This review is conducted for the following purposes:

Evaluating and improving AI scoring accuracy.
Identifying and correcting errors in AI-generated feedback.
Investigating suspected misuse or violation of our Terms of Service.

Because misuse investigations require user context, authorised reviewers may see your username and user ID alongside session data. Access is restricted to the review team only, logged for accountability, and revoked when no longer needed. Session data is never shared outside the review team, used to train external AI models, or sold to third parties.

7. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we delete or anonymise your personal data within 30 days, except where we are required by law to retain certain records. Anonymised aggregate data (e.g., average scores) may be retained for analytics.

8. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

Encryption of data in transit (TLS 1.3).
Encrypted password storage using bcrypt.
Row-Level Security in Supabase to isolate user data.
Regular security reviews and dependency updates.

9. Your Rights

Under the NDPA, you have the following rights:

Right of access: request a copy of the personal data we hold about you.
Right to rectification: correct inaccurate or incomplete data.
Right to erasure: request deletion of your data (“right to be forgotten”).
Right to restrict processing: limit how we use your data.
Right to data portability: receive your data in a structured, machine-readable format.
Right to object: object to processing based on legitimate interests.

To exercise any of these rights, contact us through the dashboard or delete your account directly in settings. We will respond within 30 days.

10. Cookies

We use essential cookies for authentication and session management. These are strictly necessary for the Platform to function. We do not use tracking cookies or third-party analytics cookies. Cookie preferences are managed through your browser settings.

11. International Transfers

Your data is stored on servers located in the United States and other jurisdictions. Where third-party services process data outside Nigeria, we ensure appropriate safeguards are in place as required by the NDPA, including contractual provisions that meet the adequacy standards of the Nigeria Data Protection Commission (NDPC). Our AI model provider may change over time as we diversify; the same data protection safeguards apply to all providers we engage.

12. Children's Privacy

The Platform is intended for users aged 18 and over. We do not knowingly collect personal data from individuals under 18. If we become aware that a child has provided us with personal data, we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or through the Platform. Continued use after changes takes effect constitutes acceptance of the updated policy.

14. Complaints

If you believe we have processed your data in violation of applicable law, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC), the supervisory authority for data protection in Nigeria.

15. Contact

For any questions or requests regarding this Privacy Policy, please reach out:

ojonimidev@gmail.com

+234 906 177 2283