Privacy Policy

Last updated September 4, 2026

This policy explains what information StepExamPrep.com collects, how we use it, and the choices you have. It applies to everyone who visits the site or creates an account. It is part of our Terms of Service.

1. Who is responsible for your data

StepExamPrep.com is operated by ASFMS LLC, 936 SW 1st Ave, #101, Miami, FL 33130 (“we,” “us,” or “our”). We are the data controller for the personal information described in this policy. You can reach us at privacy@stepexamprep.com.

2. Information we collect

Information you give us

• Account details: your name (if provided), email address, and a password, which we store only in hashed form.
• Purchase information: the plan you bought, the date, and the amount. Card numbers and billing details are collected directly by our payment processor, Stripe; we never see or store your full card number.
• Support messages: anything you send us by email, including question error reports.

Information generated by using the Service

• Exam activity: which exams and blocks you start, the answers you select, questions you flag or skip, time spent per question and per block, and your scores. This is the core of the product and is needed to save your progress and show your dashboard.
• Performance analytics: aggregate statistics derived from your answers, such as accuracy by category, best score, and average time per block.
• Session data: a session cookie that keeps you signed in (see section 5).

Information collected automatically

• Server logs: your IP address, browser type and version, device type, the pages you request, timestamps, and referring URLs. Our hosting provider and web server record these automatically for security and troubleshooting.
• Site analytics: Google Analytics collects anonymized page-view data so we can see which pages are used. Remove this bullet if you run no analytics.

We do not collect sensitive categories of information such as health data about you, government ID numbers, or precise location.

3. How we use your information

Purpose	Information used	Legal basis (where required)
Create and manage your account, sign you in, and keep you signed in	Account details, session data	Performance of a contract
Deliver practice exams, save your progress, and show your results and dashboard	Exam activity, performance analytics	Performance of a contract
Process payments and maintain purchase records	Purchase information	Performance of a contract; legal obligation
Respond to support requests and question reports	Support messages, account details	Performance of a contract; legitimate interest
Send transactional emails (receipts, password resets, important service notices)	Email address	Performance of a contract
Send product updates or promotional emails	Email address	Consent, or legitimate interest for existing customers; you can opt out at any time
Improve question quality and the Service (for example, identifying questions that perform poorly)	Exam activity, in aggregate and de-identified where possible	Legitimate interest
Protect the Service from abuse, fraud, unauthorized access, and content scraping	Server logs, session data, account details	Legitimate interest; legal obligation
Comply with law and enforce our Terms	Any of the above as needed	Legal obligation; legitimate interest

4. How we share information

We do not sell your personal information, and we do not share it with advertisers. We share information only with:

• Service providers that help us run the site and act on our instructions. Each receives only what it needs to perform its function.
• Legal and safety recipients when required by law, subpoena, or court order, or when we reasonably believe disclosure is necessary to protect our rights, our users, or the public.
• A successor in the event of a merger, acquisition, or sale of assets, in which case this policy will continue to apply to your information.

5. Cookies

We use a small number of cookies, all of which are necessary for the Service to work:

We do not use advertising or cross-site tracking cookies. Because our cookies are strictly necessary, we do not show a cookie consent banner. You can block cookies in your browser settings, but you will not be able to sign in or take exams if you do.

6. How long we keep information

• Account and exam data: for as long as your account is active. Exam results are retained so that your score history and dashboard remain available to you.
• After account deletion: we delete or de-identify your account and exam records within [30] days, except where we must keep certain records (such as purchase history) for tax, accounting, or legal reasons, typically up to [7] years.
• Server logs: retained for up to [90] days for security and debugging, then deleted.
• Backups: deleted data may persist in encrypted backups for a limited period before those backups are rotated out.

7. How we protect information

All traffic to the Service is encrypted using HTTPS. Passwords are stored using a one-way hashing algorithm and are never stored in plain text. Access to production systems is restricted to authorized personnel. Content updates to our question bank are applied in a way that never modifies or removes records belonging to an in-progress or completed exam attempt. No system is perfectly secure, however, and we cannot guarantee absolute security.

8. Your rights and choices

Depending on where you live, you may have some or all of the following rights. You can exercise any of them by emailing privacy@stepexamprep.com. We will respond within the time required by applicable law and may need to verify your identity first.

• Access: request a copy of the personal information we hold about you.
• Correction: ask us to fix inaccurate information. You can update your email address in your account settings.
• Deletion: ask us to delete your account and associated data (subject to the retention exceptions in section 6).
• Portability: receive your exam history in a machine-readable format.
• Objection and restriction: object to processing based on legitimate interests, or ask us to restrict processing while a dispute is resolved.
• Marketing opt-out: unsubscribe from promotional emails using the link in any such email. Transactional emails (receipts, password resets, security notices) will still be sent.
• Complaint: lodge a complaint with your local data protection authority if you believe we have mishandled your information.

California residents

Under the California Consumer Privacy Act (CCPA/CPRA), you have the right to know what personal information we collect and how we use and share it, to delete it, to correct it, and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of. We honor Global Privacy Control signals as an opt-out where legally required.

Users in the EEA, UK, and Switzerland

The legal bases for our processing are listed in section 3. Where we rely on consent, you may withdraw it at any time. We are located in United States; if you are outside that country, your information will be transferred to and stored there. Where required, we rely on standard contractual clauses or other approved safeguards for such transfers.

9. Children

The Service is intended for adults preparing for a professional licensing examination. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.

10. Third-party links

The Service may link to external sites, such as the CDC Public Health Image Library or the official USMLE website. We are not responsible for the privacy practices of those sites.

11. Changes to this policy

We may update this policy from time to time. We will post the revised version here with a new “Last updated” date, and for material changes we will notify you by email or with a notice on the Service before the changes take effect.

12. Contact

ASFMS LLC
936 SW 1st Ave, #101, Miami, FL 33130
privacy@stepexamprep.com