Legal
Privacy Policy
Last updated: 4 September 2026
1. About this policy
This Privacy Policy explains how "Bloomed" ("we", "us", "our") collects, uses, discloses and protects your personal information when you use the website at studywithbloomed.com (the "Site"), the Bloomed app at app.studywithbloomed.com (the "App") and any account you create with us. Together, we call these the "Services".
We handle personal information in accordance with the Privacy Act 1988 (Cth) (the "Privacy Act") and the Australian Privacy Principles ("APPs"). By using the Services or giving us your personal information, you agree to this policy.
2. The personal information we collect
•
Account information - your email address and given name. You give us these when you create an account, either by asking us to email you a sign-in link or by signing in with Google. If you use Google sign-in, Google sends us the verified email address and name on your Google account.
•
Profile information - the details you give during onboarding and in your profile: your institution, year level, stage of training (pre-clinical or clinical), the study tools you currently use, your study goals and your primary study resource.
•
Study activity - every question you answer in the App, which options you chose, whether you were correct, how long you took, the questions you save, and the progress, mastery and competency estimates we derive from your answers to decide what to show you next and to show you how you are going.
•
Feedback and question reports - what you send us through the "Give us feedback" dialog (a topic and your comment), and any rating or report you submit about an individual question.
•
AI tutor messages - the messages you send to FRED, our AI study tutor, and the replies it gives. See section 5 for how these are handled.
•
Enquiries and communications - your name, email address and message when you contact us through the Site, and records of our correspondence with you.
•
Usage and technical information - device type, browser, IP address, log data and how you interact with the Services, collected through cookies and similar technologies (see section 8).
•
Session recordings - recordings of what was on your screen while you used the App, as described in section 4.
Please don't send us sensitive information (such as health information about yourself or anyone else) through the Services. The App is for practising with study questions and is not a place to record real patient information.
3. How and why we use it
We collect personal information directly from you when you create an account, complete onboarding, answer questions, chat with FRED, send feedback or contact us, and automatically as you use the Services. We use it to:
•
create and manage your account, and sign you in;
•
run the App: choose which questions to show you, record your answers, and show you your progress and mastery over time;
•
provide FRED and other personalised study features;
•
respond to your enquiries and feedback, and fix problems with questions you report;
•
understand how the Services are used, and improve and support them (see section 4);
•
keep the Services secure and enforce our Terms of Service; and
•
send you updates about Bloomed where you have consented (see section 7).
4. Analytics and session recording
We use PostHog, a product analytics service, to understand how the App and the Site are used. In plain terms:
•
What is recorded - PostHog records page views, clicks, navigation between screens, errors, and where on the page you interact. In the App it also makes session recordings: a replay of what was on your screen while you used it, including your clicks and how you moved between screens.
•
What is masked - anything you type into a form field is masked and does not appear in recordings. Your conversation with FRED is masked. Text already displayed on the page is recorded, though, including your name and email address in the top bar, the questions you are shown and the answers you choose.
•
Linked to your account - once you sign in, recordings and events are linked to your account (your account identifier, email address and given name), including activity from earlier in the same browser before you signed in.
•
Cookies and local storage - PostHog uses cookies and browser local storage to do this (see section 8).
•
Where it is stored - PostHog stores this data on its servers in the United States.
•
Why we do it - we use this data only to understand how the Services are used, to find and fix bugs, and to improve and support the product. We do not use it to make decisions about you and we do not sell it.
•
Your choices - you can control cookies through your browser settings, but blocking cookies may not stop session recording. If you would prefer your sessions not to be recorded, or have any concern about this, the reliable route is to contact us (section 12) and we will help.
5. FRED, our AI tutor
FRED is a study tutor built into the App. When you chat with FRED, or the App generates suggested questions to ask about a question you have just answered, we send the following to a third-party AI model through OpenRouter, an AI model gateway: the question and its explanations, the messages in your current conversation with FRED, and a snapshot of your recent performance in the App (for example, which concepts you have recently found difficult). We do not send your name or email address with these requests.
Your conversation with FRED is not stored on our servers. It is held in your browser for the question you are working on and is sent back to us with each new message so FRED can follow the conversation. OpenRouter passes each request to the model provider we have configured. OpenRouter and the model provider process this data under their own terms and may store it outside Australia, including in the United States.
Other personalised study features in the App, such as a short teaching note shown after you answer, may use the same AI model gateway with the same kind of information.
6. How we disclose personal information
We disclose personal information to service providers who help us run the Services. They may only use it to provide services to us. The providers we use, by role, are:
•
Hosting and database - our application runs on Fly.io, and your account and study data are stored in a database hosted by Supabase. Both are hosted in Sydney, Australia.
•
Edge delivery and security - Cloudflare serves the Site and the App and routes traffic to our application. Cloudflare operates a global network, so requests may pass through servers outside Australia.
•
Analytics and session recording - PostHog, which stores data in the United States (see section 4).
•
Email delivery - our email delivery provider sends sign-in links to you, and Resend delivers messages from the Site's contact form to us. These providers process your email address and the contents of the message.
•
Sign-in - Google, if you choose to sign in with Google. Google's handling of your Google account is governed by Google's own privacy policy.
•
AI model gateway - OpenRouter and the model provider it routes to (see section 5).
•
Internal team notifications - when a new account is created, we relay the email address to a private channel on Discord that our team uses. When you send feedback through the App, your comment, its topic and your email address are relayed to the same kind of channel. Discord may store these messages outside Australia.
We may also disclose personal information where the law requires it, or where it is necessary to protect the rights, property or safety of Bloomed, our users or others. We do not sell your personal information.
Some of the providers above store or process information outside Australia, including in the United States. Where they do, we take reasonable steps to ensure your information is handled consistently with the APPs, including through our agreements with them.
7. Marketing
We may send you updates about Bloomed where you have consented. You can opt out at any time using the unsubscribe link in any message or by contacting us. Emails we need to send to run your account, such as sign-in links, are not marketing and you will still receive them.
8. Cookies and local storage
We use cookies and browser local storage to keep you signed in to the App, to remember your preferences, and to run the analytics and session recordings described in section 4. You can control cookies through your browser settings. Blocking them may stop parts of the App from working, and may not disable session recording; if that is your concern, contact us instead (section 12).
9. Security and retention
We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Sign-in is by one-time emailed link or Google sign-in; we do not store a password for you. No method of transmission or storage is completely secure.
We keep your account and study data while your account is active, and for a reasonable period afterwards in case you return or we need it to resolve a dispute or meet a legal obligation, after which we delete or de-identify it. You can ask us to delete your account sooner (section 11). Analytics and session recording data are kept by PostHog according to its retention settings for our account. Enquiries and feedback are kept for as long as we need them to respond and improve the product.
10. Children
The Services are intended for medical students and other adults, and you must be at least 16 years old to create an account. We do not knowingly collect personal information from anyone under 16. If you believe we have, contact us and we will delete it.
11. Access, correction, deletion and complaints
You can ask us to access or correct the personal information we hold about you by contacting us below. There is currently no self-service way to delete your account in the App. To delete your account, email us from the address on your account and we will delete your account and study data, subject to any legal requirement to keep some of it. Tell us if you would also like the analytics and session recordings linked to your account deleted, and we will arrange that with PostHog.
If you have a complaint about how we have handled your information, contact us first. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992.
12. Contact us
Email: hello@studywithbloomed.com
13. Changes to this policy
We may update this policy from time to time. The current version is always available at studywithbloomed.com/privacy with the "Last updated" date shown above. If we make a change that materially affects how we handle your information, we will let you know in the App or by email.
bloomed
Made in Melbourne, Australia