This Privacy Policy describes how Draper Mock Oral ("we," "us," or "our") collects, uses, stores, and protects information when you use the Draper Mock Oral Platform ("Platform"). We are committed to safeguarding the privacy of our users and the institutions we serve.
1.1. Information Provided by Institutions
When an institution licenses the Platform, we collect:
1.2. Information Managed by Institutions
Institutions upload and manage the following data within their isolated environment:
1.3. Information Collected Automatically
1.4. Information We Do Not Collect
| Purpose | Data Used |
|---|---|
| Providing the Platform | All institutional data as managed by administrators |
| Authentication | Usernames, encrypted passwords, session identifiers |
| Security | IP addresses for rate limiting; audit logs for accountability |
| Email distribution | Email addresses for sending exam credentials and notifications |
| License management | Institution contact information, usage counts |
| Support | Contact information when institutions request assistance |
3.1. Each institution operates in a fully isolated environment. An institution's data — including residents, faculty, content, exams, scores, and credentials — is not accessible to any other institution.
3.2. Tenant isolation is enforced at the database level. All queries are automatically scoped to the requesting institution's environment.
3.3. Platform administrators (Draper Mock Oral staff) do not access institutional data except when explicitly requested for technical support, or as required by law.
4.1. Encryption
4.2. Access Controls
4.3. Infrastructure
5.1. We do not sell, rent, trade, or otherwise share institutional or user data with third parties for marketing or advertising purposes.
5.2. We may share data with the following categories of service providers, solely to operate the Platform:
5.3. We may disclose data if required by law, regulation, legal process, or governmental request.
6.1. Institutional data is retained for the duration of the active license agreement.
6.2. Upon termination of a license, institutions have thirty (30) days to export their data. After this period, data is scheduled for permanent deletion.
6.3. Audit logs are retained for a minimum of one (1) year for security and compliance purposes.
6.4. Expired session records are automatically purged on a regular schedule.
7.1. Institutions are the data controllers for the resident and faculty information they manage within the Platform. We act as a data processor on their behalf.
7.2. Institutions are responsible for:
8.1. To the extent that data managed on the Platform constitutes education records under the Family Educational Rights and Privacy Act (FERPA), the Institution is the educational institution responsible for FERPA compliance.
8.2. We act as a "school official" with a "legitimate educational interest" under FERPA, as a service provider to the Institution, and will handle education records in accordance with the Institution's direction and applicable law.
9.1. Institutions may request export of all their data at any time by contacting us.
9.2. Individual users (residents, faculty, examiners) should direct data access, correction, or deletion requests to their Institution's administrator, as the Institution controls the data.
9.3. If you believe your data has been handled improperly, you may contact us directly at the address below.
The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children.
We may update this Privacy Policy from time to time. Material changes will be communicated to Institution administrators via email at least thirty (30) days before taking effect. The "Last Updated" date at the top of this page indicates when the policy was most recently revised.
For privacy-related questions or requests, contact:
Draper Mock Oral
Email: privacy@drapermockoral.com