Privacy Policy

1. Information We Collect

RSI Academy collects the following information when you enroll in or use our program:

• Enrollment information: Full name, professional email address, and organization or employer name, collected via our enrollment form.
• Account identifier: When you sign in with a passwordless magic link, Supabase Auth assigns a user ID (uid) linked to your email. We store that identifier to operate your account, entitlements, and related app functionality.
• Payment information: Payment is processed by Stripe, Inc. (web checkout) and, for native app purchases, by RevenueCat with Apple/Google. RSI Academy does not store credit card numbers, bank account details, or other sensitive payment credentials. Those processors' privacy policies govern payment data handling.
• Program activity: Module completion status, quiz and assessment responses, certification exam attempts, and attestation timestamps, stored in our secure database and linked to your account.
• Funnel events: Product-analytics events (for example, prep-page or enrollment funnel steps) keyed to a one-way hash of your email address, used to understand conversion and improve app functionality—not for advertising.
• Flashcard AI usage: Server-side counters of AI Explain requests (stored as flashcard AI usage linked to your user ID), used for rate-limiting and operating the Explain feature. This is separate from locally stored flashcard grades and from the study-content payload sent to Anthropic when you request an explanation.
• Communications: Emails sent to or received from our support address in connection with your enrollment.
• Usage data: Aggregate traffic and visit data collected via HuggingFace Spaces analytics. No personally identifiable usage tracking is performed via advertising SDKs.

2. How We Use Your Information

We use the information collected solely for the following purposes:

• Verifying enrollment status and granting access to program content
• Authenticating magic-link sessions and linking your user ID to entitlements and study features
• Delivering welcome communications, magic-link sign-in email, and program access instructions
• Issuing certificates of completion and NAHQ/AHIMA continuing education documentation
• Operating AI Explain (including usage counters) and optional push notifications
• Responding to support inquiries
• Maintaining required records for continuing education accreditation compliance (NAHQ, AHIMA ACEP)
• Product analytics via email-hash funnel events and improving curriculum content based on aggregate learner outcome data

3. Disclosure to Third Parties

RSI Academy shares your information only with the following parties and only as necessary to operate the program:

• Stripe, Inc. — web payment processing. Your payment data is governed by Stripe's privacy policy at stripe.com/privacy.
• RevenueCat — native subscription and in-app purchase processing on iOS and Android (with Apple App Store / Google Play). RevenueCat receives the identifiers needed to restore and validate entitlements; card numbers are not stored by RSI Academy.
• Resend — transactional email delivery (welcome email, access instructions, and Auth magic-link / OTP email when custom SMTP is enabled). Email content is limited to enrollment confirmation, sign-in, and program access information.
• improvMX — inbound email routing for our domain mailboxes (for example, support correspondence). Message content is handled as ordinary email traffic.
• Supabase — authentication, secure cloud database hosting for enrollment records, entitlements, funnel events, flashcard AI usage, exam attempts, and related program activity data.
• HuggingFace — platform hosting for the RSI Academy application.
• NAHQ / AHIMA — if you request CE credit documentation, your name, completion date, and CEU count will be included in required accreditation records. No additional personal data is shared.

We do not sell, rent, or trade your personal information to any third party for commercial purposes.

4. Security Practices

RSI Academy implements the following security measures to protect your information:

• All data transmitted to and from the RSI Academy platform is encrypted via HTTPS/TLS.
• Enrollment records are stored in Supabase with row-level security (RLS) policies limiting access to authorized service roles only.
• Payment processing is handled entirely by Stripe's PCI-compliant infrastructure. No payment credentials pass through or are stored by RSI Academy systems.
• API keys and service credentials are stored as encrypted environment secrets and are never exposed in application code or public repositories.
• Access to enrollment data is restricted to program faculty and operators on a need-to-know basis.

5. Data Retention

Enrollment records are retained for a minimum of three years following program completion to satisfy continuing education accreditation record-keeping requirements. Upon written request, non-accreditation data may be deleted earlier subject to applicable legal and contractual obligations.

6. Your Rights

You have the right to:

• Request a copy of the personal data RSI Academy holds about you
• Request correction of inaccurate personal data
• Request deletion of your personal data, subject to accreditation retention requirements
• Withdraw consent for communications at any time by contacting us at the address below

To exercise any of these rights, contact us at support@reichertscience.io.

7. Cookies and Analytics

RSI Academy does not use third-party advertising cookies or tracking pixels. The HuggingFace Spaces platform may collect aggregate, non-identifiable traffic analytics. No personally identifiable behavioral tracking is performed within the RSI Academy application.

8. Children's Privacy

RSI Academy is a professional continuing education program intended for adult healthcare analytics professionals. We do not knowingly collect information from individuals under the age of 18.

9. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or applicable law. Material changes will be communicated to enrolled learners via email. The effective date at the top of this page reflects the most recent revision.

11. RSI Academy Mobile App (iOS and Android)

This section describes data practices specific to the RSI Academy mobile applications on iOS and Android, which provide offline flashcard study with optional account sign-in. It supplements the sections above; where practices differ, this section governs the mobile apps.

Data we handle

• Account sign-in. If you choose to sign in, authentication is passwordless: we send a magic-link (or one-time code) to your email via Supabase Auth (and Resend when custom Auth SMTP is enabled). No password is collected or stored. Your Supabase user ID is linked to that email for account functionality. Session tokens are stored locally on your device and are not shared with advertising partners.
• Study activity (local). Flashcard grades, spaced-repetition (SM-2) schedules, and theme preferences are stored locally on your device. This grade/schedule data is not uploaded to our servers.
• Entitlement status. When signed in, the app asks Supabase (and, for native purchases, RevenueCat) whether your RSI Academy subscription grants access to specific study decks. Only access status and the identifiers needed to restore purchases are checked.
• AI Explain. When you request an explanation, the app sends the flashcard identifier, question stem, correct answer, and rationale (and your session token in the request header, if signed in) to our Supabase Edge Function, which forwards that study content to Anthropic to generate a plain-language explanation. Explain requests are not used for advertising or profiling.
• Flashcard AI usage (server). Separate from local grades and from the Anthropic Explain payload, we store server-side counters of Explain requests linked to your user ID (flashcard AI usage) for rate-limiting and operating the feature.
• Notifications. If you grant permission, a device notification token may be stored and registered with Google Firebase (and Apple push infrastructure on iOS) to support optional push notifications. We do not send marketing notifications; push delivery is optional and user-initiated. Firebase Analytics is not enabled for advertising measurement.
• Payments. Native in-app purchases and subscriptions are processed via RevenueCat with Apple App Store / Google Play. Web upgrade options open our website, where Stripe processes payment under its own terms. RSI Academy does not store card numbers.

Service providers

We use the following providers to operate the apps. They process data on our behalf and are not permitted to use it for their own advertising purposes: Supabase (authentication, entitlement, edge functions, usage counters), RevenueCat (native subscriptions and purchase restore), Stripe (web checkout), Resend (transactional and Auth email), improvMX (inbound domain email), Anthropic (AI Explain generation), and Google Firebase / Apple push services (optional notification delivery, if enabled). The apps contain no third-party advertising or crash-analytics SDKs, and we do not sell personal data.

Data retention and deletion

Locally stored study activity remains on your device until you clear the app's data or uninstall it.

How to request deletion. To delete your account and associated server-side data, use https://academy.reichertscience.io/account/delete (also https://academy.reichertscience.io/delete-account) while signed in, or email support@reichertscience.io. Self-serve deletion requires an authenticated session and a typed confirmation phrase. Emailed requests are processed within 30 days, subject to the retention carve-out below.

What deletion removes. Self-serve deletion removes: your sign-in account; prep access grants; hashed product-funnel events tied to your email; AI Explain usage counters; and certification exam attempt records (including legacy attempt records when present). It does not cancel Stripe subscriptions or alter billing allowlists.

What we retain after account deletion. We retain checkout consent records (dual affirmative consent and auto-renewal disclosures associated with a subscription purchase) as required by applicable law, including California AB 2863 and related automatic-renewal record-keeping obligations. Those records are kept for the period required by applicable law. They are not used to operate a deleted account or to market to you, and they are not restored as a live study account.

Children

The RSI Academy app is intended for healthcare professionals and is not directed to children under 18.

This section last updated: August 10, 2026.