Your information belongs to you.
This notice explains what this website collects, why it is used, how long it is kept, and the choices available to you.
Last updated: 1 November 2026
Who is responsible for your information?
USMLE WEB operator is the data controller for information processed by this website. Questions and privacy requests can be sent through the contact form or by email to admin [at] usmleweb [dot] com.
Information we process
- Account and sign-in data: which social sign-in provider you use, its account identifier, and the email address it supplies with its verification status. We do not keep your name, profile picture or other profile details the provider sends, we never receive your provider password, and we do not store social-login access tokens.
- Public username: new accounts receive a random username such as
member-48213, never one built from your name or email address. It is the only account detail shown publicly, beside topics and replies you publish, and you can change it on the privacy and account page. - Community data: your selected exam study group, topics, replies, reports, moderation status, and timestamps associated with your account. Study-group membership is not shown publicly; only aggregate group size is displayed.
- Contact data: the name, email address, subject, message, and delivery timestamp you submit through the contact form. The message is also delivered to the configured team mailbox.
- Security data: necessary session and CSRF cookies, CAPTCHA records, and short-lived keyed hashes derived from a network address or account for rate limiting (including sign-in attempts). Raw network addresses are not stored in these records, which expire within minutes to an hour and are purged daily.
- Technical logs: the servers keep error and diagnostic logs, which can include a network address, the page requested and the time. Logs are deleted after 30 days. We also keep a traffic log of every request to the website, for security, abuse investigation and traffic analysis (legitimate interests): your network address, the time, the page requested, the response status, size and time, your browser's user-agent string and the referring page. Secret tokens in links are removed, and cookies, form contents and account identifiers are never recorded. Traffic logs are copied daily to secure archive storage with a cloud provider and deleted after 90 days. The web server in front of the website also keeps an access log of every request, for security, abuse investigation and traffic analysis (legitimate interests): the time, your network address, the page requested, the response status, size and time, your browser's user-agent string and the referring page. Cookies and sign-in credentials are never recorded, and secret tokens in links are replaced. Access logs are stored with a cloud storage provider in the United States and deleted after 90 days.
- Score calculators: the Step 2 CK score predictor, NBME score converter and Step 1 pass probability calculator run entirely in your browser. The scores you type are not sent to our servers, stored, logged or linked to your account.
- Poll data: a keyed, one-way account or session identifier used to prevent duplicate votes. Poll results are shown only in aggregate.
- Optional analytics data: when web analytics is enabled and you choose “Allow analytics,” the analytics tag processes information about page visits, browser and device characteristics, approximate location derived from the network address, referring pages, and interaction events. The website does not send account IDs, names, email addresses, forum text, contact messages, or study-group selections to the analytics service.
Information from other sources
The residency and fellowship directories republish program details from official sources such as the AAMC ERAS participating-program list and programs' own websites. Where an editor has verified them against an official program source, they can include the professional name, role and work contact details of a program director, coordinator or other program leader, published for applicants' benefit (legitimate interests, Article 6(1)(f)). Photos are not republished, and current residents and fellows are never named; only the number of trainees a program reports is shown. Program staff can ask for a correction or removal through the contact form. News pages show headlines, dates and short descriptions published by the original news organizations.
One discussion board on two websites
The community discussion board on this website is also published on usmle-forum.org. Both websites are operated by the same controller named above, use the same member accounts, and read and write one shared set of records in the same database. This is how the board has been run since before the second website existed; it is not something you need to set up.
- What is shared: your account (sign-in provider, its account identifier, email address and verification status, public username), your topics, replies and reports, their moderation status and timestamps, and moderation cases and spam incidents. A topic or reply you publish here appears on both websites, with your public username, and so does one you publish there.
- What is not shared: each website has its own sign-in session and cookies (a cookie set on one domain cannot be read on the other), its own contact messages, advertising records, request logs and analytics choice. Study groups, polls and the other guides on this website are not part of the shared board.
- One set of rules: the same community guidelines and automated moderation apply on both. Incidents are counted together, so a pause triggered on one website applies on both, and a moderator decision is the same on both.
- Your rights apply once: changing your public username, downloading your information or deleting your account on either website changes it on both, because it is the same record. Contact messages are kept separately by each website; if you wrote to both, make the request to both (the contact form here, and the one on usmle-forum.org).
Why we use it
Account and community processing is based on performance of the service you request (GDPR Article 6(1)(b)). This information is needed to provide sign-in, publishing, moderation, and account-management features you request. Security and moderation processing supports the website's legitimate interests (Article 6(1)(f)) in preventing spam, fraud, harassment, and service abuse. Contact information is used to answer your request on the basis of legitimate interests or pre-contractual steps, as applicable. Optional analytics processing is based on your consent (Article 6(1)(a)). You may refuse or withdraw analytics consent without losing access to the website. We may retain specific information where law requires it or where it is necessary to establish, exercise, or defend legal claims.
Automated moderation
Before a topic or reply reaches a human moderator, automated checks reject links, images, explicit sexual content and common spam patterns. If an account triggers more than three such incidents within 48 hours, it is paused automatically and an administrator is alerted; a person then reviews the account and the quarantined messages and decides whether to restore it. Nothing is published without human approval. If you think a decision is wrong, contact us and a person will review it.
Cookies and similar technologies
Essential cookies support sign-in, security, form protection, CAPTCHA, messages, and your saved cookie choice. Analytics remains disabled unless it is configured by the operator and you explicitly select “Allow analytics.” The analytics tag is not downloaded and no analytics request is sent before that choice. Sponsored placements do not use advertising cookies or third-party tracking code. The study checklists save your ticks in your browser's local storage on your own device; they are never sent to us.
| Cookie | Purpose | Typical duration |
|---|---|---|
sessionid | Maintains a signed-in session, security checks and poll de-duplication. | 14 days, or until you sign out |
messages | Carries a one-time confirmation or error message to the next page. | Until the message is shown |
csrftoken | Protects forms against cross-site request forgery. | Up to one year |
usmle_cookie_choice | Remembers the cookie choice made in the banner. | One year |
_ga, _ga_* | Distinguish browser instances and maintain analytics session state. Created only after analytics consent. | Up to two years, subject to the configured analytics retention settings |
Use at any time to review or change your choice. Choosing “Essential only” prevents the analytics tag from loading. Withdrawing a previous analytics choice disables further collection and attempts to remove first-party analytics cookies from this domain. Data already processed by the analytics provider is governed by the configured retention and deletion controls. Essential cookies cannot be disabled through the banner because the requested secure features cannot work without them. You can also block cookies in your browser, though sign-in and forms may stop working.
Sharing and external services
Authorized website administrators can access contact and moderation records when needed. The website is hosted in cloud data centres in the United States (US East and US Central regions). A cloud storage provider stores archived traffic logs. An email service provider processes outbound emails; the receiving team mailbox also holds a copy. Hosting, delivery and mailbox providers process connection information needed to operate their services. Your chosen social sign-in provider processes authentication under its own privacy terms. Styles, scripts and images are delivered by this website or its configured content delivery provider. Delivery providers receive connection information such as IP addresses to serve and protect these resources. If you allow analytics, an analytics provider acts as an additional processor and receives the optional analytics data described above. Advertising-personalization, advertising-storage and cross-device signal features are disabled by the website's tag configuration. Sponsored placements display contextual text without advertising cookies, profiling, tracking pixels or embedded third-party code. Advertiser websites receive connection information only when you follow their links. Following a publisher or residency-program link takes you to a separate website with its own privacy practices. Program details are gathered from the public text of programs' official websites on our own server. Uptime and scheduled-job monitoring services check the website and receive status signals only, never visitor or member information. We do not sell personal information.
How this website earns revenue
This website generates revenue from sponsorships paid for by third parties and from affiliate links, including the book links on the Study books and checklist pages, which lead to an online retailer. Sponsored placements are labeled “Sponsored,” and affiliate links are marked as such. If you follow an affiliate link and make a purchase or sign up with the other website, we may earn a commission at no extra cost to you. Sponsors and affiliate partners do not receive your account details, community activity or any other personal information from us. When you follow a sponsor or affiliate link you leave this website, and the other website may receive connection information and set its own cookies, including to credit a referral to us, under its own privacy practices. Some sponsored placements are supplied through an advertising service. This website chooses which one to show on its own servers, so nothing about you is sent to that service; we count views and clicks here and share only the totals. Sponsored links may pass through a redirect on this website, which counts the click and then sends you on, and images are served from this website. Revenue does not change how your personal information is used here.
International processing
Website records are processed in the United States. Where GDPR international-transfer rules apply, the operator must establish an applicable transfer mechanism, such as an applicable adequacy decision or Standard Contractual Clauses with any necessary supplementary safeguards. Contact the privacy team for details of the safeguards applicable to your information and how to obtain a copy.
Retention
- Account information and associated community records are kept while the account exists, unless you delete the account or request earlier removal.
- Contact messages are deleted from the website database after 365 days. The operator should apply the same schedule to copies in the team mailbox unless a shorter or legally required period applies.
- Rejected forum submissions are deleted after 90 days.
- Resolved moderation reports are deleted after 365 days.
- Server error and diagnostic logs are deleted after 30 days.
- Web server access logs are deleted after 90 days.
- Traffic logs are deleted after 90 days.
- The managed database provider keeps automatic backups for 7 days, so information deleted from the website disappears from backups within that period.
- Expired CAPTCHA challenges, sessions and rate-limit records are removed by daily maintenance. Pending moderation cases remain restricted to staff until reviewed; resolved account reviews follow the resolved-report schedule.
Your rights
Depending on where you live and the circumstances, you may have rights to access, correct, erase, restrict, or receive a portable copy of your personal information; object to certain processing; and withdraw consent. You may also complain to the data-protection authority where you live, work, or believe an infringement occurred. We may need to verify your identity before acting on a request and will explain if a lawful exception prevents us from completing any part of it.
Signed-in community members can change their public username, review their submissions and permanently delete their account and associated personal information from the privacy and account page. You can download a JSON copy from that page. We normally respond to rights requests within one month; if a permitted extension is necessary, we explain why within that month. Contact us for correction, additional access or portability requests, an account you cannot access, or information submitted under another email address.
Account deletion
Self-service deletion removes the account profile, linked social-login records, active website sessions, study-group membership, topics, replies, reports, contact messages matching verified email addresses in the website database, and the account-linked poll identifier. It also signs you out. Ask the privacy contact to remove matching mailbox copies or information submitted under a different address. Deleted information can remain in access-restricted database backups, unavailable for ordinary use, for up to 7 days until those backups are deleted. If a backup ever has to be restored, deletions made since it was taken are applied again. Information may be retained only when a legal obligation or legal claim requires it; any retained information is restricted to that purpose. Your social provider account is separate and must be managed with that provider.
Children
This website is intended for medical students and graduates. It is not directed at children under 16, and they should not create an account. If you believe a child has created an account, contact us and we will delete it.
Changes to this notice
Material changes will be reflected on this page with a new update date. If a change requires consent, the website will ask before using the affected optional technology.