EduCase Privacy Policy

1. Scope and Responsible Organization

This Privacy Policy explains how RadOnc eLearning Center, LLC, a Wyoming limited liability company operating EduCase ("EduCase," "we," "us"), handles personal information in connection with its websites, educational platform, contouring tools, learning modules, workshops, residency programs, and assessment or examination services (collectively, the "Services").

Our business address is 680 South Cache Street, Suite 100-9670, Jackson, WY 83001, USA. This policy applies to website visitors, individual users, faculty, administrators, examination candidates, institutional representatives, and individuals contacting us.

For educational or examination records managed on an institution's behalf, the institution typically determines the educational purposes, participant selection, authorized recipients, and relevant retention instructions. EduCase processes such data to deliver contracted Services, subject to the applicable agreement and applicable law. For our own account, billing, website, and security operations, EduCase determines the purposes and means of processing. Roles may vary by program and applicable privacy law.

2. Information We Collect

Depending on the Services used, we may process:

• Identity and contact data: name, email address, username, institutional affiliation, professional role, country, and contact details you provide.
• Account and authentication data: account identifiers, access permissions, login and security records, and password authentication information maintained through our authentication systems. We do not ask users to disclose passwords in support correspondence.
• Educational and assessment data: assigned cases, contour submissions, answers, evaluations, scores, faculty feedback, completion status, timestamps, examination identifiers, attendance or participation records, and activity within authorized programs.
• Technical and usage data: IP address, device and browser characteristics, log events, performance and error information, security events, cookies, and comparable technologies.
• Support and correspondence: information in support requests, communications, feedback, and technical incident reports.
• Commercial and payment data: institutional billing contacts, invoice records, transactions, and payment status. Payment card information, where applicable, is handled by the relevant payment provider under its terms and privacy practices; EduCase should not be assumed to store full card numbers.
• Submitted datasets: educational imaging cases, contours, associated metadata and annotations provided by authorized contributors. Such materials are expected to be appropriately de-identified before submission.

We may obtain information directly from you, from an authorized institution or program organizer, from faculty or administrative users, from service providers supporting our operations, or automatically when you interact with the Services.

3. How We Use Information

We use personal information as reasonably necessary to:

• register and authenticate users; assign authorized access and protect accounts;
• deliver workshops, examinations, assignments, scoring, reports, educational communications, and support;
• share records with the relevant authorized institution, examination authority, or faculty according to program settings and contractual instructions;
• process invoices, payments, client inquiries, and business records;
• diagnose problems, maintain software, protect the Services against abuse, and respond to security incidents;
• comply with legal duties, enforce applicable agreements, and respond to properly authorized requests;
• send relevant operational communications, and marketing communications where permitted, with an available unsubscribe or objection process.

Aggregate statistics and properly de-identified information may be used for platform improvement, educational analysis, or research only where allowed by applicable law, institutional instructions, agreements, and any required permissions. Identifiable learner submissions, candidate records, or clinical datasets are not licensed or disclosed for third-party commercial AI training merely because they are uploaded to EduCase. Any additional use must have an appropriate legal basis and, where applicable, separate written authorization.

4. Legal Bases and Consent

Where a law such as the EU or UK GDPR requires a legal basis, relevant bases may include performance of a contract, legitimate interests in providing and securing the Services, compliance with legal obligations, or consent where required. For institution-directed processing, the institution is responsible for identifying and communicating its applicable legal basis and notices, while EduCase acts under agreed instructions when applicable.

We do not rely on a blanket statement that using the website constitutes consent to all collection, transfers, or disclosures. Where legally required, we request separate consent and allow its withdrawal, subject to lawful continuing processing.

5. Institutional Programs and Examination Results

Authorized program organizers, institutional administrators, faculty, examination boards, and designated reviewers may view participant identities, assignments, activity, submissions, assessment results, and related records to the extent their role and program permissions permit. An institution may independently retain copies of records it exports or receives, subject to its own privacy obligations.

EduCase does not independently determine professional certification outcomes unless explicitly contracted to perform a specified evaluation task. For examinations, the sponsoring institution or examination authority determines candidate notification practices, official record retention requirements, result release, appeals, and other examination governance matters.

If a Service Agreement or data processing agreement specifies narrower access, retention, permitted use, or reporting requirements, those specific obligations apply to that engagement.

6. Clinical Imaging and Sensitive Information

EduCase is designed primarily to host educational case material that has been appropriately de-identified by the contributor. Institutions and contributors must have authority to provide the data and must remove or protect patient identifiers, including identifiers in image headers and potentially identifying image content.

Do not upload identifiable patient health information or other restricted sensitive information unless EduCase and the responsible institution have first established the required written terms, legal authority, and operational safeguards. A link on the website referring to HIPAA does not, by itself, establish that EduCase is acting as a HIPAA business associate for every use case. Where applicable, such responsibilities must be documented in a separate business associate agreement.

If we discover an upload that appears to contain unauthorized identifiable health information, we may restrict access and coordinate appropriate remediation with the responsible organization.

7. Sharing and Disclosures

We may share relevant information with:

• Authorized institutions and faculty: for administration of their programs, educational review, assessments, and records.
• Service providers: infrastructure and hosting, email delivery, payment services, customer support, security, analytics, and technical operations, subject to appropriate contractual and legal protections.
• Accrediting or professional bodies: where authorized and necessary for credit reporting or validation, consistent with the relevant program arrangement.
• Professional advisers and authorities: when reasonably necessary for legal compliance, protection of rights, safety, or a lawful request.
• Successors in a legitimate business transaction: subject to applicable privacy obligations and protections.

We do not sell personal information for money. Whether any analytics or advertising technology constitutes a regulated "sharing" or "sale" under a specific jurisdiction's law depends on actual implementation; applicable opt-out rights will be honored where required. This policy does not authorize unrelated sale or commercialization of identifiable education or examination records.

Named vendors may change over time. The actual services and configurations used should be documented internally and made available to institutional clients when required by agreement or law.

8. Cookies and Website Analytics

We may use necessary session and authentication cookies, security and preference technologies, and, when configured, website analytics cookies or similar tools. These may collect identifiers, device or usage information, and interaction events.

Where required by law, nonessential cookies will be subject to appropriate consent choices. Browser controls may allow you to restrict or delete cookies, but disabling required cookies may interfere with login or other functions. A cookie inventory and notice should accurately describe the technologies actually deployed on the website.

9. International Storage and Transfers

EduCase is operated by a United States company and may use servers or authorized service providers in the United States or other jurisdictions, depending on the Service and agreed deployment. Data locations must not be assumed from a company's mailing address or a reference to a regional server.

Where international transfer requirements apply, EduCase and its institutional clients will use appropriate contractual or other legally recognized safeguards for the relevant transfers, as required. Data location or residency commitments are binding only when expressly confirmed in a signed agreement.

10. Security and Access Controls

We employ administrative, technical, and organizational measures intended to protect information against unauthorized access, alteration, disclosure, or loss. Depending on the system and data, these may include account authentication, role-based access, encrypted communications, restricted operational access, monitoring, maintenance, and backup or recovery procedures.

Specific measures, such as encryption at rest, multifactor authentication, server region, backup interval, recovery objectives, or security certifications, should not be inferred unless separately documented and verified. No internet-connected platform can guarantee perfect security. Where required by law or contract, EduCase will notify the appropriate parties of a qualifying security incident in accordance with applicable obligations and documented procedures.

11. Retention, Export, and Deletion

Retention depends on the type of record, the relevant educational or examination program, the applicable contract, security and accounting needs, legal requirements, and documented instructions from the responsible institution. We do not promise a universal fixed deletion period where none has been operationally verified.

• Active access: educational submissions and account information may remain accessible during the authorized program or subscription period.
• End of engagement: access may end on the contracted expiration date. Expiration of access is not the same as immediate deletion of every underlying record.
• Institutional export: clients may request available exports of records they are authorized to receive, preferably before access expires. Formats and nonstandard fees are governed by the Service Agreement.
• Deletion requests: requests are assessed under applicable law and institution-directed obligations. EduCase may need institutional authorization before deleting official examination or training records maintained on an institution's behalf.
• Legal and operational records: limited data may be retained for accounting, audit, security, dispute resolution, or other lawful purposes.
• Backups: residual copies may persist until overwritten or expired according to verified backup schedules; access is restricted and any restored records remain subject to the applicable deletion obligations.

Any precise deletion deadline, retention period, export format, or backup expiration commitment must appear in the applicable signed agreement, data processing agreement, or published verified retention schedule. In case of a conflict, the specific signed agreement prevails to the extent law permits.

12. Your Privacy Rights

Depending on your location and the law that applies, you may have rights to request access to, correction of, deletion of, or a portable copy of personal information; to object to or restrict certain processing; to withdraw consent where it is the basis for processing; and to appeal or complain to a competent privacy regulator.

To request assistance, use our website contact channel or the support process made available within EduCase, clearly stating that the matter is a privacy request. We may verify your identity and, where an institution controls the relevant records, refer the request to that institution or coordinate with it.

We respond within deadlines required by applicable law, subject to lawful extensions and exceptions. Rights are not absolute, and legitimate educational, examination, legal, or security requirements may limit certain requests. Marketing communications can be opted out of through applicable unsubscribe methods; operational notices may still be required.

13. Children and Minors

EduCase is principally intended for professionals, institutions, and authorized educational participants. It is not directed to children under 13 and does not knowingly solicit personal information directly from them without appropriate authorization. If a program involves minors, the sponsoring organization must arrange appropriate notices, consent, legal authority, and contractual safeguards before enrollment. If we become aware of unauthorized information from a child, we will take appropriate steps under applicable law.

14. Automated Tools and Assessment Processing

Educational scores, contouring comparisons, and other evaluations may be generated automatically from submitted work and configured assessment parameters. Such outputs are intended for educational or authorized examination purposes and may be reviewed by faculty or authorized examiners.

Where applicable law provides rights concerning solely automated decisions producing legal or similarly significant effects, we and the responsible institution will address those rights according to our respective legal roles. EduCase does not independently decide licensing, credentialing, or certification outcomes merely by providing automated assessment tools.

15. Changes to This Policy

We may revise this Privacy Policy to reflect changes in our practices, technologies, or legal obligations. The current version will show its effective or last-updated date. Where required or appropriate, we will provide additional notice of material changes. A revised public policy does not by itself amend a signed Service Agreement or authorize new processing inconsistent with contractual commitments or applicable law.

16. Relationship to Terms and Agreements

This Privacy Policy describes information-handling practices; it is not a promise of uninterrupted system availability or a substitute for an institutional data processing agreement. The EduCase Terms of Use govern general platform use, while a signed Service Agreement and any applicable data processing or business associate agreement govern engagement-specific commitments.

Where a signed agreement imposes additional or stricter privacy, deletion, export, security, or retention obligations for a particular engagement, those obligations control to the extent permitted by applicable law. Mandatory privacy rights always remain applicable.

17. Contact

RadOnc eLearning Center, LLC
680 South Cache Street, Suite 100-9670
Jackson, WY 83001, USA

Website: www.educase.com
Privacy requests: use the EduCase contact page or your organization's designated EduCase support channel.