Last updated 24 October 2026
Osteon is an independent orthopaedic study tool for medical students, residents, and surgeons, operated from California, United States, and reachable at support@osteon.app. This policy describes what we collect, why we collect it, who we disclose it to, and how we protect it.
Institutional users and program reporting. We maintain program profiles, public program contacts and their sources, coordinator ownership, resident invitations, and access dates. Coordinators see invitation and acceptance status and manage program access. For institutional users whose accounts are connected to a participating program, we provide its authorized coordinator with study totals, question accuracy, topics read, reading time, Learn progress, lecture progress, Rapid Review completion, and last study date from enrollment onward, as described in the institutional-user provisions of our Terms of Service. Earlier personal activity is excluded. Reporting is part of institutional membership and does not require a separate reporting opt-in; coordinators manage roster removal, which ends program access and reporting while keeping the member’s personal account and history. Members can contact their coordinator or support to correct their membership. Existing optional-sharing arrangements keep their original settings. We do not share personal notes, individual answers, AI chats, or billing details with coordinators. Progress reporting stops when program access expires or a member is removed. Individuals outside a program do not share progress with a coordinator.
Program invitations. For coordinator, resident, and attending invitations, we record when an invitation page is viewed, sign-in or acceptance buttons are clicked, the invited account is verified, and the program is claimed or joined. Administrators use this information to follow up on enrollment. Unverified link activity may include forwarded links or automated checks. We do not use these records to claim that an email was read or to measure reading time inside an inbox.
Account information. We receive your email address, name, and profile image from your sign-in provider to identify your account. We do not receive or store your sign-in password.
Study data. Your answers, results, confidence ratings, study timing, topics visited, reading and listening progress, and review completion. We use this information to personalize your study experience and sync your progress.
We store your email preference and sending history. When you follow a daily email link, sign in as its recipient, and interact with Osteon, we associate that visit and up to two hours of activity in that browser tab with the email. Authorized administrators can see these visits, estimated active time, and study activity to assess whether the emails are useful. We do not measure reading time inside your inbox. You can turn daily emails on or off in your account’s Email preferences or unsubscribe from any daily email.
Messages and feedback. Information you send to support or submit as feedback, including your contact details when provided. Support messages include the originating page and, when sent from a program invitation, the program and invitation role so we can help with your request.
Settings. Your daily question goal, your exam date if you enter one, and your time zone.
AI conversations. If you use the in-app question or topic chat, the messages you send are transmitted to our AI provider to generate a response. We record usage associated with your account to operate the feature, monitor costs, and prevent abuse.
Previous transactions. If you previously made a purchase, joined a purchased program, or earned a referral reward, we retain the records needed to manage that arrangement and meet accounting obligations. We do not store full payment card or bank account details.
Technical data. Standard server and analytics data — page performance, aggregate traffic, and error reports.
We do not ask for, and you should not submit, any patient information or protected health information. Osteon is a study tool, not a clinical system.
To sign you in, provide and personalize study tools, sync progress across devices, respond to your messages, and generate AI responses you request. We use usage and error information to improve the service and maintain security. We do not sell your data. Optional advertising measurement requires your permission.
To help detect automated content extraction, we may use AI to review summaries of account activity, such as access counts and study engagement. These security reviews do not include your name, email address, private notes, or message text. A suspicious pattern may temporarily restrict content access pending administrator review. Contact support@osteon.app to request a review of a restriction.
We use the following categories of providers for the purposes described here:
For optional ad measurement, the receiving platforms are OpenAI, Google, and Meta (Instagram), depending on the ad you clicked. These links explain their data practices.
We may also disclose information when required by law or in connection with a merger or sale of the business, with notice as required.
Osteon is operated from the United States and uses providers that process information there. If you use Osteon from the European Economic Area, the United Kingdom, or Switzerland, your data is transferred to the United States.
Where those transfers require a safeguard, they are made under the European Commission's Standard Contractual Clauses — together with the UK International Data Transfer Addendum where the UK GDPR applies — incorporated into our agreements with each provider.
Our lawful bases are: performance of a contract for providing your account and the features you request; and legitimate interests for aggregate analytics, performance monitoring, security, and abuse prevention, balanced against your rights. Optional ad measurement relies on your consent, which you may withdraw at any time using the preferences below.
Data is transmitted over HTTPS and stored encrypted at rest by our providers. Access controls restrict who can access your information. Administrative access is limited to authorized service operations, support, and content correction.
No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your data, we will notify you.
We keep your account and study data while your account exists so your progress remains available. When you ask us to delete your account, we remove your personal and study data, subject to records we must retain for legal, security, tax, or accounting purposes. Ending a paid arrangement, if any, does not automatically delete your account.
Ad measurement is off unless you allow it. Declining does not affect your access. Withdrawing stops future conversion reporting; it does not undo events already sent. When you are signed in, withdrawal also applies to future reports for your account. We honor Global Privacy Control as a refusal of ad measurement.
You can ask us to access, correct, export, or delete your data by emailing support@osteon.app. We will respond within 30 days. If you are in the European Economic Area or the United Kingdom you also have the right to object to or restrict processing and to lodge a complaint with your supervisory authority.
Osteon is operated from California. Whether or not we meet the thresholds that make the California Consumer Privacy Act mandatory for a business of our size, we extend these rights to every California resident:
We do not sell your personal information. You can decline or withdraw optional advertising measurement using the “Ad measurement preferences / Do not sell or share” control above. No study data is shared for advertising.
We do not knowingly collect sensitive personal information as the CCPA defines it. We treat your study data as confidential.
To exercise any of these rights, email support@osteon.app from the address on your account, or tell us which account you mean. You may use an authorised agent. We will not charge you, and we will respond within 45 days.
Essential cookies keep you signed in and remember preferences such as your timezone. We also remember your ad measurement choice in a first-party cookie for up to 180 days. Only if you allow measurement do we store an ad click identifier in that cookie and, after sign-in, with your account. A click can be used for attribution for up to 30 days. We send conversion events from our server; this integration does not load a third-party advertising script in your browser. Our other analytics measure aggregate traffic and page performance.
Expired click identifiers are cleared during measurement processing. Event details are removed after delivery or withdrawal, except that some delivery attempts retain details for up to seven days for retries. Expired pending events are cleared during processing. Minimal delivery records remain to prevent duplicate reporting. Your browser cookie expires automatically.
When you open a referral link, we store a signed first-party referral cookie for up to 30 days. When you create an account, we save the referral association and remove that cookie. Referral participation is separate from optional advertising measurement.
We retain referral associations to administer invitations and prevent abuse. Referrers see aggregate counts, not your identity or study activity. Any previously earned rewards and payout records remain subject to their agreed terms and applicable recordkeeping requirements. Contact support to request access, correction, or deletion, subject to records we must retain.
Osteon is intended for medical professionals and trainees. It is not directed to anyone under 16, and we do not knowingly collect their information.
If we change this policy we will update the date at the top of this page, and for material changes we will notify you by email or in the app.
Questions about this policy or your data: support@osteon.app.