Last updated 27 July 2026
Osteon is an independent study tool for orthopaedic residents preparing for the OITE and board examinations, operated from California, United States, and reachable at support@osteon.app. This policy describes what we collect, why we collect it, who we disclose it to, and how we protect it.
Account information. You sign in with Google. We receive your email address, name, and profile image from Google, and store them to identify your account. We never receive or store your Google password.
Study data. The answers you select, whether they were correct, how long each question took, the confidence rating you give, and the spaced-repetition schedule derived from them. This is the core of the product — it is what lets the app decide what to show you next and track your progress.
Settings. Your daily question goal, your exam date if you enter one, and your time zone.
AI conversations. If you use the in-app question or topic chat, the messages you send are transmitted to our AI provider to generate a response. We log the number of tokens used and the cost, associated with your account, for billing and abuse monitoring.
Subscription information. Your plan, status, renewal date, and trial history. Payments are processed by Stripe; we never receive or store your card number.
Technical data. Standard server and analytics data — page performance, aggregate traffic, and error reports.
We do not ask for, and you should not submit, any patient information or protected health information. Osteon is a study tool, not a clinical system.
To provide the service: authenticate you, rank and schedule your questions, sync progress across your devices, generate AI responses you request, and manage your subscription. We also use aggregate, non-identifying data to find broken or mis-keyed questions and to improve the content. We do not sell your data, and we do not use it for advertising.
We disclose data only to the service providers needed to run Osteon, each acting on our instructions:
We may also disclose information if required by law, or as part of a merger or sale of the business, in which case you will be notified.
Osteon is operated from the United States and every provider listed above processes data in the United States. If you use Osteon from the European Economic Area, the United Kingdom, or Switzerland, your data is transferred to the United States.
Where those transfers require a safeguard, they are made under the European Commission's Standard Contractual Clauses — together with the UK International Data Transfer Addendum where the UK GDPR applies — incorporated into our agreements with each provider.
Our lawful bases are: performance of a contract for your account, study data, AI responses, and subscription — we cannot run the product without them; and legitimate interests for aggregate analytics, performance monitoring, security, and abuse prevention, balanced against your rights. Where we rely on consent, you may withdraw it at any time.
Data is transmitted over HTTPS and stored encrypted at rest by our providers. Access to your rows is enforced at the database level by row-level security policies keyed to your account, so one user's data cannot be read by another. Administrative access is limited to the operator of the service and is used for support and content correction.
No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your data, we will notify you.
We keep your account and study data for as long as your account exists, because deleting it would destroy the review schedule the product depends on. Cancelling a subscription does not delete your data. When you ask us to delete your account, we remove your personal and study data; limited billing records are retained where required for tax and accounting.
You can ask us to access, correct, export, or delete your data by emailing support@osteon.app. We will respond within 30 days. If you are in the European Economic Area or the United Kingdom you also have the right to object to or restrict processing and to lodge a complaint with your supervisory authority.
Osteon is operated from California. Whether or not we meet the thresholds that make the California Consumer Privacy Act mandatory for a business of our size, we extend these rights to every California resident:
We do not sell your personal information, and we do not share it for cross-context behavioural advertising — as those terms are defined by the CCPA. We have never done so. Because of that there is no “Do Not Sell or Share” process to complete; there is nothing to opt out of.
We do not knowingly collect sensitive personal information as the CCPA defines it. The study data we hold reveals what orthopaedic topics you are weak on, which we treat as confidential and use only to run the product.
To exercise any of these rights, email support@osteon.app from the address on your account, or tell us which account you mean. You may use an authorised agent. We will not charge you, and we will respond within 45 days.
We use cookies only to keep you signed in and remember essential preferences such as your timezone. We do not use advertising or cross-site tracking cookies. Our analytics measure aggregate traffic and page performance.
Osteon is intended for medical professionals and trainees. It is not directed to anyone under 16, and we do not knowingly collect their information.
If we change this policy we will update the date at the top of this page, and for material changes we will notify you by email or in the app.
Questions about this policy or your data: support@osteon.app.