Last updated 16 October 2026
FExPrep ("we", "us") is an online question bank and study tool for surgical trainees preparing for the Fellowship Examination. This policy explains what personal information we collect, why, who can see it, and how you can access, correct or delete it. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).
1. What we collect
- Account details: your full name, email address, whether you are a trainee or surgeon, and your AHPRA registration number. Your password is handled by our authentication provider and stored only in encrypted (hashed) form; we can never see it.
- Your study activity: practice answers you write, confidence ratings, questions marked done, your daily review schedule, saved study plans, and generated exams.
- Your notes: notes and pictures you add to questions.
- Messages to us: flags and queries you send about questions, and any emails you send us.
- Questions you submit (surgeon accounts): the question, answer, any picture, and your name as the author.
- Technical information: like any website, the services that host FExPrep receive your IP address and browser details when you visit. We don't use advertising or analytics trackers.
Please don't include patient-identifiable information in answers, notes, pictures, queries or submitted questions. Clinical images must be de-identified and used with appropriate consent.
2. Why we collect it
- To check that you are a registered medical practitioner (using your AHPRA number against the public AHPRA register) before approving your account.
- To run your account and the features you use: saving answers, notes, ratings, progress, study plans and the daily review.
- To respond to your flags, queries and messages, and to review and publish submitted questions.
- To keep the service secure and fix problems.
We don't sell, rent or trade your personal information, and we don't use it for marketing by anyone else. We'll only email you about your account or the service (for example sign-up confirmation, approval and password resets).
3. Who can see it
- Other users can't see your account details, answers, notes, ratings or progress.
- The FExPrep administrator can see account details (to approve sign-ups) and the flags and queries you send. Your answers, notes and progress are private to you. Because the administrator manages the database, they could technically access stored data, but will only do so where needed to fix a technical problem, respond to a request from you, or meet a legal obligation.
- Surgeons' names on submitted questions are visible to the administrator. Contributors listed on the Contributors page have agreed to be listed.
- Service providers that run the website store or process data on our behalf, under their own security and privacy terms:
- Supabase (database, sign-in and file storage)
- Cloudflare (website hosting and delivery)
- our email delivery provider (account emails)
- Google Fonts, cdnjs and jsDelivr (fonts and code libraries, which receive your IP address when pages load)
- Overseas storage: some of these providers store or process data outside Australia (for example in the United States or Singapore). We choose reputable providers with strong security, but overseas laws may differ from Australian law.
- Where required by law: we may disclose information if required by law, a court order or a regulator.
4. On your device
FExPrep stores a few small items in your browser's local storage, such as your filter choices, the question bank view you prefer, and drafts of answers you're writing, so they're not lost if you close the page. These stay on your device and you can clear them in your browser settings. Sign-in uses a secure session token stored the same way.
5. How we protect it
Data is sent over encrypted connections (HTTPS) and stored with our database provider, which encrypts it at rest. Database rules mean each person can only read their own private data. Pictures you upload to notes are stored privately and are only shown to you through short-lived links. No system is completely secure; if a data breach is likely to cause serious harm, we will notify affected users and, where required, the Office of the Australian Information Commissioner (OAIC).
6. How long we keep it
We keep your information while your account is active. If you ask us to delete your account, we'll delete your account details, answers, notes, pictures, ratings and progress within 30 days, except where we need to keep something to meet a legal obligation. Questions you have submitted may stay in the question bank without your name unless you ask for them to be removed. Declined sign-ups are deleted within 90 days.
7. Your choices and rights
- Access and correction: you can ask for a copy of the personal information we hold about you, or ask us to correct it.
- Deletion: you can ask us to delete your account and data at any time.
- Notes and answers: you can delete your own notes, pictures and saved answers yourself at any time.
Email fexprepadmin@gmail.com and we'll respond within 30 days. We may need to confirm your identity first.
8. Complaints
If you're concerned about how we've handled your personal information, email us first and we'll try to resolve it. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
9. Changes to this policy
We may update this policy as FExPrep changes. We'll change the date at the top and, for significant changes, let you know by email or on the site.
Contact
FExPrep · fexprepadmin@gmail.com