Privacy Policy

MEDIMIND MANAGING EMARKETPLACES W.L.L. Operating as Zyura Education Effective Date: August 31, 2026 Last Updated: September 7, 2026

1. Introduction

MEDIMIND MANAGING EMARKETPLACES W.L.L., operating the Zyura Education platform respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, disclose, and protect personal data when you:

Visit www.zyura-e.com;
Create or use a Zyura account;
Access our website, mobile applications, dashboards, or related services;
Use our MCQs, flashcards, study notes, clinical cases, simulations, AI-assisted tools, board-examination preparation, or other educational features;
Purchase or manage a subscription;
Participate as a student, healthcare professional, mentor, affiliate, institutional user, or content contributor;
Communicate with our support, academic, technical, or administrative teams.

This Privacy Policy should be read together with our Terms and Conditions, Cookie Policy, Refund and Cancellation Policy, and any additional notices presented when specific data is collected.

2. Who We Are

Zyura Education is owned and operated by:

MEDIMIND MANAGING EMARKETPLACES W.L.L. Kingdom of Bahrain Commercial Registration Number: 175855-1

Registered Address: Office 22, Building 93, Block 711, Tubli, Kingdom of Bahrain

Email: support@zyura-e.com Privacy enquiries: privacy@zyura-e.com

Website: www.zyura-e.com

For applicable data-protection laws, MEDIMIND MANAGING EMARKETPLACES W.L.L. is generally the organization responsible for determining why and how personal data is processed.

Where an educational institution, university, hospital, training centre, or employer provides access to Zyura, that organization may separately act as a data controller. Zyura may act as its service provider or data processor for certain activities.

3. Scope of This Policy

This Privacy Policy applies to personal data processed through Zyura-controlled services.

It does not govern third-party websites, applications, payment platforms, or services that maintain their own privacy policies, even when they are linked to or integrated with Zyura.

4. Personal Data We Collect

The information collected depends on how you interact with the Platform.

4.1 Account and identity information

We may collect:

First and last name;
Email address;
Mobile telephone number;
Country or region;
Username or internal user identifier;
Password in encrypted or securely hashed form;
Account verification status;
Profile photograph, if provided;
Preferred language;
Communication preferences;
Date of birth or age confirmation, where required.

Zyura should never store passwords in readable plain text.

4.2 Educational and professional profile information

We may collect:

User type, such as student, professional, mentor, or affiliate;
Profession or healthcare discipline;
Specialty or area of practice;
University, college, hospital, employer, or training institution;
Academic year, professional level, or training stage;
Target board examination;
Subjects, systems, topics, and learning interests;
Professional qualifications and experience;
Professional registration or licensing details for mentors or reviewers;
Educational goals and study preferences.

4.3 Learning and activity information

When you use Zyura, we may collect:

Courses, notes, questions, flashcards, and clinical cases accessed;
Answers submitted and assessment results;
Scores, attempts, progress, completion status, and time spent;
Strengths, knowledge gaps, and areas recommended for revision;
Saved content, bookmarks, notes, study plans, and preferences;
Simulation decisions and clinical-reasoning pathways;
Certificates, transcripts, course evaluations, and feedback;
Search queries and feature usage;
AI-generated recommendations and learning analytics.

This information may be used to personalize educational content and provide progress reports.

5. User-Submitted Content

We may process information that users submit through:

Questions or prompts entered into AI tools;
Clinical simulation responses;
Notes, comments, or saved study material;
Support enquiries;
Course reviews and evaluations;
Mentor applications;
Uploaded files or documents;
Reports concerning inaccurate, inappropriate, or unsafe content;
Community or communication features, if available.

Users must not enter real patient-identifying information into Zyura.

You must not upload patient names, identification numbers, medical-record numbers, photographs, contact details, exact dates of birth, or any other information that could identify a patient unless Zyura has expressly authorized that activity under an appropriate legal and institutional arrangement.

Zyura is an educational platform and is not intended to function as an electronic health record or a system for managing identifiable patient information.

6. Mentor and Content-Contributor Information

If you apply to become a mentor, educator, reviewer, author, affiliate, or content contributor, we may collect:

Professional biography;
Educational and employment history;
Professional qualifications;
Licenses and registration details;
Identity-verification documentation;
Areas of expertise;
Availability and session information;
Course descriptions and educational materials;
User ratings and feedback;
Payment and payout information;
Tax or regulatory information where legally required;
Communications with learners and administrators;
Records relating to complaints, refunds, attendance, or quality review.

Only authorized personnel should have access to verification documents.

7. Subscription and Transaction Information

When you purchase a subscription, mentoring session, course, certificate, or other paid service, we may collect:

Subscription type and billing period;
Transaction date and amount;
Currency and payment status;
Billing name and address;
Invoice or transaction number;
Discount, coupon, or referral code;
Subscription renewal and cancellation information;
Refund and chargeback records;
Limited payment-method information supplied by the payment processor, such as card brand and last four digits.

Payments are processed through authorized third-party payment providers. Zyura does not intentionally store complete payment-card numbers, card security codes, or online-banking credentials on its own systems.

8. Affiliate and Referral Information

If you participate in the Zyura Affiliate Program, we may collect:

Affiliate identity and contact details;
Referral links and discount codes;
Clicks, registrations, purchases, and conversions;
Commission calculations;
Refund-related commission adjustments;
Payout details and payment history;
Tax information where required;
Information used to identify fraudulent, duplicate, or self-referrals.

Visitors who use an affiliate link may have a referral identifier stored through a cookie or similar technology.

9. Institutional Accounts

Where access is provided through a university, college, hospital, employer, or training organization, we may receive:

Your name and institutional email address;
Student, employee, or membership identifier;
Assigned program, course, specialty, or learning group;
Account eligibility and access period;
Completion, attendance, assessment, and progress information;
Other information authorized by the institution and permitted by law.

We may provide the sponsoring institution with reports concerning account activation, course participation, progress, completion, and performance when this is necessary to deliver the institutional program.

We will not provide unrelated personal information to an institution without an appropriate legal basis.

10. Technical and Device Information

When you access Zyura, certain information may be collected automatically, including:

Internet Protocol address;
Device type and operating system;
Browser type and version;
Device identifiers;
Language and time-zone settings;
General geographic location derived from the IP address;
Login time and session information;
Pages visited and navigation activity;
Referring website or campaign;
Application performance and error records;
Security events and suspected fraudulent activity.

Precise geographic location should only be collected if a feature requires it and the user has provided appropriate permission.

11. Cookies and Similar Technologies

Zyura may use cookies, pixels, software-development kits, local storage, and similar technologies to:

Authenticate users;
Maintain secure sessions;
Remember settings and preferences;
Preserve learning progress;
Measure site and feature performance;
Diagnose errors;
Prevent fraud and abuse;
Understand use of the Platform;
Measure advertising or campaign performance;
Personalize content, where permitted.

Strictly necessary technologies may operate without optional consent where legally permitted. Analytics, personalization, or advertising technologies will be used according to applicable consent requirements.

Users should be able to accept, reject, or customize non-essential cookies and later change their choices.

Additional information is available in the Zyura Cookie Policy.

12. How We Use Personal Data

We may process personal data to:

12.1 Provide and operate the Platform

Create, verify, and maintain accounts;
Authenticate users and manage access;
Deliver free, trial, and paid services;
Save learning progress and preferences;
Provide courses, MCQs, flashcards, notes, simulations, and assessments;
Issue certificates and transcripts;
Arrange mentorship sessions;
Process subscriptions, payments, refunds, and payouts.

12.2 Personalize the learning experience

Recommend relevant subjects, topics, questions, and cases;
Identify strengths and possible learning gaps;
Adjust content recommendations according to progress;
Generate study plans and revision suggestions;
Display performance and learning analytics.

12.3 Operate AI-assisted features

Process prompts and responses;
Generate educational drafts or explanations;
Support adaptive recommendations;
Evaluate simulation pathways;
Detect duplicate, incomplete, or potentially unsafe content;
Improve the reliability, safety, and usability of AI-assisted functions.

12.4 Communicate with users

Send account and email-verification messages;
Provide security and password-reset notices;
Send subscription, payment, renewal, and cancellation notices;
Respond to questions and support requests;
Provide service and policy updates;
Send marketing communications where permitted.

12.5 Protect Zyura and its users

Detect fraud, misuse, unauthorized access, and security threats;
Investigate complaints and suspected violations;
Enforce our Terms and Conditions;
Maintain audit and security records;
Protect our legal rights and the rights of users and third parties.

12.6 Improve and administer the Platform

Analyze performance and feature usage;
Troubleshoot technical problems;
Conduct quality assurance;
Improve educational content and user experience;
Develop new features;
Produce aggregated or de-identified statistical reports;
Manage finance, compliance, and administrative operations.

12.7 Meet legal obligations

Maintain accounting and transaction records;
Respond to lawful government or regulatory requests;
Comply with tax, consumer-protection, data-protection, and other applicable requirements;
Establish, exercise, or defend legal claims.

13. Legal Bases for Processing

Depending on the circumstances and applicable law, we process personal data on one or more of the following grounds:

Contract: Processing is necessary to create an account or provide requested services.
Consent: You have given permission for a specific activity, such as optional marketing or non-essential cookies.
Legal obligation: Processing is required to comply with applicable laws.
Legitimate interests: Processing is reasonably necessary to operate, secure, improve, and protect the Platform, provided that these interests do not override your rights.
Protection of vital interests: Processing is necessary to protect someone’s life or safety in exceptional circumstances.
Legal claims or substantial public interest: Processing is permitted under applicable law for regulatory, fraud-prevention, safeguarding, or legal purposes.

Where processing relies on consent, you may withdraw that consent. Withdrawal does not affect processing already lawfully completed.

14. AI-Assisted Features and Automated Processing

Zyura uses artificial intelligence to support educational activities. AI features may analyze:

Selected profession, specialty, and examination;
Learning history and performance;
Answers and simulation decisions;
Subjects or topics viewed;
Prompts submitted by the user;
Preferences and educational goals.

AI outputs may contain inaccuracies, omissions, or inappropriate recommendations. They are provided for education and must not be treated as medical advice, a clinical diagnosis, a treatment decision, or a substitute for qualified professional judgment.

Zyura does not intend to make decisions through AI that produce legal or similarly significant effects concerning users without appropriate human review and safeguards.

Information submitted to an AI feature may be transmitted to contracted AI technology providers. We apply contractual, security, confidentiality, and data-minimization measures appropriate to these services:

Model Training: Our AI service providers (including OpenAI API) do not use your submitted prompts, flashcard generations, or outputs to train their foundational models.
Data Retention: Prompts and generated outputs processed through our AI APIs are retained by the providers for a maximum of 30 days strictly for security, safety, and abuse-monitoring purposes.
Rate Limiting & Safety: We enforce daily and monthly AI generation thresholds to protect system stability and prevent abusive automated queries.

Users must not submit confidential patient information, protected medical records, or sensitive personal information into an AI prompt.

15. Sensitive Personal Data

Some information may be considered sensitive under applicable law, including health information and certain identification or professional-verification documents.

Zyura does not request personal health information for ordinary educational use. If a user voluntarily provides sensitive information, we will process it only where there is an appropriate legal basis and when reasonably necessary.

Users should avoid sharing:

Personal diagnoses or medical histories;
Patient information;
Government identity documents unless specifically requested through a secure verification process;
Biometric information;
Information revealing sensitive personal characteristics unrelated to the service.

16. Marketing Communications

With your consent, or where otherwise permitted by law, we may send information about:

New educational content;
Platform features;
Subscription offers;
Courses, examinations, and mentorship services;
Events, webinars, and institutional programs.

You may unsubscribe using the link provided in the message or by contacting us.

Unsubscribing from marketing does not prevent us from sending essential account, payment, security, or service communications.

We do not sell personal data to third parties for their independent marketing purposes.

17. When We Share Personal Data

We may disclose personal data to the following categories of recipients when necessary:

17.1 Technology service providers

These may include providers of:

Cloud Infrastructure & Storage: Amazon Web Services (AWS) for application hosting (EC2) and secure object/media storage (S3).
Database Services: MongoDB Atlas (Cluster hosting) for structured user account and application data.
Authentication Providers: Google OAuth for single sign-on identity verification and authentication.
Video Conferencing & Session Booking: Google Meet API and Zoom API for scheduling and conducting live mentorship sessions.
Email & Communication Platforms: Twilio SendGrid and Mailgun for transactional emails, account verification, customer support, and system notifications.
Artificial Intelligence Providers: OpenAI API services for AI study assistants and simulation processing.
Analytics, Cybersecurity, and Performance: Providers used for tracking platform stability, monitoring performance, and preventing fraud.

17.2 Payment and financial providers

We may share transaction-related information with:

Payment Gateways: Tap Payments for secure credit card and regional payment processing.
Banks, payout providers, and accounting providers.
Fraud-prevention services.

17.3 Mentors and learners

When a mentorship session is booked, necessary information may be shared between the learner and mentor, including names, session details, professional profiles, and relevant communications.

Neither party may use that information for unrelated marketing or unauthorized contact.

17.4 Institutions

Where access is sponsored or administered by an institution, we may share authorized participation, completion, and performance information as described in Section 9.

17.5 Professional advisers and authorities

We may share information with:

Professional Advisers: Lawyers, auditors, accountants, and insurers;
Authorities: Courts, regulators, law-enforcement bodies, or government authorities;
Parties involved in establishing, exercising, or defending legal claims.

Such disclosure will occur only where lawful and reasonably necessary.

17.6 Business transactions

If Zyura or its business assets are reorganized, financed, merged, sold, or transferred, relevant personal data may be disclosed under appropriate confidentiality and data-protection safeguards.

18. International Data Transfers

Zyura is operated from the Kingdom of Bahrain. User data is hosted across secure, encrypted cloud data centers, specifically utilizing Amazon Web Services (AWS) data centers located in the US-East (N. Virginia, us-east-1) region and MongoDB Atlas cloud database clusters.

When transferring personal data internationally, we will use safeguards required by applicable law. These may include:

Transfer to a legally approved country;
Your valid consent, where appropriate;
Contractual data-protection provisions;
A lawful exemption;
Regulatory notification or authorization where required;
Security and risk assessments.

Bahrain’s Personal Data Protection Law regulates transfers of personal data outside the Kingdom, and some transfers may require specific safeguards or authorization. (Ministry of Legal Affairs)

19. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including legal, accounting, security, dispute-resolution, and contractual requirements.

Retention periods may depend on whether the account remains active, the type of subscription or service, legal and financial record-keeping requirements, institutional contracts, security and fraud-prevention needs, complaints or legal disputes, and the user’s deletion request.

Our approved retention schedule is as follows:

Active account data: Retained for the duration of the account.
Deleted account data: Deleted or securely anonymized within 30 days of the deletion request.
Financial and invoice records: Retained for 5 to 7 years to comply with applicable tax and accounting laws.
Password Reset Tokens: Valid for 5 minutes from generation, after which they expire immediately.
Session Access Tokens: Expire automatically (Access Tokens: 7 days; Refresh Tokens: 30 days).
Learning records: Retained while the account is active and for a defined period afterward.
Support records: Retained for up to 3 years for operational and legal dispute resolution.
Email and Security logs: Retained for 90 days for continuous security monitoring.
AI prompts and outputs: Retained by AI providers for up to 30 days for safety and abuse prevention, after which they are purged.
Unsuccessful mentor applications: Deleted after 90 days following the review or appeal period.
Marketing data: Retained until consent is withdrawn or the data is no longer needed.

Backups may retain information for a limited additional period before secure deletion through normal backup rotation.

20. Data Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal data, which may include:

Encryption in transit;
Encryption at rest where appropriate;
Secure password hashing;
Role-based access controls;
Multi-factor authentication for privileged accounts;
Access logging and audit trails;
Secure development and testing practices;
Vulnerability and security monitoring;
Backups and recovery procedures;
Vendor security assessments;
Staff confidentiality and privacy training;
Incident-response procedures.

No system is completely secure. Users are responsible for protecting their passwords and devices and should notify us promptly if they suspect unauthorized account access.

21. Personal Data Breaches

If a personal data breach occurs, Zyura will:

Investigate and contain the incident;
Assess the nature and possible impact;
Take reasonable steps to reduce harm;
Document the incident;
Notify the relevant authority when required;
Notify affected individuals when legally required or when necessary to help them protect themselves.

22. Your Privacy Rights

Subject to applicable law and any lawful limitations, you may have the right to:

Ask whether we process your personal data;
Obtain access to your personal data;
Request correction of inaccurate or incomplete information;
Request deletion or erasure;
Request restriction or blocking of certain processing;
Object to certain processing;
Withdraw consent;
Object to direct marketing;
Request a portable copy of information where applicable;
Ask for information about international transfers;
Challenge certain automated decisions;
Submit a complaint to the relevant data-protection authority.

Bahrain’s Personal Data Protection Law establishes rights for data subjects and obligations for organizations processing personal information. (moh.gov.bh)

To submit a request, contact: Privacy Contact: privacy@zyura-e.com

We may need to verify your identity before completing a request. We will respond within the period required by applicable law.

We may refuse or limit a request where permitted by law, including when necessary to protect another person’s rights, prevent fraud, comply with legal obligations, or preserve legitimate legal claims.

23. Account Deletion

Users may request account deletion through:

The account settings, if this function is available; or
Emailing support@zyura-e.com.

Deletion of an account may result in permanent loss of:

Saved study progress;
Assessment history;
Notes and bookmarks;
Certificates stored only in the account;
Personal recommendations;
Access to purchased or subscribed content.

Some information may be retained where required for payment records, fraud prevention, institutional reporting, legal compliance, or disputes. Where deletion is not required or technically possible, information may be securely restricted or anonymized.

24. Children and Young Users

Zyura is intended strictly for university students, healthcare professionals, and adult learners who are 18 years of age or older.

Individuals below the age of 18 are not permitted to use Zyura or independently consent to data processing. We do not knowingly collect personal data directly from minors in violation of applicable law.

If you believe a minor has provided personal data without appropriate authorization, contact us so that we can investigate and take suitable action.

25. Third-Party Links and Integrations

The Platform may contain links to or integrations with third-party services, such as:

Payment providers;
Social sign-in services;
Video-conferencing platforms;
Reference websites;
Educational resources;
Social-media platforms;
Institutional systems.

Third parties process information under their own terms and privacy policies. Zyura is not responsible for the privacy practices of independently operated third-party services.

Users should review the applicable third-party privacy policy before supplying information.

26. Google API Services User Data Policy

Zyura Education, operated by MEDIMIND MANAGING EMARKETPLACES W.L.L., uses the Google Ads API to manage, monitor, report on, and optimize advertising campaigns for Zyura’s own healthcare education platform.

With authorization, the application may access Google Ads information including Google Ads customer identifiers, campaign and ad-group information, advertisements, keywords, assets, budgets, bids, campaign status, impressions, clicks, advertising costs, conversions, conversion values, and related performance metrics.

This information is used only by authorized Zyura personnel for internal campaign management, reporting, performance analysis, keyword planning, budget management, and advertising optimization. The integration is not offered to external clients or the public.

Zyura does not sell Google user data. Information obtained through Google APIs is not used for unrelated advertising, profiling, or marketing purposes. It may only be shared with service providers when necessary to operate or secure the application and subject to appropriate confidentiality and data-protection obligations.

Google Ads API data and authentication credentials are protected using reasonable administrative and technical safeguards. Access is restricted to authorized personnel, credentials are stored securely, and information is encrypted during transmission.

Google Ads information is retained only for as long as reasonably necessary to provide internal advertising-management and reporting functions or satisfy legal requirements. Users may revoke the application’s Google access through their Google Account security settings. Requests concerning access, correction, or deletion may be sent to support@zyura-e.com.

Zyura’s use of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

27. De-identified and Aggregated Information

We may create aggregated or de-identified information that does not reasonably identify an individual.

We may use this information to:

Understand educational performance trends;
Improve content and Platform functionality;
Conduct internal research;
Produce statistical reports;
Support institutional planning;
Evaluate the safety and effectiveness of educational features.

We will not attempt to re-identify properly de-identified information except when necessary to test or maintain de-identification protections or where permitted by law.

28. Research and Publication

Zyura will not publish identifiable user information in research, academic publications, presentations, or marketing materials without an appropriate legal basis and, where required, specific informed consent.

If Platform data is used for research, Zyura will apply suitable safeguards, which may include:

Ethical or institutional review where appropriate;
Data minimization;
De-identification or anonymization;
Restricted access;
Clear consent procedures;
Written research and data-use agreements.

Acceptance of general Platform terms should not be treated as consent to participate in identifiable research.

29. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

Changes to the Platform;
New features or technologies;
Changes in service providers;
New legal or regulatory requirements;
Changes in our data-processing activities.

The revised Policy will be published with an updated 'Last Updated' date.

If a change materially affects users’ rights or how personal data is used, we will provide appropriate notice and obtain consent where legally required.

30. Complaints

If you have concerns about our processing of personal data, please contact us first so we can investigate.

You may also have the right to complain to the competent data-protection authority in Bahrain or the authority in your place of residence.

Personal Data Protection Authority – Kingdom of Bahrain Official website: www.pdp.gov.bh

31. Contact Us

For questions, privacy requests, complaints, or concerns about this Privacy Policy, contact:

MEDIMIND MANAGING EMARKETPLACES W.L.L. (Operating as Zyura Education)

Registered Address: Office 22, Building 93, Block 711, Tubli, Kingdom of Bahrain

Commercial Registration Number: 175855-1

Privacy Email: privacy@zyura-e.com

Support Email: support@zyura-e.com

Website: www.zyura-e.com