Privacy Policy

Information you give me

• Your email address. You sign in with a six-digit email code, or with Google or Facebook. Either way I end up with your verified email, which is your account and how I email you.
• Google or Facebook sign-in. If you choose one of these, they confirm your identity and pass me your email and basic profile details. I never receive your password, and their handling of your data is covered by their own privacy policies.
• Background questions (no longer asked). I used to ask a few questions before your first mock: whether you'd sat the GAMSAT before (and, if you had, your most recent section scores), your degree background, whether English is your first language, how far along your study was, which sitting you were targeting, and how you heard about Meridian. I don't ask these any more. If you answered them before, I keep those answers and use them as described in this policy.
• Marketing opt-in. A separate, unticked box for whether you want occasional emails from me (see below).
• The contact form. If you write to me through the contact form, I receive your name, email address and message. It arrives in my inbox as an email, and I keep it like ordinary email correspondence.

Information from sitting a mock

When you sit a mock I record how you interact with it, because that is exactly what lets me tell a good question from a bad one:

• The answers you pick, any changes you make, and which questions you flag for review.
• Timing and navigation: how long you spend on each question, the order you saw them in, and on-screen actions during the sitting (for example moving between questions, leaving and returning to the tab, resizing the window, entering or leaving fullscreen, and attempts to copy text).
• Your score, and a percentile compared with other people who have finished.
• For Section 2 sittings (the free mock and the paid bank): the essays you write, saved as you type, along with how the writing unfolded, such as your word count over time, how much you revise, and whether text was pasted in and how much. For the paid bank I also record the options you pick, such as practice mode topics, and any prompts you reset to sit again.
• Optional feedback afterwards: for any question, whether you guessed it and whether you think it has a problem (with an optional written comment), and after the sitting, how close it felt to the real GAMSAT (or that you haven't sat the real one yet) and any other comment you want to leave. I used to ask a few more questions after a sitting too, like how seriously you treated it, where you sat it, how you went for time and how it compared with the real thing. I don't ask those any more. If you answered them before, I keep those answers and use them as described in this policy.

Before your first free mock you tick a box agreeing that your responses can be analysed to check and improve the questions, and that if you sit Section 2, your essays can be used without your name or email to build essay feedback tools. The paid Section 2 Practice Bank doesn't need that box. If you use the bank without having ticked it, I save your sittings so the bank works for you (your Section 2 page, and giving you prompts you haven't seen). I may also look at how the prompts get used across everyone, to keep the bank working well, but I don't use your essays to build feedback tools. The same goes for any essays you wrote before you ticked the box. Results are only ever published in anonymised, aggregated form (for example an average score, or how difficult a question turned out to be), never in a way that identifies you.

If you buy something

You pay on Stripe's secure checkout page. Stripe collects your name, email address and payment details there. Your card number goes straight to Stripe and never reaches me.

I keep a record of each purchase: your email address, what you bought, how much you paid, the date, Stripe's reference numbers for the payment, and whether it was later refunded or disputed. If you sign in with the same email you paid with, the purchase is linked to your account so you can use it. I use these records to give you access, handle refunds, and meet my tax obligations.

Technical information

Like most websites, I record some standard technical details when you use the site: your browser and device type, screen size, timezone and language, the page or ad that referred you (including any campaign tags in the link), and a scrambled, one-way version of your IP address. I store only that scrambled version, never your actual IP address, and I use it to spot the same person sitting a mock many times, not to identify you.

How I use your information

• To run your sitting, score it, and show you your results and the worked solutions on the site.
• To check that every question is fair and accurate, and to improve the questions over time.
• Later, to email you the upgraded question sets your sitting helped build, free, when they are ready; and, after your GAMSAT results are released, one short email asking how you went.
• If you write Section 2 essays and have ticked the consent box, to build and improve my essay feedback tools. Your essays are only ever used for this in de-identified form, never with your name or email attached.
• If you buy something, to give you access, send your purchase confirmation, handle refunds, and keep the records tax law requires.
• To send you updates and offers, but only if you have opted in (see below).
• To keep the site secure and meet my legal obligations.

I do not sell your personal information to anyone.

Marketing emails

The box for marketing emails is unticked by default, so you only receive them if you opt in. Every marketing email tells you who it is from and includes an unsubscribe link, and once you unsubscribe I stop within five business days. Opting out does not stop the emails that are part of using the site, such as your sign-in code, copies of your Section 2 essays, purchase confirmations, the free upgraded question sets, and the short follow-up after results.

Who I share it with

I use a small number of trusted services to run the site. They only receive what they need to do their job, and each has its own privacy policy:

• Supabase: securely stores your account, your mock data and your purchase records, powers the email, Google and Facebook sign-in, and sends the sign-in code emails.
• Google: if you choose to sign in with Google. My email inbox is also Gmail, so emails you send to hello@meridiangamsat.com (including refund requests and replies to my emails), contact-form messages and question error reports are stored there.
• Facebook: only if you choose to sign in with it.
• Stripe: handles payments if you buy something. Stripe collects your name, email address and payment details on its checkout page, and your card number never reaches me. Stripe may store and process this information overseas, including in the United States.
• Resend: sends the site's other emails, such as purchase confirmations, copies of your Section 2 essays, contact-form messages and question error reports to my inbox, and any updates you have signed up for.
• Cloudflare: hosts the website, forwards email sent to hello@meridiangamsat.com to my inbox, and helps keep the site secure, including the Turnstile bot check on the sign-in and contact forms. Cloudflare processes your IP address as part of that check.

Where your information is stored

Some of these providers, including Stripe for payments, store or process data on servers outside Australia, including in the United States and other countries where they operate. When your information is handled overseas, I take reasonable steps to make sure it stays protected and is only used for the purposes described in this policy.

Cookies

I keep cookies to a minimum. I set a single essential cookie that keeps you signed in after you log in. It lasts up to 30 days, or until you sign out, and without it the mocks can't remember who you are. It isn't used for advertising or tracking, and I don't use Google Analytics, advertising pixels, or any third-party tracking cookies. The sign-in and contact forms use Cloudflare Turnstile, a privacy-friendly bot check that runs a small Cloudflare script on those pages, and my hosting and sign-in providers (Cloudflare, and Supabase, Google or Facebook during sign-in) may set their own cookies to keep the site secure, as may Stripe on its own checkout page. I also use your browser's own storage for a few small jobs: counting anonymous visits and sign-in steps (a random id, not personal information, cleared when you close the tab), remembering what's in your cart, remembering a sitting's end time so a reload doesn't break the timer, and keeping a local backup of your Section 2 essay so a reload never loses your writing. The backup holds the same text that is saved to your account as you type.

How long I keep it

I keep your account and mock data while your account is active and for as long as I need it to calibrate the questions. If you ask me to delete your account, I remove your sign-in details and your profile, and keep your mock answers and essays only in a de-identified form that is no longer linked to you, so the statistics survive without identifying anyone.

Purchase records are different. Tax law requires me to keep them for five years, so I keep them for that long even if you delete your account.

Your rights

You can ask me to show you the personal information I hold about you, correct it, or delete it. Just email hello@meridiangamsat.com and I will help.

Security

Your sign-in uses a secure, signed session, your data sits in a private database with restricted access, and connections to the site are encrypted. No system is ever perfectly secure, but I take reasonable technical and organisational steps to protect your information.

Children

Meridian is intended for GAMSAT candidates, who are adults. It is not aimed at children, and I do not knowingly collect information from anyone under 16.

Complaints

If you are worried about how I have handled your personal information, email me at hello@meridiangamsat.com and I will do my best to put it right. If you are not happy with my response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Changes to this policy

I may update this policy from time to time, for example when I add new products. The “last updated” date at the top shows when it last changed.

Contact

Questions about your privacy? Email me at hello@meridiangamsat.com.