Privacy Notice

Osler is built and run by Alie Samy, a medical student at Ain Shams University, as an independent project. It is not run by, or on behalf of, the university. For anything about your data, email aliesamy4@gmail.com.

• Account: your email address, the name you give, your study year, and what you tell us at sign-up (daily study target, biggest challenge).
• What you upload: lecture files, notes and photos you add, plus the text Osler extracts from them.
• How you study: your tutor conversations, the questions you answer and whether you got them right, flashcard reviews, study plans, time spent and streaks.
• Voice, if you use it: audio you record is sent for transcription and isn’t kept after it’s turned into text.
• Technical: login sessions (cookies needed to keep you signed in), and a per-request record of which AI service ran and how much it cost, so we can keep Osler affordable.

We don’t collect health information about you, run advertising, or use tracking cookies.

• To run Osler for you: tutoring, questions, flashcards, notes and your plan, built from your own material.
• To show you your own progress.
• To find bugs and keep costs in check.
• To improve Osler. We look at aggregated usage (e.g. which features get used), not at individual students’ answers.

We never sell your data, and we never use it for advertising.

To work, Osler sends parts of your data to the services below. When you ask the tutor something or generate questions, the relevant part of your material and your question are sent to an AI model. Several of these services are outside Egypt.

• Supabase: database, file storage and sign-in.
• Vercel (USA): hosts the website.
• DeepSeek (China): the default AI model for tutoring, questions, notes and plans.
• OpenAI (USA): search indexing of your material, reading photos, voice transcription and read-aloud.
• Mistral (France): reading scanned PDFs.
• Google (USA): some image and document reading.
• Anthropic (USA): only for administrator testing, never your default.

These providers process data to return a result to Osler. Under their API terms, they don’t use it to train their public models by default. Even so, don’t upload anything that identifies a real patient: no names, photos, file numbers or national IDs. Osler is for studying, not for patient records.

Your conversations, answers and progress are private to you. Other students can’t see them. Shared department material in the Sources library (lectures, study guides, and the notes and questions generated from them) is visible to every signed-in student in that subject. The administrator can access the database to run and fix the service, and only for that purpose.

For as long as your account exists. If you ask us to delete it, we delete your account, uploads, conversations and progress within 30 days. Aggregated counts that no longer identify you may remain. If the pilot ends, we’ll tell you, and delete the data unless you ask to keep your account.

Email us and we will:

• tell you what we hold about you, and send you a copy;
• correct anything that’s wrong;
• delete your account and data;
• stop using your data for anything beyond running your own account.

We reply within 30 days. These rights come from Egypt’s Personal Data Protection Law (No. 151 of 2020), and you can also complain to the Personal Data Protection Centre.

Data travels encrypted (HTTPS). Database access is restricted per user, so each student can only read their own rows, and sign-in uses one-time email codes, not passwords. No system is perfectly secure. If a breach affects your data, we’ll tell you promptly.

If this notice changes in a way that matters, we’ll tell you in the app before it takes effect. The date at the top is the current version.