Last updated: 24 September 2026.
Key2MD is run by Dan Brittain in Australia. The site provides admissions guidance, coaching enquiries, AI practice feedback, mock exams, email updates and payment links. This policy is written plainly because students should not need a law degree to understand what happens to their information.
Information We Collect
Depending on what you use, Key2MD may collect your name, email address, enquiry details, selected universities, exam timing, account login details, payment status, practice answers, AI feedback, uploaded or recorded MMI/CASPer mock responses, usage limits, credits, subscription status, basic device information, IP address and site analytics events.
The chances calculator can be used without creating an account. If you ask us to email your result, your email address and submitted result are processed to send that requested copy. A copy of the request is also sent to Dan for support. This does not subscribe you to a newsletter. Subscription and enquiry forms may separately store the information you submit.
How Information Is Collected
Information is collected when you submit it through forms, create or use an account, buy credits or subscriptions, request AI feedback, upload or record a mock response, subscribe to email updates, or use site pages that include security, analytics or abuse-prevention tools.
How We Use It
Key2MD uses student information to provide the service requested, reply to enquiries, manage accounts, process payments, deliver AI feedback, maintain review history, send subscribed email updates, prevent abuse of free limits, improve the tools, and keep admin records needed to run the business.
Account Security and Fair Use
To reduce account sharing and protect paid access, Key2MD may record privacy-safe login and usage signals such as hashed device IDs, hashed network groups, approximate country/region from hosting security headers, browser family, timestamps and review counts. Raw IP addresses, full browser strings and raw device IDs are not shown in the admin dashboard. These signals are used for manual review, fraud prevention, support and fair-use monitoring.
AI Practice Content
Practice answers and recordings may be processed by AI services to generate feedback. Students should avoid submitting highly sensitive personal, health, financial or third-party information unless it is genuinely needed for the practice task.
Sharing Your Own Practice
Students can choose to turn one of their own marked stations into a public link. Sharing is off by default and always opt-in. When a student creates a link, they choose exactly what it shows: the station, their recording, their transcript, the marking and the score. Anyone holding the link can open that page without an account, so students should only include what they are comfortable making public. Search engines are asked not to index shared pages. So that any student can choose to share a recording, practice recordings are held for a short period after marking even where they are not otherwise retained for playback, and are then deleted automatically. A recording attached to a share is kept for 60 days from the share and then removed automatically. Deleting the link removes the page, the preview image and any shared recording immediately.
Sensitive Information
Some practice answers may reveal sensitive information if a student chooses to include health, racial or ethnic background, religious or political views, biometric, sexuality, criminal-record or other sensitive details. Do not include sensitive information about yourself or another person unless it is necessary for the task. Where it is submitted, Key2MD uses it only for the relevant service, support, safety, legal or accounting purpose.
Payments
Card payments are handled through Stripe; Key2MD does not store full card numbers. Tutoring and some other offers use bank transfer. Key2MD records the booking or order reference, amount due, payment reports, verified amounts, refunds and verification history. Dan checks the bank record to match your transfer, which may show the sender name and transfer reference. Do not send bank passwords, full card details or unrelated bank statements. Stripe and the banks process payment information under their own policies.
Tutoring and Calendars
To arrange tutoring, Key2MD stores your account and contact details, selected times and time zone, preparation notes, booking terms, changes and payment records. Google Calendar supplies Dan's busy times and receives tutoring event details so sessions do not overlap. Other students see availability, not your name, notes or calendar event. Calendar downloads and optional subscription links contain session times and a My bookings link, without Zoom links. Treat a calendar subscription link as private; anyone with that link can read its calendar until you revoke it in My bookings. Dan shares a unique joining link only when it is safe to join your session.
OSCE Practice
OSCE practice uses fictional cases. Do not include real patient details. OpenAI processes live voice and transcription; Anthropic processes conversation text and feedback requests. This provider processing occurs even when you choose feedback-only storage. Providers may process data overseas under their service terms; Key2MD's storage choice does not promise that providers retain no data.
Feedback only is the default: Key2MD does not save an audio recording, and clears the temporary transcript and notes after feedback or after 24 hours without activity. Saved feedback can contain short quoted evidence from your answers. Choosing full storage also retains the transcript, notes and uploaded voice recordings for later review. Saved attempts and feedback are available to you and Key2MD's administrator. Attempts are linked to your browser, so they are not fully anonymous. You can delete attempts using the tool or contact Dan for help.
Service Providers and Overseas Processing
Key2MD uses providers including Cloudflare for hosting, databases and storage, Resend for email, Stripe for card payments, Google Calendar for tutoring, and OpenAI and Anthropic for AI services. These providers may process or store data in Australia or overseas depending on their infrastructure and policies. Only the information needed for the relevant service should be submitted.
Email Updates
Marketing updates require consent. An enquiry, seminar registration, interview-day kit request or request for a calculator result does not by itself give permission for unrelated ongoing marketing. Newsletter signup sends a confirmation email. We retain your confirmed email address, the wording you accepted, the form source, and request, confirmation and withdrawal dates as evidence of your choice. Unconfirmed links expire after 24 hours. Regular newsletters are currently paused. Requested result emails, booking communications and account messages are separate from newsletters. You can withdraw marketing consent using the unsubscribe page or by contacting Dan.
Who Can Access Student Data
Student data is intended to be accessed only by Key2MD admin users and the services needed to run the site, such as hosting, database, email, payments and AI processing providers. Admin areas are protected and are not intended for public access.
Data Retention
Key2MD keeps data while it is useful for providing the service, maintaining student history, resolving support issues, meeting payment/accounting obligations, and improving safety. Students can request deletion of personal data where deletion is reasonable and legally possible.
Delete or Access Your Data
To request access, correction or deletion, email dan@key2md.net. Include the email address used on Key2MD so the right records can be found.
Students Under 18
Key2MD is designed for senior secondary, undergraduate, graduate and doctor-applicant audiences. If a student is under 18, they should use paid services with parent or guardian involvement.
Security
Key2MD uses account authentication, admin authentication, protected API endpoints and payment-provider security controls. No website can guarantee perfect security, but the site is designed to keep student records out of public access.
Changes
This policy may be updated as the site changes. The latest version will be published on this page.