IQ Apparatus
Back to Home

Privacy Policy

Last updated: August 15, 2026

1. Introduction

IQ Apparatus ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our continuing education platform at IQApparatus.com, including all subdomains, mobile applications, API integrations, and any other services we provide (collectively, the "Service").

By using our Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with any part of this policy, please do not use our Service.

2. Our Role and the Role of Provider Organizations

IQ Apparatus is a multi-tenant platform. Accredited provider organizations ("Organizations") use the Service to publish continuing education activities to their own learners, sometimes under their own branding and domain.

  • Where we are the controller: for accounts you create directly with IQ Apparatus, marketplace purchases you make from us, platform-level analytics, and our own communications with you, we determine how your data is used and this policy governs.
  • Where we are the processor: when you access activities through an Organization (employer, association, or accredited provider), that Organization is the controller of its learner records. We process that data on its instructions under our agreement with it, and the Organization's own privacy notice also applies. Requests about data held on an Organization's behalf may be referred to that Organization.

3. Information We Collect

3.1 Information You Provide

  • Account Information: Name, email address, password, and organization name when you create an account.
  • Professional Information: Degree type, medical specialty, license numbers, and practice information when you enroll in CE activities.
  • Payment Information: Billing details processed securely through our payment processor (Stripe). We do not store full credit card numbers.
  • Activity Data: Your progress, quiz responses, completion status, evaluation and outcomes responses, and certificates earned.
  • Communications: Information you provide when contacting us for support, requesting a demo, or subscribing to updates.
  • Authoring Content: For administrators and authors, the activity content, scripts, images, and source material you submit to the platform, including material you submit to AI-assisted authoring tools.

3.2 Information Collected Automatically

  • Usage Data: Pages visited, features used, time spent on activities, and interaction patterns.
  • Device Information: Browser type, operating system, device identifiers, and IP address.
  • Cookies: We use cookies and similar technologies to maintain sessions and improve user experience.
  • Push Subscriptions: If you opt in to browser notifications, we store the push endpoint and encryption keys your browser generates. See Section 9.

3.3 Information We Do Not Want

The Service is not designed or authorized to receive protected health information (PHI) or individually identifiable health data, and our Terms of Service prohibit submitting it. Do not enter patient identifiers into activity content, assessment responses, support messages, or AI authoring tools. If PHI is submitted in violation of the Terms, we may delete it.

4. How We Use Your Information

We use collected information to:

  • Provide, maintain, and improve the Service
  • Process activity enrollments and generate certificates
  • Track and report CE credits to accrediting bodies (ACCME, ANCC, ACPE, etc.)
  • Send transactional emails (confirmations, certificates, receipts)
  • Send educational follow-up communications for outcomes measurement
  • Personalize activity recommendations based on your specialty
  • Analyze usage patterns to improve educational content
  • Respond to support requests and inquiries
  • Comply with legal obligations and accreditation requirements

We do not use your personal information to train third-party AI models, and we do not make decisions producing legal or similarly significant effects about you through solely automated means.

5. Artificial Intelligence and Automated Processing

The Service includes AI-assisted features. These are authoring tools used by administrators and content authors, not tools that analyze learner records.

  • AI-assisted content and image generation: Text prompts and source material an author supplies are sent to Google AI Studio (Gemini) to draft or refine educational content, scripts, and images.
  • Talking-avatar presenters: Approved script text and the selected avatar and voice identifiers are sent to HeyGen to render presenter videos. The avatars and voices are synthetic and licensed from the vendor; we do not create avatars from your likeness or clone your voice unless you separately provide that material and consent.
  • Recommendations: Activity recommendations are generated on our own infrastructure from your stated specialty and enrollment history, and are advisory only.

We use these vendors under terms that prohibit using our submissions to train their general-purpose models. AI-generated output is reviewed by qualified humans before an activity is published; see our Disclaimer. Authors must not submit personal information about learners or patients to these tools.

6. Information Sharing and Disclosure

We may share your information in the following circumstances:

  • Accrediting Bodies: We report CE completion data to relevant accrediting organizations (ACCME, ANCC, ACPE, AAPA, ADA, ASWB, APA) as required for credit verification.
  • Professional Regulatory Bodies: We may share information with state licensing boards, credentialing organizations, or professional regulatory authorities when required by law, regulation, or accreditation standards.
  • Your Organization: If your employer or professional association provides access to our platform, we may share completion data with them.
  • Selling Organizations: When you purchase an activity published by an Organization through our marketplace, we share the information that Organization needs to deliver the activity, issue credit, and meet its accreditation record-keeping obligations.
  • Service Providers: Third-party vendors who assist with hosting, payment processing, email delivery, AI-assisted authoring, and analytics, bound by confidentiality agreements. See our subprocessor list.
  • Legal Requirements: When required by law, subpoena, or to protect our rights and safety. See Legal Inquiries.
  • Business Transfers: In connection with a merger, acquisition, or sale of assets, with notice to users.
  • Aggregated/De-Identified Data: We may share aggregated, anonymized, or de-identified data that cannot reasonably be used to identify you, without restriction, for research, analytics, reporting, or any other purpose.

We do not sell or share your personal information for cross-context behavioral advertising.

7. Developer API, Integrations, and Agent Access

We offer a public API, webhooks, and an agent (MCP) interface so Organizations can connect IQ Apparatus to their own systems.

  • API keys and agent connections are issued to an Organization and are scoped to that Organization's data. They do not grant access to other tenants' records.
  • When an Organization enables an integration, learner and completion data may be transmitted to the system it designates. That transfer is directed by the Organization, and its handling of the data is governed by its own privacy notice.
  • We log API and agent requests, including timestamps, endpoints, and the key or account used, for security monitoring, abuse prevention, and troubleshooting.

8. Data Retention

We retain your information for as long as your account is active or as needed to provide services. CE completion records, accreditation compliance data, and associated documentation are retained indefinitely (or for a minimum of six (6) years, whichever is longer) to comply with accreditation requirements, regulatory obligations, and audit standards.

You may request deletion of your account; however, we are under no obligation to delete records that we are required to retain by law, regulation, accreditation standards, or contractual obligation. Deletion requests do not override our legal retention obligations, and certain records may be retained in anonymized form even after account deletion.

9. Push Notifications

Browser push notifications are off by default and are enabled only where an Organization has turned the feature on and you have granted permission in your browser. If you opt in, we store the subscription endpoint and keys your browser issues so we can deliver messages about new activities, deadlines, and credit reminders.

You can revoke permission at any time in your browser's site settings, which immediately stops delivery. We delete subscriptions that your browser reports as expired or revoked.

10. Data Security

We implement industry-standard security measures including:

  • Encryption of data in transit (TLS/SSL) and at rest
  • Secure authentication with password hashing
  • Row-level access controls that isolate each Organization's data
  • Regular security assessments and monitoring
  • Access controls limiting employee access to personal data
  • Secure cloud infrastructure with SOC 2 compliant providers

To report a suspected vulnerability, see Legal Inquiries.

NOTWITHSTANDING THE FOREGOING, IQ APPARATUS CANNOT AND DOES NOT GUARANTEE THE ABSOLUTE SECURITY OF YOUR INFORMATION. NO METHOD OF ELECTRONIC TRANSMISSION OR STORAGE IS 100% SECURE, AND WE CANNOT ENSURE OR WARRANT THE SECURITY OF ANY INFORMATION YOU TRANSMIT TO US. YOU ACKNOWLEDGE AND ACCEPT THE INHERENT SECURITY RISKS OF PROVIDING INFORMATION OVER THE INTERNET AND AGREE NOT TO HOLD US RESPONSIBLE FOR ANY BREACH OF SECURITY UNLESS CAUSED BY OUR GROSS NEGLIGENCE OR WILLFUL MISCONDUCT.

11. Your Rights and Choices

Depending on your location, you may have the right to:

  • Access: Request a copy of personal data we hold about you
  • Correction: Update or correct inaccurate information
  • Deletion: Request deletion of your personal data (subject to legal retention requirements)
  • Export: Receive your data in a portable format
  • Opt-out: Unsubscribe from marketing communications

To exercise these rights, contact us at privacy@iqapparatus.com. We will respond to verified requests within thirty (30) days. If the data is held on behalf of an Organization, we will forward your request to that Organization and assist it in responding.

11.1 California Residents (CCPA/CPRA)

If you are a California resident, you have the right to: (a) know what personal information we collect, use, and disclose; (b) request deletion or correction of your personal information; (c) opt out of the sale or sharing of personal information (we do not sell or share personal information for cross-context behavioral advertising); (d) limit the use of sensitive personal information; and (e) not be discriminated against for exercising your privacy rights. Submit requests, including requests made by an authorized agent, to privacy@iqapparatus.com or through our contact form. We verify requests using the email address associated with your account.

11.2 European Economic Area / UK Residents (GDPR)

If you are located in the EEA or UK, you have additional rights under the General Data Protection Regulation, including the right to lodge a complaint with your local supervisory authority. Our lawful bases for processing your data include: performance of a contract, legitimate interests (improving services, fraud prevention), compliance with legal obligations, and your consent where applicable.

12. Cookies and Tracking

We use essential cookies to maintain your session and preferences. We may use analytics cookies to understand how users interact with our Service. We do not use advertising or cross-site tracking cookies. You can control cookie preferences through your browser settings, though disabling essential cookies will prevent you from signing in.

13. Children's Privacy

Our Service is intended for working professionals and is not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe we have collected information from a minor, please contact us immediately.

14. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States, where our infrastructure and most of our service providers operate. We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws, including standard contractual clauses where required.

15. Changes to This Policy

We may update this Privacy Policy periodically. For material changes, we will notify registered users via email to the address associated with their account, in addition to posting the updated policy on our website and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy. If you do not agree with any changes, you must discontinue use of the Service.

16. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: