Privacy Policy

PANCE Agent provides an AI-powered study platform for Physician Assistant students preparing for the PANCE board examination. We are headquartered in Ohio.

Privacy inquiries: questions@panceagent.com · panceagent.com

Every PANCE Agent user has a direct, individual account relationship with us. Your study data, progress, and account information are private to you. Your school’s faculty and program directors have no access to your individual account data through PANCE Agent, and we do not report your performance back to your program.

Your school is not our customer and does not pay us for your access. Its only role is a one-time authorization.

Every school must complete a School Authorization Agreement before any of its students may access PANCE Agent. That agreement is what permits you to use your program’s course materials with the platform, and it sets the terms under which we handle data. It does not give your school access to your account.

We use the information we collect to:

• Provide, maintain, and improve the Service
• Conduct AI tutoring sessions and calculate mastery scores
• Diagnose technical issues and respond to bug reports
• Detect and prevent unauthorized access, fraud, and abuse
• Send transactional emails (email confirmation, password resets, subscription and trial notices, data deletion notices, and program authorization emails)
• Comply with applicable law and respond to legal process

We do not sell your personal information, use your information for advertising, or use your information to train Anthropic’s or OpenAI’s general AI models.

Contractual necessity: Processing your account information, uploaded content, session data, and study results is necessary to provide the Service under our Terms of Service.

Legitimate interests: Processing log data and technical information for security monitoring and fraud prevention.

Legal obligation: Responding to verified legal process and fulfilling data breach notification obligations.

We do not sell your personal information. We share information only as follows:

During upload and synthesis: Your uploaded content is sent to OpenAI’s Embeddings API (for vector representations) and to Anthropic’s Claude (for topic list and study plan generation). Neither provider retains this content for model training.

During study sessions and chat: Each message you send is transmitted to Anthropic’s Claude with relevant context from your uploaded materials and session history. Claude generates the tutor’s response, which is returned to you and stored in your conversation history.

You are always interacting with an AI. PANCE Agent’s tutor is an artificial intelligence system, not a human. Every response during a study session is AI-generated. The AI tutor is not a licensed clinician, educator, or PA.

The Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g (“FERPA”), governs how educational institutions handle student education records. This section explains why it does not restrict what you do with your own account here.

Your school does not disclose your records to us. You subscribe to PANCE Agent yourself, and you choose what to upload. Your school does not send us your grades, transcripts, enrollment file, or any other record it maintains about you. Nothing about your account involves your institution disclosing an education record.

We do not act as a school official. Some education vendors are designated “school officials” under 34 C.F.R. § 99.31(a)(1)(i)(B) so a school can share student records with them. PANCE Agent is not designated that way and does not rely on that exception. We hold no education records on your school’s behalf, and we send your school nothing about you.

What your school’s authorization covers. The School Authorization Agreement is a copyright and data-handling permission: it confirms your program allows its course materials to be used with PANCE Agent, and it commits us to specific security and deletion obligations. It is not a records-sharing arrangement and gives your school no access to your account.

Your rights here come from this policy, not from your school. You can access, export, correct, and permanently delete your PANCE Agent data yourself at any time from Settings. See Section 15. Your separate FERPA rights in the records your institution maintains are administered by your school’s registrar, and are unaffected by your use of PANCE Agent.

Your account: Kept while your account is open. When you delete your account in Settings, it is deleted immediately and permanently, together with your uploads, study data, scores, flashcards, and conversations.

Uploaded content and study data: Kept while your account is open. You can delete individual uploads and conversations yourself at any time.

If your school withdraws its authorization: New uploads are turned off from the withdrawal. Your access continues for 30 days, or uninterrupted if you have an active subscription of your own. Ninety days after the withdrawal, the coursework you uploaded and everything generated from it (the search index, slide images, and flashcards) is permanently deleted, because the permission your uploads relied on has ended. Your account, mastery scores, and conversation history are not deleted.

If you cancel your own subscription: You keep full access through the end of the billing period you have already paid for. When that period ends, your access ends, and 90 days later your account and everything in it is permanently deleted — uploaded coursework, mastery scores, flashcards and conversation history. We email you before that happens, you can export your data at any time, and resubscribing during those 90 days cancels the deletion entirely. This is the one case where your study record does not survive, because the account it belongs to is being closed.

School authorization records: Retained for a minimum of seven years for legal compliance, regardless of whether the school’s relationship with PANCE Agent continues.

Billing records: Payment records remain with Stripe and Link for as long as tax and accounting law requires, including after your account is deleted.

Accounts that are never used: If you create an account but never start a free trial or subscribe, and add nothing to it, we delete it after 30 days.

Free trials: If your trial ends without you subscribing, your account and everything in it — uploaded coursework, study history, and the payment card saved at signup — are permanently deleted 30 days later. We delete the card itself from our payment processor; we do not keep payment details for people who never subscribed.

One retained exception, and why: when we delete that card, we keep a fingerprint of it — a one-way code supplied by our payment processor that identifies the same card again. It cannot be used to charge anything, cannot be reversed into a card number, and is not linked to your name, email, or any deleted account. We keep it for one reason: to enforce the one-free-trial-per-person limit, which would otherwise be trivially defeated by deleting an account and signing up again. We rely on our legitimate interest in preventing fraud and abuse of the free trial as the basis for this.

Backups: Our database provider keeps encrypted daily backups for 7 days. Data you delete can remain in those backups until they expire, up to 7 days after deletion.

We implement administrative, technical, and physical safeguards designed to protect your information, including:

• Encrypted data transmission (TLS) between your browser and our servers
• Encryption of data at rest in our database infrastructure
• Row-level security controls limiting database access to authorized operations
• Secure session token authentication
• Access controls limiting personnel access to user data

No security measures are perfect. In the event of a data security incident affecting your personal information, we will notify affected individuals and relevant authorities as required by applicable law. We maintain a written information security program updated on a regular basis.

You retain ownership. You retain all copyright and other intellectual property rights in the materials you upload. PANCE Agent does not claim ownership of your uploaded content.

Limited license to provide the service: By uploading content, you grant PANCE Agent a limited, non-exclusive license to store, process, index, retrieve, and use your uploaded content solely to provide you with the AI tutoring service. This license does not extend to sharing your content with other users or commercializing your content.

Your representation: By uploading content, you represent that you have the right to use that material in connection with this service.

Content isolation: Your uploaded content is used only to provide your own study sessions and to look into problems you report to us. No other PANCE Agent user has access to your uploaded files or content derived from them.

PANCE Agent has registered a designated DMCA agent with the U.S. Copyright Office and maintains a notice-and-takedown process for copyright infringement claims. See our Copyright Policy for details.

PANCE Agent uses only strictly necessary cookies and browser storage — the minimum needed for the site to work and stay secure:

• Session cookies, placed through our Supabase authentication service, keep you signed in. Without them you cannot log in.
• A security check on our sign-up pages, provided by Cloudflare Turnstile, confirms a person rather than an automated program is creating an account. It runs only on those pages and is used only to stop abuse.
• Browser storage remembers settings you choose, such as light or dark mode, your place in study features, and that you have seen our cookie notice. It stays on your device and is not sent to us for tracking.

Visitor statistics. On our public pages (the home page, About, sign-up and sign-in pages, and the legal pages) we use Vercel Web Analytics to count visits and see which pages and links bring people to us. It records the page address (without any query string or fragment), the referring site, the type of browser and device, and the approximate country. It sets no cookies, uses no browser storage, and does not follow you across other websites. We do not run it inside the signed-in app, so your study sessions, uploads and conversations are never measured.

We do not use advertising cookies, analytics cookies, cross-site tracking, or behavioral advertising, and we do not sell or share your information for advertising. Because everything we set is strictly necessary, we show a notice rather than asking for consent — there are no optional cookies to accept or refuse. You can clear or block cookies in your browser settings, but you will not be able to stay signed in.

PANCE Agent sends these transactional emails, which cannot be opted out of while your account is open:

• Email address confirmation when you sign up
• Password reset links
• A welcome email when your subscription starts
• A notice when your free trial ends
• Notices before your data is scheduled for deletion
• Program authorization emails (to program directors)

Payment receipts and invoices are sent by Link, Stripe’s payment service. We do not send marketing or promotional emails without separate opt-in consent. Our emails are sent from the panceagent.com domain.

PANCE Agent is designed for adult graduate-level students enrolled in Physician Assistant programs. PA programs require a bachelor’s degree as a prerequisite, and our users are uniformly adults. The platform is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13.

If you believe a person under 13 has created an account, please contact us at questions@panceagent.com and we will promptly investigate and delete the account if confirmed.

In the event of a security breach involving your personal information, we will notify affected individuals and relevant regulatory authorities as required by applicable law. Where an incident affects coursework or account data belonging to students of an authorized program, we will also notify that program promptly, as committed in the School Authorization Agreement. That notice describes the incident; it does not identify you.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last Updated” date and notify you by email or prominent platform notice. Your continued use of the platform after a policy update constitutes your acceptance. If you do not agree, you may request account deletion.

For questions, requests, or concerns about this Privacy Policy or our data practices:

PANCE Agent
questions@panceagent.com
panceagent.com

For questions about a School Authorization Agreement, program directors may contact us at the same address with the subject line “School Data Inquiry.”