Privacy Policy
Last updated 2026-11-09.
APEP Exam Prep (apepprep.com.au) is an online study service for physiotherapists preparing for the Australian Physiotherapy Council Written Assessment, operated from Perth, Western Australia. We are an independent provider, not affiliated with or endorsed by the Australian Physiotherapy Council. We handle personal information in line with the Australian Privacy Principles.
What we collect
- Account details: your email address, name, a password (stored only as a salted hash) and, if you choose to give one, a mobile number.
- Sign-up location: the country, region and city Cloudflare attaches to your connection. We do not store your IP address with your account.
- Study progress: the questions you answer and your answers, bookmarks, notes marked as read, your study plan and exam date, mock exam results, and when these happened.
- Product events: a small set of events such as "signed up", "finished a case" or "opened checkout", with a question or case id and a timestamp. No free text and nothing from a patient case. We do not use third-party analytics or advertising trackers.
- Payments: taken by Stripe on Stripe's pages. We never see or store card details. Stripe sends us your email address, the amount and currency, and its reference ids as the record of your purchase.
- Support: your name, email address and message when you contact us or use live chat (with the page you started the chat from), and the question id, reason and note when you report a question. Please do not include patient details.
- Referral or discount codes you use.
- Study reminders: if you turn them on, the push address your browser issues for that device, the reminder time you chose and its time zone. Turning the reminder off deletes them.
What we use it for
- Running the service: signing you in, keeping your progress, building your plan, issuing mock papers, applying daily study allowances, and activating access when a payment is confirmed.
- Account messages: verification links, password resets, payment receipts, notice of changes to your access, and replies to your messages. These are sent whether or not you have opted in to anything.
- Study reminder emails: a reminder to verify your address after you sign up, a short getting-started email if you have not begun, and up to two reminders if you stop studying for a week or more. Each one carries a link to stop them, and you can switch them off in Settings.
- Improving the product: seeing which steps students complete and where they stop, and reviewing questions that are reported as wrong.
- Protecting the content: usage limits, detection of accounts reading far beyond ordinary study, and invisible per-account marks in served text. The marks are a secondary signal only.
- Plans and offers: as an account holder you may occasionally get an email about our plans and offers, for example a shorter pass when your exam is close. Each one identifies us and carries a one-click link to stop them; the Study reminder emails switch in Settings stops them too. We do not share your address with anyone for marketing.
Who else sees it
We do not sell personal information or share it with advertisers. Two providers handle data on our behalf:
| Provider | What they do | What they hold |
|---|---|---|
| Cloudflare | Hosts the site and database, sends our email | The information above, on Cloudflare's network |
| Stripe | Takes payment | Your email, the amount paid, and card details we never receive |
Both are United States companies, so information may be stored or processed outside Australia under their own privacy terms. We disclose information where the law requires it and will tell you when we are allowed to.
How long we keep it
- Your account and progress: while your account exists. If you ask us to delete your account, we delete the account, progress, exam results, product events, contact messages and chats within 30 days.
- Payment records: five years after the transaction, as Australian tax law requires. They hold your email address, the amount and Stripe's references.
- Sign-in sessions: 30 days without use. Verification and password-reset links: 24 hours.
Your choices and rights
You can change your name, email address, phone number and password in Settings. To get a copy of your information, correct it, or delete your account, use the contact page or [email protected]; we respond within 30 days and verify requests that come from a different address. Settings and the contact page stay available after paid access ends.
If you believe we have mishandled your information, contact us first. You may also complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Security, cookies and storage
All traffic is encrypted. Passwords are hashed with a per-account salt, sessions expire and are revoked on sign-out, and study content is served only to signed-in accounts. If we become aware of a breach likely to cause you serious harm, we will tell you.
We use no advertising or tracking cookies. Your sign-in token, progress and preferences are kept in your browser's local storage so the app loads quickly and works offline; your progress is also held on our servers.
Children and changes
The service is for qualified physiotherapists and not intended for anyone under 18.
Changes are posted here with a new date. A change that materially affects how we use your information is announced in the app or by email before it takes effect.