Policies and review status
Last updated 17 July 2026. These policies describe the current product; draft legal material is not a substitute for counsel approval.
Scientific review and content updates
Generated checks verify structure, source mapping, runnable behavior, and internal consistency. They do not constitute scientific approval. Every lesson carries separate scientific, instructional, and accessibility review states. Material scientific corrections should be prioritized immediately; routine content is reviewed on a scheduled release cycle. Public capability and inventory claims must be regenerated from course data. The current catalog remains marked scientific review not started until a named qualified reviewer and date are recorded.
Privacy notice
Anonymous learning progress and code drafts remain in the learner’s browser. When a learner creates an account, PharmLearn stores the supplied name, affiliation, email, password hash, session records, synchronized completion/mastery metrics, plans, bookmarks, notes, capstone progress, and decision-lab work. Control-stream drafts and tutor conversations are not included in account synchronization. Authorized instructors can see enrolled learners’ names, affiliations, emails, and aggregate completion, mastery-component, attempt, hint, and last-sync values; they cannot see private notes, code, question responses, or tutor conversations. Model code and tutor questions sent to API routes are processed to provide grading, execution, or tutoring. For operational statistics and daily AI limits, PharmLearn records page paths, timestamps, account IDs when signed in, pseudonymous hashes for unsigned visitors, model identifiers, token counts, and estimated cost. Raw visitor IP addresses, tutor prompt text, and model replies are not stored in these usage records. The service owner can view operational records and registered-account profile data in a separately protected command center. Learners must not submit patient-identifiable, confidential, or regulated data. Production retention, deletion, subprocessors, email verification/recovery, analytics, and privacy contacts still require deployment-owner and legal approval.
Terms of learning use
PharmLearn is educational software, not clinical, regulatory, medical, or statistical advice. Results must be independently verified before use in research or decisions. Completion indicators and portfolio exports are evidence of activity, not professional certification. A counsel-approved commercial agreement is still required before paid launch.
Accessibility statement
The interface supports keyboard navigation, narrow screens, reduced motion, semantic labels, non-color chart encodings, and text descriptions for course visuals. Automated and browser checks cover these features, but no formal WCAG conformance claim is made. A qualified accessibility review and testing with assistive-technology users remain required. Report barriers through the feedback page.
Security
Accounts use PBKDF2 password hashing, opaque HttpOnly SameSite sessions, learner-only registration unless a server-configured instructor invite matches, role-protected cohort APIs, optimistic progress revisions, request-size limits, and authentication rate limits. Signed-in learners can change their password. A forgotten-password request requires an owner-issued, single-use reset link that expires within 72 hours; the current production workflow requires the owner to deliver that link through a verified support channel. API routes validate dataset paths and keep lesson solutions and question answers server-side until requested through the intended workflow. Production must use HTTPS with secure cookies and durable protected database storage. Do not upload secrets or identifiable health data. Automated email verification and delivery, deployment hardening, dependency scanning, incident response, backups, logging, session administration, and an independent production security review remain release gates.
Voluntary contributions and refunds
PharmLearn learning access is free and does not require a contribution. When enabled, the support page sends contributors to Stripe-hosted checkout; PharmLearn does not collect or store card numbers. PharmLearn records the checkout identifier, payment status, amount, currency, limited payment metadata, and the email returned by the payment provider for reconciliation and support. Contributions support the project, are not subscriptions or purchases, and are not represented as tax-deductible donations. If a payment was made in error, create a support report with the date, amount, and checkout email so the operator can review a refund through the payment provider. Do not include card details in the report.
Content and licensing
Course source mappings identify included reference documents and derived teaching coverage. Mapping is provenance evidence, not permission to redistribute or create derivatives. Ownership, license terms, attribution requirements, and permitted use of every included PDF, excerpt, figure, dataset, and derived lesson must be reviewed and recorded by the rights holder or counsel before commercial release.
Support and corrections
Use the structured problem report for scientific errors, unclear explanations, accessibility barriers, account concerns, or technical failures. Reports are stored for owner review and email delivery is attempted to contact@ai4pharma.org. Do not include patient-identifiable information, passwords, payment-card details, confidential data, or secrets. No response-time commitment is currently published.