Privacy Policy
Iraqi Board Review (IBR) — iraqiboardreview.com
Last updated: 2026-08-19
This policy explains what IBR collects, why, where it is kept, and what you can ask us to do about it. It is written to be understood on one reading.
The short version. We collect what we need to run a question bank and a research desk, and nothing else. We do not sell your data, we do not advertise, and there is no analytics or tracking service anywhere on this site. There is one section you should read carefully even if you skip the rest: Section 5, about research uploads and patient data.
1. What we collect
1.1 When you create an account
| What | Required? | Why we need it |
|---|---|---|
| Full name | Yes | To address you, and to know who we are working with on a research project |
| Email address | Yes | To contact you about your account and your research project |
| Username | Yes | To sign you in |
| Password | Yes (unless you use Google) | To sign you in. Stored so that we cannot read it — see Section 7 |
| Specialty | Yes | Decides which question bank you get |
| Track | Yes | Whether you came for the primary exam, the final exam, or the research desk |
| Training level | Yes | To pitch content and support correctly |
| Institution or hospital | Optional | Context; useful on a research project |
| City | Optional | Context |
| Exam year | Optional | To build a study plan back from your exam date |
1.2 If you sign in with Google
Signing in with Google is optional. If you use it, we ask Google for three things only — your Google account identifier, your email address, and your basic profile (openid email profile). From that we store:
- your Google account identifier, so we can recognise you next time;
- your email address and name; and
- the address of your Google profile picture, which is shown on your own profile.
We never receive your Google password, and we do not ask Google for access to your Gmail, your contacts, your Drive, or anything else.
1.3 What you do while studying
To make the bank work as a study tool, we record:
- which questions you answered, what you chose, whether it was right, and how long you took;
- the exams and sessions you built, and their results;
- questions you flagged, and the notes you wrote on questions;
- your study plan.
This is your own progress data. It is what makes "your weak areas" and "questions you have not seen" possible. It is shown to you and is not shown to other users.
1.4 If you use the research desk
We collect what you enter on the intake form and what you send us afterwards:
- the study — title, research question, rationale, design, setting, city, the period of data collection;
- the population — inclusion and exclusion criteria, sampling, number of cases;
- ethics — the approving body, the reference, the date, and the type of consent;
- the practical detail — your deadline, your supervisor's name, your council, what access you have to patients or records, and your notes;
- what each column of your data file means;
- the fields you told us you are not sure about yet;
- the files you upload — your dataset, your college's thesis template, and any supporting document; and
- the messages between you and the desk about your project.
1.5 Technical information
- Your IP address, used to limit repeated failed sign-in attempts and to slow down attacks on accounts. Throttling records are kept briefly and cleared automatically.
- Operational logs produced by our hosting provider in the ordinary course of serving the site. We use them to keep the service working and to investigate faults and abuse. They are not used to build a profile of you and are not used for marketing.
1.6 What we do NOT collect
- No advertising or marketing trackers. There are none on this site.
- No third-party analytics — no Google Analytics or any equivalent.
- No third-party scripts, fonts, or content delivery networks. The pages load nothing from anyone else's server.
- No payment details of any kind. The research fee is arranged and paid directly with us, off the platform. We never see a card or bank number on this site.
2. Cookies
IBR uses three cookies, and no others. None of them is for advertising or analytics.
| Cookie | What it does | How long | Notes |
|---|---|---|---|
nb_session | Keeps you signed in | 30 days | Cannot be read by scripts (HttpOnly), sent over HTTPS only, signed so it cannot be forged. It also carries a version number, so all your sessions can be ended at once |
ibr_lang | Remembers whether you chose English or Arabic | 1 year | Contains a language code and nothing else |
nb_oauth | Protects the Google sign-in exchange from tampering | 10 minutes | Only set if you start a Google sign-in, and deleted as soon as it completes |
You can delete cookies in your browser at any time. Deleting nb_session signs you out; deleting ibr_lang resets the language.
3. Why we use your information
We use what we collect to:
- run your account and keep you signed in;
- give you the right question bank and record your progress;
- run the research desk — do the analysis and the writing, ask you the questions we need to ask, and deliver your documents;
- contact you about your account or your project;
- protect the service and other users' data from abuse; and
- understand, in aggregate, which specialties are registered, so we know which bank to build next.
We do not use your information to advertise to you, and we do not build profiles for anyone else.
4. Where your data is kept
IBR runs on Cloudflare:
- Accounts, progress, research submissions and messages are stored in a Cloudflare D1 database.
- Files you upload to the research desk are stored in Cloudflare R2 object storage, in a private bucket that is not published to the internet.
Cloudflare is a global infrastructure provider, and the service runs on its network. This means your data is stored and processed on servers outside Iraq. By using IBR you accept that. If that is a problem for your institution, tell us before you upload anything.
Cloudflare processes this data for us, to run the service. It does not use it for its own purposes.
5. Research uploads and patient data — the important section
If you use the research desk, the file you upload may contain information about real patients. Please read all of this section.
5.1 De-identify your data before you upload it. This is your obligation.
Before you send us any file, remove everything that identifies a patient. That means at least:
- names — patient, relative, or anyone else;
- hospital numbers, file numbers, and any other patient ID;
- dates of birth — send age instead;
- addresses and phone numbers;
- facility identifiers where a patient could be recognised from them;
- photographs, scans and documents that carry any of the above, including identifiers printed in a corner or visible in an image.
If you need to be able to link a row back to a patient for your own records, keep the linking key yourself, in your own file, and do not send it to us.
We do not need identifiers to analyse anything. Age, sex, the clinical variables and the outcome are enough for every analysis this service performs.
This obligation is yours. You are the person with a duty to your patients and to your ethics committee, and you are the only person able to check the file before it leaves your hands. We cannot de-identify a file we have not yet received.
If you upload a file that still contains identifiers, tell us immediately and we will delete it and ask you for a clean copy.
5.2 What we do with what you upload
- Your files are private to your account. They are visible to you, and to the staff who process your request. They are shown to no other user.
- This is enforced in the software, and it has been tested against the live service: a request without a signed-in account is refused, and a request from a different signed-in user does not even confirm that the record exists.
- Your data is used only for your own project. It is not pooled, not reused for anyone else's study, not used to train any model, and not published in any form.
- Only the person or people working your case can see it.
5.3 We delete your raw data after delivery
Once your thesis is delivered, your raw dataset is deleted — the file is removed from storage, and only a record that a file once existed remains. Your deliverables stay on your account so you can download them again.
The deletion is automatic, and nobody has to remember it. A scheduled job runs every day and removes the raw uploads of every project that was delivered more than 7 days ago. Those few days exist for one reason: a revision round after your supervisor reads the draft sometimes needs the data again. After that window the file is gone whether or not anyone is at a keyboard.
This is the promise the intake form already makes, and it is the one we keep.
You can ask for deletion sooner. Ask at any time and we will delete your uploads, though we may not be able to continue the work without them.
5.4 If something goes wrong
If we become aware that research files have been exposed to anyone who should not have seen them, we will tell the affected users directly and without delay, say what happened, and say what we are doing about it.
6. Who else sees your data
Nobody, except:
- you;
- the staff who run IBR, and for research files only the people working your case;
- Cloudflare, as the infrastructure provider that stores and serves the data on our behalf;
- Google, and only if you choose Google sign-in — in which case Google knows you signed in to IBR, and that is inherent to using it; and
- a lawful authority, where we are legally required to disclose something.
We do not sell your data. We do not rent, trade or share it for anyone's marketing. There are no advertising partners, because there is no advertising.
7. How your data is protected
- Passwords are stored so that we cannot read them — hashed with PBKDF2-SHA256 (100,000 iterations) and a unique random salt for each account. Older accounts created under a weaker scheme are upgraded automatically the next time you sign in. If you sign in with Google, we hold no password for you at all.
- Sessions are cryptographically signed and can all be revoked at once if an account is compromised.
- Sign-in is rate-limited, by account and by network address, so that passwords cannot be guessed at volume.
- The whole site is served over HTTPS, with a strict security-header set.
- Research files are stored in a private bucket and are served only through a check that the requester owns the record.
- Signup deliberately does not reveal whether a username or an email address is already registered — so nobody can use the form to find out which doctors hold an account.
No system is perfectly secure, and we do not claim otherwise. Section 5.4 says what we will do if something goes wrong.
8. How long we keep things
| What | How long |
|---|---|
| Your account and profile | Until you ask us to delete it |
| Your study progress, notes and flags | While the account exists |
| Research submission details and messages | While the account exists, so you keep the record of your project |
| Your uploaded raw data | Deleted automatically 7 days after your thesis is delivered, or earlier on request |
| Deliverables we produced for you | While the account exists, so you can download them again |
| Failed sign-in records | Days, then cleared automatically |
| Hosting operational logs | As long as our provider retains them in the ordinary course |
9. Your choices, and how to delete your account
You can, at any time:
- See and correct the information on your profile, from inside the app;
- Ask for a copy of what we hold about you;
- Ask us to delete your uploaded research data; and
- Ask us to delete your account and the personal data attached to it.
There is no self-service delete button yet. Until there is, email us at support@iraqiboardreview.com from the address on your account and ask. We will confirm it is you, delete the account and its personal data, and confirm when it is done.
Two things to know about deletion:
- If a research project is in progress, we will need to finish it or stop it first — we will ask you which.
- We may keep a minimal record of a completed paid engagement where we are required to, and anonymous counts (for example "how many accounts chose Neurology") that cannot be traced back to you.
10. Who this service is for
IBR is for doctors, residents and medical students preparing for board examinations. It is not directed at children, and accounts should not be created for anyone under 18.
11. Changes to this policy
If we change this policy we will change the date at the top, and if the change is significant we will show a notice in the app before it takes effect.
We will never make a change that applies retrospectively to research data you have already sent us — the promise you were given when you uploaded is the promise that applies to that file.
12. Contact
Questions about this policy, a request to see or delete your data, or a concern about how something is handled:
support@iraqiboardreview.com
If something about privacy on this service worries you, please write. We would rather answer it than have you wonder.
See also: the IBR Terms of Service.