PRIVACY POLICY

Effective Date: October 13, 2026 Last Updated: October 13, 2026

This Privacy Policy explains how END PEAK, S.L., operating under the brand ENDPEAK (“ENDPEAK,” “we,” “us,” or “our”), collects, uses, stores, shares, and protects personal information when you access or use our websites, applications, educational platform, baseline or diagnostic assessments, question banks, practice and computerized adaptive testing tools, artificial intelligence features, educational media, study tools, and related services (collectively, the “Services”).

We are committed to handling personal information responsibly, transparently, and in accordance with applicable privacy and data protection laws.

Please read this Privacy Policy carefully.

By using the Services, you acknowledge the practices described in this Privacy Policy.

1. WHO WE ARE

The controller responsible for your personal information is:

END PEAK, S.L. Operating as ENDPEAK Spanish limited liability company (S.L.) Camí Nou de Picanya, 31, Escalera Izquierda, Puerta 2 46014 Valencia Spain

Privacy inquiries: contact@endpeak.com General support: contact@endpeak.com

If we appoint a Data Protection Officer (“DPO”), the DPO's contact information will be made available here.

2. SCOPE OF THIS PRIVACY POLICY

This Privacy Policy applies to personal information processed through ENDPEAK, including information associated with:

ENDPEAK accounts;
free access;
free trials;
paid subscriptions and fixed-duration plans;
baseline, diagnostic, or other educational assessments;
question banks;
practice questions and practice examinations;
NCLEX-style questions;
Next Generation NCLEX-style questions;
case studies;
Computerized Adaptive Testing (“CAT”) simulations;
study plans;
RN-topic and other study materials;
flashcards;
study text and audio materials;
on-demand, scheduled, premiere, recorded, or live educational media;
readiness and performance predictions;
progress tracking;
performance analytics;
achievements;
artificial intelligence features;
live educational sessions;
recorded educational sessions;
user communications;
customer support;
email communications;
platform security; and
related ENDPEAK Services.

This Privacy Policy does not govern third-party websites or services that operate independently from ENDPEAK.

3. INFORMATION WE COLLECT

The personal information we collect depends on how you interact with ENDPEAK.

3.1 Account and Identity Information

When you create or manage an ENDPEAK account, we may collect:

first and last name;
email address;
account identifier;
authentication information;
password-related authentication data;
account creation date;
account status;
phone number, if you provide one;
profession or role, if you provide it;
institution or organization, if you provide it;
country;
state or region;
timezone;
preferred language, where available;
user preferences; and
other information you voluntarily provide when setting up or updating your profile.

Passwords are not intended to be visible to ENDPEAK personnel in plain text and should be processed using appropriate authentication and security systems.

3.2 Educational and Study Information

Because ENDPEAK is an educational platform, we process information about how you study and perform within the Services.

This may include:

questions presented to you;
answer selections;
correct and incorrect responses;
partially correct responses;
question difficulty;
time spent answering questions;
examination start and completion times;
Q-Bank activity;
questions answered;
questions skipped;
bookmarked questions;
incorrectly answered questions;
case study performance;
CAT examination performance;
estimated ability levels;
performance measurements;
study-plan progress;
topics completed;
topics in progress;
topics being reviewed;
flashcard activity;
practice history;
study frequency;
study duration;
readiness estimates;
pass-readiness or predictor outputs and similar performance indicators;
achievement progress;
educational recommendations;
historical performance trends; and
other information generated through your use of ENDPEAK's educational tools.

We use this information to provide the educational functionality of ENDPEAK and to personalize your study experience.

4. PERFORMANCE ANALYTICS AND PROFILING

ENDPEAK may analyze your educational activity to generate personalized study information.

For example, we may analyze:

your answer history;
accuracy;
question difficulty;
performance by topic;
response patterns;
study frequency;
time spent studying;
CAT examination performance; and
historical learning progress.

This information may be used to generate:

performance reports;
readiness estimates;
suggested study priorities;
personalized study plans;
topic recommendations;
progress indicators;
estimated examination readiness; and
other educational analytics.

These systems are intended to assist you with studying.

ENDPEAK does not use examination predictions, CAT results, study analytics, or readiness estimates to make decisions that produce legal or similarly significant effects concerning you.

ENDPEAK does not determine whether you may become a nurse, receive a professional license, obtain employment, enroll in a school, or take the official NCLEX examination.

We do not provide your ENDPEAK readiness results to nursing regulatory bodies, NCSBN, Pearson VUE, educational institutions, prospective employers, or licensing authorities unless:

you specifically direct us to do so;
such disclosure is necessary to provide a feature you requested; or
disclosure is required by law.

ENDPEAK performance predictions are educational estimates only.

5. ARTIFICIAL INTELLIGENCE INFORMATION

ENDPEAK may provide artificial intelligence-powered functionality.

When you interact with an AI feature, we may process:

your prompts;
questions submitted to the AI;
conversation history;
AI-generated responses;
educational context associated with the conversation;
relevant ENDPEAK study content;
account identifiers;
technical logs; and
feedback you provide concerning AI responses.

We may use retrieval and similar technologies to provide the AI system with relevant ENDPEAK educational content.

Important Privacy Requirement

Do not submit identifiable patient information, protected health information, confidential medical records, Social Security numbers, payment-card information, examination-confidential information, or other highly sensitive information through ENDPEAK's AI features.

ENDPEAK is an educational platform and is not intended to function as a medical-record system or repository for patient information.

Clinical scenarios used for educational purposes should be fictional, de-identified, or otherwise lawfully provided.

We may use AI service providers to process AI requests on our behalf.

Where reasonably available, we configure service providers and contractual arrangements to limit processing to providing, securing, and supporting the relevant Services.

ENDPEAK does not intentionally use private user AI conversations to train publicly available or general-purpose AI models unless we provide appropriate notice and obtain any consent required by applicable law.

AI interactions may be reviewed where reasonably necessary for:

investigating reported problems;
improving safety;
diagnosing technical issues;
addressing abuse;
responding to a support request; or
improving the ENDPEAK service.

Access is limited to authorized personnel and service providers with a legitimate need to process the information.

6. PAYMENT AND SUBSCRIPTION INFORMATION

When a purchase is processed through Paddle, Paddle acts as the merchant of record and processes the payment transaction under its own buyer terms and privacy obligations.

Depending on the transaction, we may receive limited payment, billing, subscription, and entitlement information such as:

customer identifier;
subscription or plan selected;
transaction identifier;
payment status;
amount charged;
currency;
billing country;
billing information;
payment-card type;
expiration information;
last digits of the payment card;
renewal status;
cancellation status;
payment failure information; and
refund or dispute information.

ENDPEAK does not receive or store your complete payment-card number when the transaction is handled directly by Paddle.

Paddle may process additional identity, billing, payment, tax, fraud-prevention, and transaction information as an independent party for the purchase. You should review the privacy information presented by Paddle in connection with checkout.

If we use a different payment provider for a future transaction, the provider identified at checkout may process information under its own privacy and security obligations.

7. LIVE EDUCATIONAL SESSIONS

If you register for or participate in an ENDPEAK live educational session, we may collect:

account information;
registration information;
attendance information;
session participation;
quiz responses;
chat messages;
reactions;
questions submitted to instructors;
moderation information; and
technical connection information.

ENDPEAK live sessions may be recorded.

Where a recording could capture your voice, image, username, or another identifiable contribution, ENDPEAK will provide appropriate notice and obtain consent where required by applicable law.

Recordings may be made available to eligible ENDPEAK users.

We may moderate live-session communications in order to:

enforce community rules;
prevent abuse;
protect users;
prevent spam;
address inappropriate content; and
maintain the educational quality of the session.

8. COMMUNICATIONS AND CUSTOMER SUPPORT

When you contact ENDPEAK, we may collect:

your name;
email address;
account information;
content of your request;
support history;
files or screenshots you provide;
technical diagnostic information; and
communications between you and our support personnel.

We use this information to respond to your request, investigate problems, maintain customer service records, and improve the Services.

9. DEVICE, LOG, AND TECHNICAL INFORMATION

When you use ENDPEAK, certain technical information may be collected automatically.

This may include:

IP address;
browser type;
operating system;
device type;
device identifiers;
browser identifiers;
security or fraud-prevention device signals, including device-identification or fingerprinting signals where configured;
date and time of access;
pages or features accessed;
session information;
referring URLs;
network information;
authentication events;
application events;
error logs;
crash reports;
performance logs;
security events; and
suspected fraudulent or abusive activity.

We use this information for purposes including:

operating the Services;
authentication;
cybersecurity;
preventing fraud;
investigating abuse;
detecting account sharing;
enforcing concurrent-session or device-security controls;
detecting repeated free-trial abuse or other attempts to circumvent access rules;
debugging;
improving performance;
diagnosing failures;
measuring reliability; and
improving ENDPEAK.

We may derive an approximate location, such as country or general geographic region, from an IP address.

ENDPEAK does not require precise GPS location to provide its core educational Services.

10. COOKIES AND SIMILAR TECHNOLOGIES

ENDPEAK may use cookies, local storage, software development kits, pixels, and similar technologies.

These technologies may be used for:

Strictly Necessary Functions

For example:

authentication;
account security;
session management;
payment processes;
fraud prevention;
preferences; and
essential platform functionality.

Analytics

Where permitted, analytics technologies may help us understand:

how users navigate ENDPEAK;
which features are used;
application performance;
technical problems; and
general product usage.

Advertising and Marketing

No advertising pixel or marketing-tracking SDK is currently configured in the ENDPEAK application.

If ENDPEAK introduces advertising or marketing technologies in the future, they may be used to:

measure advertising effectiveness;
attribute registrations or purchases to campaigns;
create advertising audiences;
limit repetitive advertising; or
deliver relevant marketing.

Where applicable law requires consent before non-essential technologies are activated, ENDPEAK will request such consent before enabling them.

You may be able to manage these technologies using ENDPEAK's cookie preference controls.

For additional information, please see our Cookie Policy.

11. HOW WE USE PERSONAL INFORMATION

We may use personal information for the following purposes.

A. Providing the Services

Including:

creating accounts;
authenticating users;
providing study content;
delivering baseline or diagnostic assessments;
delivering question banks and practice examinations;
administering CAT simulations;
saving progress;
generating educational analytics;
producing readiness estimates;
creating study recommendations;
providing AI functionality;
providing on-demand, scheduled, premiere, recorded, or live educational media;
processing subscriptions and access entitlements; and
maintaining account preferences.

For users subject to the GDPR or similar laws, this processing is generally necessary to perform our contract with you or to take steps at your request before entering into a contract.

B. Personalizing ENDPEAK

We may use study activity and performance information to personalize:

study plans;
question selection;
learning recommendations;
topic priorities;
progress indicators;
readiness estimates;
educational content; and
other ENDPEAK functionality.

Depending on the circumstances, this processing may be necessary to provide requested Services or based on our legitimate interest in providing an effective educational platform.

C. Improving the Services

We may analyze use of ENDPEAK to:

identify technical problems;
improve question quality;
improve educational content;
evaluate question difficulty;
improve CAT behavior;
calibrate educational systems;
improve recommendation systems;
measure feature performance;
understand aggregated learning patterns;
improve AI features; and
develop new features.

Where appropriate, we may use aggregated or de-identified information for these purposes.

Our legitimate interest is to improve the quality, reliability, accuracy, and usefulness of ENDPEAK.

D. Security and Fraud Prevention

We may process information to:

protect accounts;
detect unauthorized access;
identify account sharing;
detect automated scraping;
identify suspicious activity;
prevent payment fraud;
prevent abuse of free trials;
protect ENDPEAK intellectual property;
investigate attacks;
enforce our Terms and Conditions; and
protect ENDPEAK, our users, and third parties.

This processing is generally based on our legitimate interests in maintaining a secure and trustworthy service and, where applicable, complying with legal obligations.

E. Communications

We may send you transactional communications including:

verification emails;
password reset messages;
security alerts;
payment confirmations;
subscription notices;
cancellation confirmations;
live-session information;
important service notices; and
legal notices.

These communications are necessary to operate your account or provide the Services.

F. Marketing

Where permitted by law, we may send promotional communications regarding ENDPEAK products, educational content, features, offers, or events.

Where consent is required, we will obtain consent before sending marketing communications.

You may unsubscribe from marketing emails at any time using the unsubscribe mechanism included in the message.

Unsubscribing from marketing does not prevent us from sending necessary account, security, billing, or service communications.

G. Legal Compliance

We may process personal information where reasonably necessary to:

comply with applicable laws;
maintain financial and accounting records;
respond to lawful government requests;
respond to court orders;
establish or defend legal claims;
comply with regulatory obligations; and
protect legal rights.

12. LEGAL BASES FOR PROCESSING

Where the GDPR, UK GDPR, or similar legislation applies, ENDPEAK relies on one or more of the following legal bases:

Performance of a Contract

Where processing is necessary to provide ENDPEAK Services that you requested.

Examples include:

account management;
Q-Bank functionality;
CAT examinations;
study progress;
subscriptions;
AI functionality; and
live-session access.

Legitimate Interests

Where processing is necessary for legitimate business interests that are not overridden by your rights and interests.

Examples may include:

cybersecurity;
fraud prevention;
service improvement;
debugging;
abuse prevention;
platform analytics;
enforcing our Terms;
protecting intellectual property; and
improving educational functionality.

Consent

Where you voluntarily consent to processing.

Examples may include:

marketing communications;
non-essential cookies;
certain advertising technologies;
certain live-session recording situations; and
other processing where consent is legally required.

You may withdraw consent at any time.

Withdrawal does not affect the lawfulness of processing that occurred before consent was withdrawn.

Legal Obligation

Where processing is necessary for ENDPEAK to comply with applicable law.

13. AGGREGATED AND DE-IDENTIFIED INFORMATION

We may create aggregated or de-identified information from personal information.

For example, we may analyze overall user performance to understand:

which questions are unusually easy or difficult;
whether an item appears defective;
how users perform across educational topics;
how CAT simulations behave;
which educational materials are most effective; or
how ENDPEAK features are used.

Where information has been properly de-identified so that it is no longer reasonably capable of being associated with an identifiable individual, we may use that information for:

research;
product development;
statistical analysis;
educational analysis;
system calibration;
benchmarking; and
other legitimate business purposes.

Where required by applicable law, we will maintain such information in de-identified form and will not attempt to re-identify it except as permitted to test or maintain de-identification safeguards.

14. WHEN WE SHARE PERSONAL INFORMATION

ENDPEAK does not sell personal information for money.

We may disclose personal information in the circumstances described below.

Service Providers

We may disclose information to companies that help us operate ENDPEAK.

These may include providers of:

cloud infrastructure;
database services;
authentication;
payment processing;
artificial intelligence;
video hosting and streaming;
email delivery;
analytics;
security;
customer support;
application infrastructure;
error monitoring; and
other technology services.

These providers may process information only for appropriate purposes and subject to applicable contractual and legal protections.

15. CORE TECHNOLOGY PROVIDERS

ENDPEAK's technology infrastructure may use providers such as:

Lovable Cloud — application backend, database, authentication, storage, hosting, and related cloud infrastructure;
Paddle — merchant of record, checkout, payment processing, subscription billing, taxes, refunds, and transaction support;
OpenAI — artificial intelligence processing used for AI-powered educational functionality;
Mux — video processing, hosting, streaming, and consent-dependent playback analytics where enabled;
Resend — transactional email delivery;
Fingerprint — device identification and security signals used for authenticated-session protection, fraud prevention, and trial-abuse detection where configured;
Sanity — content management or delivery for certain public editorial content; and
other infrastructure, security, analytics, hosting, or operational providers.

The specific providers used by ENDPEAK may change over time as our technology evolves.

We evaluate providers based on factors including functionality, security, privacy protections, contractual commitments, and regulatory requirements.

A service provider may process information in countries different from the country where you reside.

16. ADVERTISING PARTNERS

ENDPEAK may use advertising platforms to promote our Services, but no advertising pixel or marketing-tracking SDK is currently configured in the ENDPEAK application.

If we introduce advertising or marketing technologies in the future and you consent where consent is required, certain information may be disclosed to or collected by advertising providers.

This information may include:

cookie identifiers;
device identifiers;
IP address;
browser information;
page visits;
campaign identifiers;
registration events;
subscription or conversion events; and
similar online activity information.

We do not intentionally provide advertising platforms with your detailed Q-Bank answers, CAT responses, AI conversations, individual readiness scores, or detailed study history for targeted advertising.

Certain disclosures involving advertising technologies may be considered a “sale,” “sharing,” or “targeted advertising” under some U.S. privacy laws even where no money is exchanged.

Where ENDPEAK is legally required to provide an opt-out from such processing, we will provide the appropriate privacy controls.

17. BUSINESS TRANSFERS

If ENDPEAK or its business is involved in:

a merger;
acquisition;
financing;
corporate restructuring;
sale of assets;
sale of the business;
bankruptcy;
insolvency; or
similar corporate transaction,

personal information may be disclosed or transferred as part of that transaction.

Any recipient will remain subject to applicable privacy obligations concerning the information.

18. LEGAL AND SAFETY DISCLOSURES

We may disclose information if we reasonably believe disclosure is necessary to:

comply with applicable law;
respond to valid legal process;
respond to a court order;
respond to an authorized governmental request;
enforce ENDPEAK's agreements;
investigate fraud;
investigate cybersecurity incidents;
protect users;
prevent harm;
protect ENDPEAK's rights or property; or
establish, exercise, or defend legal claims.

We will assess requests for personal information in accordance with applicable law.

19. INTERNATIONAL DATA TRANSFERS

ENDPEAK serves users internationally and uses technology providers that may process personal information in the United States and other countries.

As a result, personal information may be transferred outside the European Economic Area (“EEA”), United Kingdom, Switzerland, or your country of residence.

Where legally required, we use appropriate safeguards for international transfers.

Depending on the recipient and circumstances, these safeguards may include:

an adequacy decision adopted by the European Commission;
participation by an eligible U.S. recipient in the EU-U.S. Data Privacy Framework where applicable;
European Commission Standard Contractual Clauses;
the UK International Data Transfer Addendum or other approved UK mechanisms;
recognized Swiss transfer mechanisms;
supplementary contractual, organizational, or technical measures; or
another lawful transfer mechanism.

You may contact contact@endpeak.com for additional information concerning applicable safeguards.

20. DATA RETENTION

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to provide the Services and satisfy legal, accounting, security, and regulatory obligations.

The retention period depends on the type of information and why it is processed.

Account Information

Generally retained while your account remains active.

If you request deletion, account information will be deleted, anonymized, or restricted unless retention is required for another legitimate purpose.

Study and Performance Information

Generally retained while necessary to maintain your learning history, progress, statistics, recommendations, and account functionality.

Following account deletion, this information may be deleted or de-identified, subject to applicable legal and technical retention requirements.

AI Conversations

AI conversation data may be retained for as long as reasonably necessary to provide conversation history, operate AI functionality, investigate problems, prevent abuse, and comply with applicable legal requirements.

Users may be provided with controls to delete conversation history where available.

Support Communications

May be retained for a reasonable period to maintain customer-service records, investigate recurring problems, and resolve disputes.

Transaction and Billing Records

Certain transaction, invoice, tax, accounting, and payment records may be retained for the period required under applicable accounting, tax, anti-fraud, and other legal requirements.

Security Logs

Security and technical logs may be retained for a reasonable period based on cybersecurity, fraud-prevention, incident investigation, and operational requirements.

Backups

Deleted information may remain temporarily in protected backup systems until the relevant backup is overwritten or expires under our backup retention procedures.

When determining retention periods, we consider:

the purpose of processing;
the nature of the information;
the sensitivity of the information;
the risk associated with the information;
whether the information is required to provide the Services;
legal retention requirements;
contractual requirements;
security requirements; and
whether information can instead be de-identified.

21. DATA SECURITY

ENDPEAK uses administrative, technical, and organizational measures designed to protect personal information against:

unauthorized access;
unauthorized disclosure;
accidental loss;
destruction;
alteration;
misuse; and
unauthorized acquisition.

Depending on the system involved, safeguards may include:

access controls;
authentication;
encryption in transit;
encryption at rest where appropriate;
restricted administrative access;
security logging;
monitoring;
backups;
environment separation;
provider security controls;
secure development practices; and
incident-response procedures.

No online system can be guaranteed to be completely secure.

You are responsible for protecting your password and account credentials and should notify us promptly if you suspect unauthorized access.

22. YOUR PRIVACY RIGHTS — EEA

If you are located in the European Economic Area and the GDPR applies to the processing of your personal information, you may have the following rights:

Right of Access

You may request confirmation of whether we process your personal information and request access to that information.

Right to Rectification

You may request correction of inaccurate or incomplete personal information.

Right to Erasure

You may request deletion of personal information in circumstances provided by law.

Right to Restriction

You may request that processing of certain information be restricted.

Right to Data Portability

Where applicable, you may request certain information in a structured, commonly used, machine-readable format and may have the right to transmit it to another controller.

Right to Object

You may object to certain processing based on legitimate interests.

You may object at any time to processing for direct marketing purposes.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal will not affect processing that lawfully occurred before withdrawal.

Rights Relating to Automated Decision-Making

Where applicable law grants rights regarding decisions based solely on automated processing that produce legal or similarly significant effects, you may exercise those rights.

ENDPEAK's educational analytics, CAT results, study recommendations, and readiness estimates are not intended to produce such legal or similarly significant effects.

Right to Lodge a Complaint

You may lodge a complaint with the data protection authority in your country.

If ENDPEAK's controller is established in Spain, you may also contact:

Agencia Española de Protección de Datos (AEPD) Spanish Data Protection Agency

You are encouraged, but not required, to contact us first so we have an opportunity to address your concern.

23. UNITED KINGDOM AND SWITZERLAND

Users in the United Kingdom and Switzerland may have similar rights under applicable privacy legislation.

These may include rights relating to:

access;
correction;
deletion;
restriction;
portability;
objection;
consent withdrawal; and
complaints to the relevant supervisory authority.

International transfers involving personal information subject to UK or Swiss privacy legislation will use an appropriate lawful transfer mechanism where required.

24. U.S. STATE PRIVACY RIGHTS

Residents of certain U.S. states may have additional privacy rights, subject to applicable law and eligibility requirements.

Depending on your state, these rights may include:

confirming whether we process your personal information;
accessing personal information;
obtaining a copy of personal information;
correcting inaccurate information;
deleting personal information;
opting out of the sale of personal information;
opting out of sharing for cross-context behavioral advertising;
opting out of targeted advertising;
limiting certain uses of sensitive personal information;
opting out of certain profiling or automated decision-making activities;
obtaining information concerning certain automated decision-making systems;
withdrawing consent;
appealing a privacy-rights decision; and
exercising privacy rights without unlawful discrimination or retaliation.

The specific rights available depend on applicable law.

25. CALIFORNIA PRIVACY NOTICE

This section provides supplemental information for California residents.

It applies to the extent ENDPEAK is subject to the California Consumer Privacy Act (“CCPA”).

Categories of Personal Information

Depending on how you use ENDPEAK, we may collect the following categories of information:

Identifiers

Examples:

name;
email address;
account identifiers;
IP address; and
online identifiers.

Customer and Transaction Information

Examples:

subscription information;
billing information;
transaction history;
plan purchased; and
payment status.

Commercial Information

Examples:

products or subscriptions purchased;
purchase history; and
subscription status.

Internet or Other Electronic Network Activity

Examples:

ENDPEAK activity;
pages viewed;
session information;
device information;
browser information;
interactions with features; and
technical logs.

Approximate Geolocation

Approximate geographic information may be inferred from your IP address.

ENDPEAK does not need precise GPS location for its core educational Services.

Audio, Electronic, or Visual Information

This may include participation in recorded educational sessions where applicable.

Educational or Professional Preparation Information

This may include information you provide concerning your study goals, examination preparation, professional education, or related information.

Inferences

We may generate educational inferences based on your ENDPEAK activity, including:

performance estimates;
readiness estimates;
study recommendations;
learning strengths;
topics requiring review; and
related educational predictions.

Sensitive Personal Information

Certain information may qualify as sensitive personal information under California law, including authentication credentials.

ENDPEAK does not intentionally request:

Social Security numbers;
government identification numbers;
precise geolocation;
racial or ethnic origin;
religious beliefs;
union membership;
genetic data;
private sexual information; or
identifiable patient health information

as part of its ordinary educational Services.

26. SALE AND SHARING OF PERSONAL INFORMATION

ENDPEAK does not sell personal information for monetary compensation.

If ENDPEAK uses advertising technologies, certain disclosures of identifiers and online activity to advertising partners may qualify as “sharing” or “sale” under the CCPA or similar laws, even if ENDPEAK is not paid money for the disclosure.

Where applicable law requires ENDPEAK to provide an opt-out, users will be provided with a mechanism such as:

“Do Not Sell or Share My Personal Information”

and/or

“Your Privacy Choices.”

Where required, ENDPEAK will also recognize legally valid browser-based opt-out preference signals, such as Global Privacy Control.

ENDPEAK does not knowingly sell or share personal information of individuals under the age at which additional consent requirements apply.

27. CALIFORNIA RIGHTS

Subject to applicable law, California residents may have the right to:

know the categories of personal information collected;
know the specific pieces of personal information collected;
know the sources of personal information;
know the purposes for collecting personal information;
know categories of third parties to whom information is disclosed;
request deletion;
request correction;
opt out of sale or sharing;
limit certain uses of sensitive personal information;
exercise applicable rights concerning automated decision-making technology; and
receive equal service and treatment when exercising privacy rights.

Certain exceptions apply.

We may need to verify your identity before completing certain requests.

An authorized agent may submit a request on your behalf where permitted by law, but we may require verification of the agent's authority and/or verification directly from you.

28. HOW TO EXERCISE YOUR PRIVACY RIGHTS

You may submit a privacy request through:

Email: contact@endpeak.com

You can also manage optional cookies through the Cookie Settings control on our Cookie Policy page.

Please clearly describe the right you wish to exercise.

We may request information reasonably necessary to verify:

your identity;
your account;
the authenticity of the request; and
your authority to act on behalf of another person.

We will not request more information than reasonably necessary for verification.

We will respond within the period required by applicable law.

If applicable law provides a right to appeal a decision concerning your privacy request, instructions for appealing will be provided with our response.

29. MARKETING PREFERENCES

You may unsubscribe from promotional emails by using the unsubscribe link included in the message.

You may also object to marketing through the privacy contact details provided in Section 1.

Even if you opt out of marketing, ENDPEAK may continue sending non-promotional communications relating to:

your account;
authentication;
security;
payments;
subscription status;
legal notices;
live sessions for which you registered; and
other Services you requested.

30. DO NOT TRACK AND GLOBAL PRIVACY CONTROL

Some browsers offer “Do Not Track” settings.

Because there is no universally accepted standard for responding to traditional Do Not Track signals, ENDPEAK may not respond to every Do Not Track signal.

Where applicable privacy law requires recognition of an opt-out preference signal, such as Global Privacy Control (“GPC”), ENDPEAK will process the signal as required by law.

31. CHILDREN'S PRIVACY

ENDPEAK is intended for adults preparing for professional licensing and certification examinations.

The Services are not intended for children under eighteen (18) years of age.

We do not knowingly create accounts for or intentionally collect personal information from children under 18 through ENDPEAK's ordinary consumer Services.

If we learn that personal information has been collected from a child in circumstances where such collection is not legally permitted, we will take reasonable steps to delete the information.

If you believe a child has provided personal information to ENDPEAK, please contact:

contact@endpeak.com

Nothing in this section prevents ENDPEAK from implementing legally compliant age-verification or age-assurance mechanisms where appropriate.

32. PATIENT AND HEALTH INFORMATION

ENDPEAK teaches medical and nursing concepts, but ENDPEAK is not intended to store actual patient records or identifiable patient information.

Do not upload or enter:

patient names;
medical-record numbers;
patient photographs;
dates or identifiers that could identify a patient;
protected health information;
confidential clinical documents; or
other identifiable patient information

unless ENDPEAK has expressly provided a feature specifically designed and legally authorized for that purpose.

Educational questions containing fictional patients, hypothetical medical scenarios, or properly de-identified information are not treated as actual patient medical records solely because they contain medical terminology.

33. THIRD-PARTY LINKS

ENDPEAK may contain links to third-party websites, products, services, or educational resources.

We are not responsible for the privacy practices of independent third parties.

You should review the privacy policy of a third-party service before providing personal information to it.

34. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy to reflect:

changes to ENDPEAK;
new features;
changes in technology;
changes in service providers;
changes in business practices;
regulatory developments; or
changes in applicable law.

When we make changes, we will update the “Last Updated” date.

If a change materially affects how we use personal information, we will provide additional notice where required by law.

Where applicable law requires consent to a new form of processing, we will request consent before beginning that processing.

35. CONTACT US

For questions about this Privacy Policy or ENDPEAK's privacy practices, contact:

END PEAK, S.L. Operating as ENDPEAK

Camí Nou de Picanya, 31, Escalera Izquierda, Puerta 2 46014 Valencia Spain

Privacy: contact@endpeak.com Support: contact@endpeak.com Website: https://endpeak.com

If a Data Protection Officer is appointed, their contact details will be published here.