Privacy Policy

1. Who we are

DOME Exams™ ("DOME") is operated by Injexa Technologies LLC ("Injexa", "we", "us", "our"), a Florida limited liability company. This Privacy Policy explains what personal information we collect when you use domeexams.com and the DOME exam simulator, how we use and share it, how long we keep it, and your choices. It should be read with our Terms of Service and the Recording Consent Notice, which you accept before your first exam.

Contact: support@injexa.com. We handle privacy questions and requests by email.

2. The short version

• Your voice is transcribed, not stored. Microphone audio is held only in memory while it is captured, sent and transcribed. We do not write it to any file, database, or storage we control.
• The words are processed by AI providers. Audio goes to OpenAI for transcription; your transcribed answers and case context go to Anthropic, whose models play the examiner, patients and consultants. We have disabled the provider data-sharing and training settings available to us.
• Scoring is done by our own rules engine, not by an AI model.
• We never see or store your card number. Payments run through Stripe-hosted Checkout.
• We do not sell your personal information or share it for cross-context behavioral advertising, and we do not currently use advertising trackers.
• Do not enter real patient information. DOME's cases are fictional. DOME is not designed to receive patient health information.

3. Information we collect

3.1 Account information

• Email address.
• Password, if you sign up with email. It is stored by our authentication provider (Supabase) as a salted hash; we cannot see it.
• Google sign-in (optional). If you sign in with Google, we receive the basic profile information Google shares for sign-in, typically your email, name, and profile-picture link.
• Profile record: account creation date; free-case usage counter; trial end date; subscription status; current billing-period end date; your Stripe customer ID (a reference to your Stripe customer record, not card data); the end date of any free invite access; and your selected specialty or track.
• Invite codes. If you redeem an invite code, we record the redemption attempt (your account, the code entered, whether it succeeded, and when) to prevent abuse and to set your invite-access end date.
• Consent records. Which version of the Recording Consent Notice you accepted and when, tied to your account or, before sign-in, to a random anonymous acceptance ID.

3.2 Voice, transcripts, and exam data

• Microphone audio. Captured only after you accept the Recording Consent Notice. Sent to OpenAI for transcription and not stored by DOME.
• No browser speech recognition. DOME does not use your browser's built-in speech recognition (for example, the speech service built into Chrome, which can send audio to Google). If our transcription service is unavailable, the microphone is turned off and you answer by typing.
• Typed input. DOME also accepts typed answers, handled the same way as transcripts.
• Live exam session: the running transcript of the case, case state and grading state, linked to your account if you are signed in. This is needed to run and score the exam.
• Case-attempt record: which case you started, when, how far you got, whether you finished, pass or fail, counts of turns, credited actions and harm events, and your access type. It contains no transcript and nothing you said. We use it for product analytics (for example, which cases are hard and where candidates stop).
• Examiner consult-reply samples: on certain consult turns, the AI model's raw reply text and technical event tags, with the session and case identifiers. These are not linked to your user ID, but a consultant reply may echo something you said during a handover. We use them for quality control of the AI characters.
• Your score and debrief are computed by DOME's rules engine from the session. Your recent attempt history is also kept in your browser's local storage on your device.

3.3 Feedback and bug reports

• Debrief feedback: your rating, comment, and any answer you report as "not credited" with what you think it should have earned; linked to your account.
• In-app bug reports: your message; a screenshot of the page; your recent transcript turns; recent browser console errors; page address, case and session identifiers; browser type and window size; and your email address if you are signed in.

3.4 Payment information

Stripe collects and holds your card and billing details through Stripe-hosted Checkout and the Stripe customer portal. DOME never receives or stores your card number. From Stripe we receive and store your Stripe customer ID, subscription status, trial end and billing-period end.

3.5 Technical and usage information

• Abuse-limit counters. To cap AI usage by anonymous demo visitors, we store a one-way cryptographic hash of your IP address (never the address itself) with a usage counter. These hashes are kept for about one day and then deleted.
• Hosting logs. Our host, Vercel, records IP addresses, request URLs, browser information and timestamps in its standard request logs for security and operations, and keeps them for a limited period under its own retention settings.
• Page-view statistics. We use Vercel Web Analytics for aggregate, cookieless page-view statistics (which pages are visited, the referring site, and general browser, device and country information). It sets no cookies and does no cross-site tracking. Page addresses are sent without query strings or case names, and nothing you say or type is included.
• Application logs contain operational metrics; our logging is designed not to record what you say or type.

3.6 Cookies and local storage

• Strictly necessary cookies: authentication session cookies that keep you signed in, and an access cookie used by the invite gate when it is enabled.
• Local storage (on your device only): theme preference, examiner speech speed, whether you dismissed the tutorial, recent attempt history, in-progress session tokens, and display settings.
• No advertising or analytics cookies. DOME does not currently use advertising pixels or cookie-based analytics tools (such as a Meta pixel, Google Analytics or Google Tag Manager). Our page-view statistics (Vercel Web Analytics, section 3.5) use no cookies. Stripe sets its own cookies on Stripe-hosted pages for fraud prevention.

3.7 What we do not collect

We do not intentionally collect patient health information, government IDs, precise location, contacts, or biometric identifiers. We do not create voiceprints or derive anything from the characteristics of your voice.

4. How we use information

• To provide DOME: authenticate you, run exams, transcribe speech, generate examiner speech and AI character responses, and score your performance.
• To manage trials, subscriptions, invite access and billing, and to send service and billing communications.
• To record and enforce consent to the Recording Consent Notice.
• To prevent abuse, enforce usage limits, secure the service, and fix problems.
• To improve DOME's cases and AI characters using case-attempt records, consult-reply samples, feedback and bug reports.
• To comply with law and enforce our Terms.

We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. If we send you marketing email, you can opt out at any time by using the unsubscribe link in the message or by emailing us.

5. Who we share information with

We share personal information only with the service providers that run DOME for us, and as described below.

• AI provider data use. Neither OpenAI nor Anthropic is permitted to train on DOME data; we have disabled the sharing and training settings available on both accounts. Each provider may retain content for a limited period under its own policies, for example for abuse monitoring.
• Legal and safety. We may disclose information if required by law, subpoena or court order, or to protect rights, safety and security.
• Business transfers. Information may transfer as part of a merger, acquisition or asset sale, subject to this Policy.

6. How long we keep information

7. Your choices and rights

• Access and correction. Your account page shows your email, name and access status. To change your email or correct other information, email support@injexa.com. You can change your password with a password reset.
• Cancel your subscription anytime in Manage billing, or by emailing us.
• Deletion. You can delete your account yourself on your account page, or email support@injexa.com from your account email and we will respond within 30 days. Deleting your account immediately cancels any active subscription or trial (no further charges), deletes your bug reports and live exam sessions, and deletes your account, which removes your profile, attempt records, consent records and feedback. Stripe retains transaction records as required by law.
• Export. You can request a copy of your personal information by emailing support@injexa.com; we will respond within 30 days.
• Microphone. You can use typed input instead of voice, and you can revoke microphone permission in your browser at any time.
• Verification. To protect your account, we may ask you to confirm a request from the email address on your account.
• State privacy rights. Depending on where you live, you may have rights to know, access, correct, delete, or obtain a copy of your personal information, to opt out of its sale or sharing or of targeted advertising (we do none of these), and to appeal if we deny your request. To exercise any of these rights, email support@injexa.com. If we deny your request, you can appeal by replying to our response.
• We will not discriminate against you for exercising your privacy rights.

8. California privacy rights

If you are a California resident, you have the right to know the categories and specific pieces of personal information we collect, the sources, the purposes, and the categories of third parties we disclose it to (described in Sections 3 through 5); to request deletion or correction of your personal information; and not to be discriminated against for exercising these rights. We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We do not use or disclose sensitive personal information for purposes that would give you a right to limit its use. You or an authorized agent may make a request by emailing support@injexa.com; we may need to verify your identity, and an agent's authority, before we act. California's "Shine the Light" law also lets California residents ask about disclosures to third parties for their direct marketing; we make no such disclosures.

9. Do Not Track

Some browsers send a "Do Not Track" signal. There is no common standard for how to respond to it, so DOME does not change its behavior in response. Because DOME does not currently use advertising trackers or track you across other websites, there is no cross-site tracking for the signal to stop.

10. Health information and patient data

DOME is exam-preparation software for clinicians. Cases are fictional, and you must not enter real patient information. DOME is not a healthcare provider, is not a HIPAA covered entity or business associate, and is not designed to receive protected health information. If you enter real patient information despite this instruction, it will be transmitted to the providers above and stored as part of your session until it is deleted as described in Section 6. If you tell us this has happened, we will delete the affected session and reports on request.

11. Children

DOME is intended for adult professionals and is not directed to children under 18. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided us information, contact support@injexa.com and we will delete it.

12. Where we process data

DOME is operated from the United States, and we process and store personal information in the United States. If you use DOME from outside the United States, your information will be transferred to and processed in the United States.

13. Security

We use industry-standard measures: encryption in transit (TLS); database access rules so users can read only their own records; server-only secret keys; hashed passwords; hashed rather than raw IP addresses for abuse limiting; and card data kept entirely with Stripe. No system is perfectly secure. If a security incident affects your personal information, we will notify you as required by law.

14. Changes to this Policy

We may update this Policy. If changes are material, we will notify you by email or by a banner on the site before they take effect. Changes to the Recording Consent Notice require your re-acceptance before your next exam.

15. Contact

DOME is operated by Injexa Technologies LLC. Please contact us by email at support@injexa.com.