Privacy Policy

Last updated: 10 August 2026

Wall Board Academy ("we", "our", "us") respects your privacy. This document explains what personal data we collect when you use www.wallboardacademy.com and the Wall Board Academy mobile app, how we use it, and the rights you have under the General Data Protection Regulation (EU 2016/679, "GDPR").

1. Data Controller

Wall Board Academy — Federico Fiori MD, Head of Abdominal Wall Surgery Unit, ASST Santi Paolo e Carlo — Milano, Italy. Contact: info@wallboardacademy.com.

2. Data we collect

Registration data: email, first name, last name, date of birth, institution, specialization.
Authentication data: encrypted password, session token (JWT).
Usage data: pages visited, videos watched, watch-time (in seconds), live session presence (only aggregated counts).
Technical data: IP address, browser and device type, referrer, timestamps.
Cookies and analytics: PostHog session analytics (anonymised) for product improvement.

3. How we use your data

To create and manage your account and grant access to the content library.
To send transactional email (approval, password reset, upcoming live reminders) via Resend (EU processor).
To broadcast live sessions via YouTube Data API (Google LLC) — only when you actively join a live event.
To analyse content performance in an aggregated form (analytics dashboard for admins).
To comply with legal obligations.

4. Legal basis (GDPR art. 6)

Contract (art. 6.1.b) — for account creation and delivery of the service.
Legitimate interest (art. 6.1.f) — for security, analytics, and product improvement.
Consent (art. 6.1.a) — for optional marketing communications and cookies (you can withdraw anytime).

5. Third parties

Resend (email delivery) — https://resend.com/legal/privacy-policy
Google LLC (YouTube Data API for live streaming) — https://policies.google.com/privacy
PostHog (product analytics) — https://posthog.com/privacy
MongoDB Atlas (database hosting) — https://www.mongodb.com/legal/privacy-policy
Aruba S.p.A. (hosting provider) — https://www.aruba.it/informativa-privacy.aspx

6. Data retention

Account data: retained until you request deletion.
View and heartbeat logs: automatically deleted after 36 months.
Live-session Q&A messages: automatically deleted after 36 months.
Backups: encrypted, rotated every 30 days.

7. Your rights

Under GDPR you have the right to access, rectify, erase, restrict, port or object to the processing of your data. You may also lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali). To exercise any right, email info@wallboardacademy.com — we reply within 30 days.

8. Cookies

We use only strictly necessary cookies (session, authentication) and one analytics cookie set by PostHog. No advertising or third-party tracking cookies are used.

9. Children

The platform is intended for medical professionals aged 18 and above. We do not knowingly collect data from minors.

10. Security

Passwords are hashed with bcrypt. All traffic is encrypted via HTTPS/TLS 1.3. Access to the database is restricted by IP allow-list and requires MFA.

11. Changes to this policy

This Privacy Policy may be updated. The date of the last revision is shown at the top. Significant changes will be communicated by email.

12. Contact

Wall Board Academy — info@wallboardacademy.com — www.wallboardacademy.com