Privacy Policy

Who We Are

This website is operated by Next Steps Career Corporation, 30 N Gould St, STE R, Sheridan, WY 82801, USA ("Next Steps", "we", "us"). We help USMLE aspirants from scratch to match, providing guidance for Step 1, Step 2 CK, CV building, Clinical Rotations, and Residency Match strategy.

This policy covers nextstepsusmle.com, including our blog, our mentorship booking page, and our payment pages.

Information You Give Us

We collect personal information when you submit one of our forms. We do not require you to create an account, and the site has no comment system or public user profiles.

Mentorship booking form (/mentorship):

• Full name
• Email address
• Phone number, including the country dialling code you select
• Your medical college, and the country (and, for India, the state) where it is located

Contact form and on-site enquiry pop-ups:

• Name, email address, phone or WhatsApp number, medical college
• Your message, and where offered, your current USMLE stage and target exam date

Every field marked required must be completed for us to process your request. Anything else is optional, and leaving it blank does not affect the service you receive.

Information Collected Automatically

When you browse the site, we and our analytics and advertising providers may collect:

• Your IP address, browser type, device type, and operating system
• The pages you visit, how long you spend on them, and the site or advertisement that referred you
• Campaign attribution parameters in the page URL (utm_source, utm_medium, utm_campaign and similar), which we retain for the duration of your visit and attach to any form you submit
• A randomly generated visitor ID stored in your browser (see Cookies and Similar Technologies below)
• Anonymised recordings of page interactions — scrolling, clicks, and mouse movement — captured by Microsoft Clarity to help us understand how pages are used

Booking a Mentorship Call

The mentorship page is our main enquiry route, so we want to be specific about what happens when you press Book Your Slot:

• Your name, email, phone number and college details are sent to our servers and stored in TeleCRM, a customer relationship management platform operated by Ciphercode Technologies Pvt. Ltd. (India), which our counselling team uses to manage enquiries.
• The campaign parameters that brought you to the page are stored alongside your enquiry, so we know which advertisement or article it came from.
• A notification email containing your submission is sent to our internal team inbox.
• A member of our team will contact you — normally within 24 hours — by phone, WhatsApp, or email, to discuss USMLE mentorship. By submitting the form you are asking us to make that contact.
• A conversion event is sent to our advertising platforms, as described in the next section.

If you would prefer we did not contact you, or you want your enquiry deleted, email us at admin@nextstepsusmle.com and we will remove your details from our CRM.

Advertising and Conversion Measurement

We advertise on Google, Meta (Facebook and Instagram), and Reddit, and we need to know which advertisements produce genuine enquiries. To measure that:

• When you submit an enquiry form, we send a conversion event to Google Ads, Meta, and Reddit through Google Tag Manager.
• That event includes your email address and phone number in an irreversibly hashed form, together with the random visitor ID described below. The advertising platform compares the hash against its own records to confirm the conversion. This is commonly called "advanced matching" or "enhanced conversions". We do not send your name, your college, or the content of your message to these platforms.
• These platforms act as independent controllers of the data they receive, and their own privacy policies govern what they do with it.

You can limit this by using your browser's tracking protection, by opting out of personalised advertising in your Google, Meta, and Reddit account settings, or by contacting us to request erasure.

Cookies and Similar Technologies

We use the following, all loaded through Google Tag Manager after the page has finished rendering:

• Google Analytics 4 — measures traffic and page performance. Sets cookies that distinguish one visitor from another, typically for up to two years.
• Microsoft Clarity — records heatmaps and session replays of how pages are used, so we can improve them.
• Google Ads, Meta, and Reddit advertising tags — measure conversions and allow us to show you relevant advertising elsewhere.
• A persistent visitor ID — a randomly generated identifier saved in your browser's local storage under the key externalId. It is not derived from anything you type and contains no personal detail on its own, but it does persist across visits and lets our advertising platforms recognise a returning visitor. Clearing your browser's site data removes it.
• Temporary session storage — holds campaign parameters and form state for the duration of your visit, and is cleared when you close the tab.

Most browsers let you block or delete cookies and local storage through their settings. Blocking them will not stop you using the site, though some analytics and conversion measurement will not function.

Payments

Payments for our packages are processed by Razorpay and Stripe. Card details are entered directly into the payment provider's own secure checkout and never pass through or get stored on our servers. We receive confirmation of the transaction, the amount, and the billing name and contact details needed to issue your invoice and provide the service you have purchased.

How We Use Your Information

• To respond to your enquiry and arrange your mentorship or counselling call
• To deliver, administer, and support the services you buy from us
• To send you information about USMLE preparation and our services, where you have asked to hear from us
• To measure which advertisements and articles bring us genuine enquiries
• To improve the website's content, structure, and performance
• To meet our accounting, tax, and other legal obligations
• To detect and prevent spam, fraud, and abuse of our forms

Who We Share Your Data With

We do not sell your personal information. We share it only with the service providers that make our business run:

• TeleCRM — stores and manages your enquiry so our counselling team can follow it up
• Google — Analytics, Tag Manager, Ads, and email delivery for our team notifications
• Microsoft — Clarity analytics
• Meta and Reddit — conversion measurement and advertising, as described above
• Razorpay and Stripe — payment processing
• Our hosting and infrastructure providers — who store the site and its data on our behalf

We may also disclose information where we are required to by law, or where it is necessary to establish or defend a legal claim. Because we operate from the United States and use providers in India, the United States, and the European Union, your information may be transferred to and processed in countries other than your own.

How Long We Keep Your Data

• Enquiries that do not become customers — kept in our CRM for up to 24 months after your last interaction with us, then deleted
• Customer records — kept for the duration of your programme and for as long as afterwards as we need them to support you
• Invoices and payment records — kept for as long as tax and accounting law requires
• Analytics data — kept according to each provider's retention settings, generally no more than 14 months in identifiable form

Your Rights

Wherever you live, you can ask us to:

• Tell you what personal information we hold about you, and give you a copy of it
• Correct anything that is inaccurate or out of date
• Delete your information, where we have no continuing legal reason to keep it
• Stop contacting you, or stop using your information for advertising measurement
• Withdraw a consent you previously gave, without affecting anything done before you withdrew it

If you are in India, these rights are provided under the Digital Personal Data Protection Act, 2023, and you may also raise a grievance with us using the contact details below before approaching the Data Protection Board. If you are in the European Economic Area or the United Kingdom, you have the rights set out in the GDPR, including the right to complain to your national supervisory authority.

To exercise any of these rights, email admin@nextstepsusmle.com. We will respond within 30 days, and we may need to verify your identity first.

Embedded Content from Other Websites

Our articles may include embedded content such as videos or social media posts. Embedded content from other websites behaves exactly as if you had visited that website directly — those sites may set their own cookies, collect data about you, and monitor your interaction with the embedded content, particularly if you have an account and are logged in to them.

Data Security

The site is served over encrypted HTTPS connections, and access to our CRM and internal systems is restricted to the team members who need it. No method of transmission or storage is completely secure, so while we take reasonable steps to protect your information, we cannot guarantee absolute security.

Children

Our services are intended for medical students and graduates, and are not directed at children under 18. We do not knowingly collect personal information from children. If you believe a child has given us their information, contact us and we will delete it.

Changes to This Policy

We may update this policy as our services and the tools we use change. The revision date below always reflects the most recent substantive change, and material changes will be highlighted on this page.