Last updated 9 September 2026 · Operated by Nepsor Technology Pvt. Ltd. · See also Terms of Service
This policy explains what personal data IOMMock collects, why, who we share it with, how long we keep it, and the choices you have. It is written to be read, not skimmed: if a feature collects something, it is listed here. Using the service means you have read it and agree to it, alongside our Terms of Service.
IOMMock is an online preparation platform for Nepal’s MECEE-BL (IOM) MBBS/BDS entrance examination. It is owned and operated by Nepsor Technology Pvt. Ltd., a company established in Kathmandu, Nepal (“we”, “us”, “our”). For the purposes of data protection law we are the data controller of the personal data described in this policy.
This policy applies to the IOMMock website and progressive web app, the emails and push notifications we send, and any support conversation you have with us. It does not cover third-party sites we link to, such as the Medical Education Commission (MEC), medical colleges, eSewa or Khalti, which have their own policies.
IOMMock is an independent study tool. We are not affiliated with, endorsed by, or acting on behalf of MEC or the Institute of Medicine (IOM), and we never receive personal data from them.
We only collect what a feature needs to work. In practice that is:
We do not collect your phone number, date of birth, home address, government ID, exam roll number or any special-category data such as health information, and we ask you not to put such information into free-text fields, doubt photos or uploaded materials.
You can create an account or sign in with your Google account instead of a password. When you do, we ask Google for the standard openid, email and profile scopes only, and we receive:
We do not request or receive access to your Gmail, contacts, calendar, Drive, photos, YouTube or any other Google service, and we never post anything to your Google account. The access token Google issues is used once, during sign-in, to read the profile above and is then discarded. We do not store Google access or refresh tokens.
If an account already exists with the same email address, and Google reports that address as verified, sign-in links the Google identifier to that account so both methods work. If Google reports the address as unverified, we refuse to link and ask you to log in with your password instead, to stop anybody claiming an account they do not own.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to create and sign you into your IOMMock account; it is not used for advertising, not sold, and not transferred to anyone else except as needed to provide the service or as required by law.
You can revoke IOMMock’s access at any time from your Google account’s third-party connections page. Revoking access does not delete your IOMMock account; use “Forgot password?” to set a password if you want to keep signing in without Google, or ask us to unlink or delete the account (section 9).
We use personal data to:
Where a legal basis is required, we rely on: performance of our contract with you (the Terms of Service) for everything needed to run the account and plan you asked for; your consent for optional announcements, push notifications, Google sign-in and uploading photos to the AI; our legitimate interests in securing, moderating and improving the service; and legal obligation for financial records. You can withdraw consent at any time as described in section 9.
We do not use your personal data for automated decisions that have legal or similarly significant effects on you. Rank and college predictions are estimates for your information only, generated from your score and published MEC merit-list data, and are never shared with any institution.
We are based in Nepal, but our infrastructure is not. The database is hosted in Asia pacific, and our hosting, email, AI and push providers operate mainly from the United States and the European Union. By using the service you understand that your data will be stored and processed outside Nepal. We choose providers that publish security commitments and contractual data-protection terms, and we transfer only what each one needs.
When you delete your account (section 9) it is locked at once and, after a 7-day grace period, we erase your personal data: profile, test history, bookmarks, flashcards, study plans, AI conversations and notification devices. What remains is the financial record set above with your name and email removed, and anything we need to keep to establish or defend a legal claim. Backups are overwritten on a rolling cycle within a further 30 days. Community materials you authored stay published without your name unless you ask us to take them down.
You have the right to know what personal data we hold about you, to have it corrected, to have it deleted, to receive a copy of it in a portable format, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. These rights apply under Nepal’s Individual Privacy Act, 2075 (2018) and, if you are in a jurisdiction such as the EEA or UK, under its own data protection law.
Contact us (section 13) to access or export your data, correct your name or email, unlink Google, take down a material you submitted, or have us delete an account you can no longer sign in to. We will confirm your identity, act within 30 days, and tell you if any part of the request cannot be honoured and why.
If you believe we have handled your data unlawfully you may complain to us first, and you also have the right to complain to the competent authority in Nepal or in your own country.
No system is perfectly secure. If we learn of a breach that affects your personal data we will notify you and any relevant authority without undue delay, and tell you what happened and what we are doing about it. Please choose a password you do not use elsewhere, and tell us at once if you think your account has been accessed by someone else.
The service is built for students preparing for an undergraduate medical entrance, most of whom are 17 or older, and it may be used by anyone aged 16 or above. If you are under 18, please use the service with the knowledge and consent of a parent or guardian, who accepts our Terms of Service on your behalf. We do not knowingly collect personal data from anyone under 13; if you believe a child under 13 has created an account, contact us and we will delete it.
A parent or guardian of a user under 18 may exercise that user’s rights in section 9 on their behalf once we have verified the relationship.
We will update this policy when the service or the law changes. The date at the top shows the current revision. For material changes, such as a new category of data, a new purpose, or a new kind of recipient, we will give notice by email or an in-app notice before the change takes effect. Continuing to use the service after that date means you accept the revised policy.
To ask a question about this policy or exercise any of your rights, contact Nepsor Technology Pvt. Ltd. through any of:
Please write from the email address on your account, or tell us which account you mean, so we can verify that the request is genuinely yours before acting on it.