NBME® Privacy Notice

Date Updated: November 1, 2024

 

National Board of Medical Examiners (NBME) provides this Privacy Notice ("Notice") to explain NBME's information collection, use, and dissemination practices in connection with the NBME web site: www.nbme.org and our MyNBME® portals, applications (including, without limitation, any MedVR Education applications), and any other web sites that link to this Notice (collectively, "Site"). If a client health profession organization provides personal information to NBME, the use of such information shall be limited to the purposes authorized by the client. Please review this Notice and feel free to contact us at privacy@nbme.org if you have any questions.

If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request.

1. General Users

NBME’s web servers may track the Internet protocol (IP) addresses of visitors to the Site to measure number of visits to the website. If you participate in NBME’s examination services (e.g., NBME Licensing Examination Services, NBME Self-Assessment Services), you will be required to provide personal information during the registration process and to create an account. To access certain portions of the Site including your NBME account, you have to submit a user ID and password. The personal information you have provided to NBME as well as information otherwise collected or generated by NBME, may be stored in your NBME account.

2. Collection of and Consent to Use Information from Site Users

You provide information to us in the process of completing various forms for the United States Medical Licensing Examination® (USMLE®) and/or NBME programs and services for medical schools, students, and graduates of medical schools. This information includes, but is not limited to:

  • Name
  • Date of birth
  • Email address
  • Billing and Mailing address
  • Telephone number
  • Credit card and billing information
  • Social security or national identification number
  • Citizenship
  • Gender
  • Medical school history (including Medical School name, country, professional degree, date degree conferred/expected)
  • Recordings (e.g., related to remotely proctored exams)
  • With respect to MedVR Education applications, user completion data and user-patient transcripts (collectively, “MedVR User Data”)

The provision of information is sometimes required by law and at other times is a result of a contractual requirement. You may be required to provide information, for example in a case where we sign a contract with you to provide you with testing services, and the non-provision of information could, in certain circumstances, prevent a transaction from concluding. In general, you are required to respond to most of the questions on the application forms. However, you are not required to provide information regarding your ethnicity or first language. Providing this information is optional and does not affect the outcome of your application. NBME uses information about the ethnicity and first language of its applicants for research purposes and to ensure the fairness of our exams.

By providing information about yourself online to NBME, you acknowledge that NBME will use that information in accordance with this Notice. This information is used for identification purposes and as stated below in Section 7.

In addition to the information described above, we also collect aggregate information from many users about use of the Site, such as number of visits and pages visited on the Site, and the overall duration of time spent on the Site. The information we collect depends in large part upon the needs of your account and what services and features you use on the Site.

3. Security

We have reasonable administrative, technical and physical measures in place to protect the security of information about our users. Unfortunately, no data transmission over the Internet can be guaranteed to be 100% secure. As a result, we cannot and do not ensure or warrant the security of any information you transmit to us, and you do so at your own risk.

If, for any reason, you should choose not to provide your information online, you may request a paper version of the application or document request form by calling +1 215-590-9700 or by email to webmail@nbme.org. If you have questions about providing your personal information related to NBME Self-Assessment Services, you may contact assessmentservices@nbme.org.

4. Cookies and Tracking Technologies

NBME and its partners use cookies or similar technologies to analyze trends, administer the website, track users’ movements around the website, and to gather demographic information about our user base as a whole. You can control the use of cookies at the individual browser level, but if you choose to disable cookies, it may limit your use of certain features or functions on our website or service.

As is true of most websites, we gather certain information automatically and store it in log files. This information may include IP addresses, browser type, Internet service provider (ISP), referring/exit pages, operating system, date/time stamp, and/or clickstream data.

We may combine this automatically collected log information with other information we collect about you. We do this to improve site functionality.

5. Digital Advertising & Analytics

We may partner with ad networks and other ad serving providers (“Advertising Providers”) that serve ads on behalf of us and others on non-affiliated platforms. Some of those ads may be personalized, meaning that they are intended to be relevant to you based on information Advertising Providers collect about your use of the Site and other sites or apps over time, including information about relationships among different browsers and devices. This type of advertising is known as interest-based advertising.

NBME adheres to the Digital Advertising Alliance (“DAA”) Self-Regulatory Principles in connection with this interest-based advertising activity. You may visit the DAA Webchoices tool at www.aboutads.info to learn more about this type of advertising and how to opt out of this advertising on websites by companies participating in the DAA self-regulatory program. If you delete your cookies or use a different browser or mobile device, you may need to renew your opt-out choices exercised through the DAA Webchoices tool. Note that electing to opt out will not stop advertising from appearing in your browser or applications.  It may make the ads you see less relevant to your interests. 

Additionally, to opt-out of interest-based advertising by participating companies in the following consumer choice mechanisms, please visit:

NBME uses Google Analytics and other third-party services to improve the performance of the Site and for analytics and marketing purposes. For more information about how Google Analytics collects and uses data when you use our Site, visit https://www.google.com/policies/privacy/partners, and to opt out of Google Analytics, visit https://tools.google.com/dlpage/gaoptout.

You can change your cookie preferences at any time by clicking the Cookie Settings link in the site footer.

6. Credit Card

All credit card transactions are processed through a secure vendor. NBME uses a clearinghouse to verify and validate the credit card. NBME does not store or disclose credit card information.

7. Use of Information Collected

NBME collects and uses the information you provide to better serve you and to carry out its public interest mission, including ensuring exams are fair and maintaining a permanent record of examinee performance. Such information is used for lawful purposes, including the following:

  • to process your applications and requests for services or materials,
  • to provide support for the services we provide,
  • to verify that you meet the minimum qualifications for our programs and services,
  • to allow us to contact you to provide those services, to complete delivery of services,
  • to notify you that scores are available;
  • to provide offers that may be relevant to you,
  • for billing purposes,
  • to ensure the integrity, security, and fairness of our exams, and to protect you and NBME from fraudulent transactions,
  • to tailor and improve your experience if you use the Site, including for analytics purposes,
  • to operate and improve our products and services,
  • to invite you to participate in surveys, pilots, and focus groups;
  • to invite you to apply for grant programs;
  • to comply with the law and to maintain the security of our Site, or
  • with your consent or as otherwise disclosed at the time information is collected.
  • Additionally, NBME and its collaborating organizations, including the Federation of State Medical Boards (FSMB), the Educational Commission for Foreign Medical Graduates (ECFMG), the Association of American Medical Colleges (AAMC), and the National Residency Match Program (NRMP) may use information for research and statistical purposes.

Your credit card information is used to bill you for services. We will not use your credit card information for any other purpose.

We do not use automatic decision-making or engage in profiling that results in significant effects to you.

Where we intend to process information about you for a purpose other than the purpose for which it was collected, we will provide you with information regarding the purpose for the processing, as well as other relevant information, prior to processing your personal information for the new purpose.

User Data Supplementation

We may receive information about you from other sources, including offline sources, publicly available databases, or third parties, and combine this data with information we already have about you. Specifically, we receive personal information from ECFMG, FSMB, AAMC, NRMP or from medical schools, residency programs, and other healthcare organizations that purchase NBME’s exam services or otherwise collaborate with NBME such as the National Board for Health & Wellness Coaching. This helps us to update, expand, and analyze our records, verify the identity of new examinees and process purchases of our services, notify you that scores are available, invite you to participate in surveys, pilots, and focus groups, and provide products and services that may be of interest to you. If you provide us information about others, or if others give us your information, we will only use that information for the specific reason for which it was provided to us.

8. Disclosure of Information to Third Parties

We may distribute the information that you submit to us, both internally within our organization and to our agents and affiliates as necessary for purposes related to our services.

Third Parties Related to Products and Services. We disclose your information to certain third parties to provide the products and services you have requested online. When you apply for a USMLE examination, we will provide certain registration information to NBME’s test delivery vendors (e.g., Prometric or Internet Testing Systems, LLC) to schedule and administer the test. If you request a test accommodation, we may also share your information with consultants who review and evaluate the requests and the supporting documentation you provide. We also provide information to medical schools, residency programs, or other healthcare organizations that purchase NBME’s exam services. We will also provide your information to other educational institutions upon your request.

Payment Vendors. NBME uses a third-party vendor to process your online payment transactions. To process these transactions, your payment information must be disclosed to this third party.

Organizational Partners. The USMLE is sponsored jointly by NBME and the FSMB. ECFMG also serves as the registration entity for international medical school graduates. To ensure an efficient and accurate examination process for applicants, and to provide the services you have contracted with us for, portions of the information you provide to us during the registration process are retained in a shared database for the purposes of exam registration and scheduling. Additionally, this information, as well as performance data from the examination, is used by these organizations for research and statistical purposes. This research may be published but individual examinees will not be identified in any publication. NBME also maintains permanent examinee records for verification by examinees, educational institutions, medical employers, and licensing authorities.

Association of American Medical Colleges and National Residency Match Program. NBME may also share certain user information, such as USMLE ID, name, medical school name and graduation date, date of birth, gender, score information, and, if provided, ethnic and first language information, with the Association of American Medical Colleges (AAMC) and National Residency Match Program (NRMP) pursuant to data sharing agreements. These organizations use the data that we provide for research and operational purposes. Individual examinees will not be identifiable in any publication.

Service Providers. NBME also may provide information to third parties that have entered into contracts with us to provide certain services. Specifically, NBME may share your information with its Customer Relationship Management (CRM) vendors, survey management vendors, content management vendors, or IT services management companies. We may also use this information to help us manage programs and services that may be of interest to you, including inviting you to participate in surveys, pilot programs, or focus groups; or to apply to grant program(s).

Please also note that all of your activities on the MyNBME portal(s) are traceable through your single sign-on (SSO) account. If you use your name as part of your SSO account or User ID, your name may be available to third parties that contract with us to provide certain services after enrollment.

Legal Compliance. At times we may be required by law, court order or legal process to disclose your personal information. We may disclose information about you, in our sole discretion, if we believe that disclosure is necessary: (a) to satisfy any law, regulation, or governmental request or to respond to a subpoena; (b) to operate this website; (c) to protect the safety, rights or property of NBME or users of the Site or any of NBME's websites; and (d) or as otherwise permitted under this Notice.

In certain situations, NBME may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

With Consent. NBME may use information with your consent or as otherwise disclosed at the time any data is collected or shared.

Transfer of Business. In the event that we sell or transfer all or a portion of our business and assets, including as part of a bankruptcy proceeding, we reserve the right to transfer information about you in connection with that transaction.

Deidentified or Aggregated Data. We may share information that has been de-identified or aggregated to the extent allowed by applicable law.

9. International Visitors

This section applies to those that visit our Site from the European Economic Area, United Kingdom, or Switzerland.

A. Lawful Basis for Processing

On certain occasions, we process your personal information when it is necessary for the performance of a contract to which you are a party, such as to provide services to you that you have requested or to notify you that scores are available. We also process your personal information to respond to your inquiries concerning our products and services.

On other occasions, we process your personal information where required by law. We also process your personal information if necessary to protect your interests or the interests of a third party.

Additionally, we process your personal information when necessary to do so for direct marketing purposes, for sending invitations to participate in surveys, pilots, or focus groups, for assessing our exams, and maintaining accurate permanent examination records. Processing your personal information for this purpose is necessary for our legitimate interest to improve our exams, ensure their fairness, maintain an official record of examinee performance, and provide other services to you.

We may also process personal information with your consent. You have the right to withdraw your consent to such processing of personal information at any time.

B. Transfers of Personal Information

Please be aware that the information we collect or receive may be transferred to and maintained on servers or databases located outside your state, province, country, or other jurisdiction, where the privacy laws may not be as protective as those in your location. If you are located outside of the United States, please be advised that we process and store personal information in the United States. In some instances, we rely on entering into the Standard Contractual Clauses with data processors to legitimize the data transfer from the European Economic Area to the United States.

C. Your Rights

You have a right to the following:

  • To request access to the personal information we hold about you;
  • To request that we rectify or erase your personal information;
  • To request that we restrict or block the processing of your personal information;
  • Under certain circumstances, to receive personal information about you that we store and transmit to another without hindrance from us, including requesting that we provide your personal information directly to another, i.e., a right to data portability; and
  • Where we previously obtained your consent, to withdraw consent to processing your personal information.

To exercise these rights, please contact us at privacy@nbme.org. Please be aware that NBME may be unable to afford these rights to you under certain circumstances, such as if we are legally prevented from doing so. Additionally, you have the right to lodge a complaint against us. To do so, contact the supervisory authority in your country of residence.

10. Access and Choices for Personal Information

A.  NBME Self-Assessment Services

Upon request NBME will provide you with information about whether we hold any of your personal information. If your personal information changes, or if you no longer desire our service, you may correct, update, or delete inaccuracies by making the change within your account by selecting "Personal Information" or by emailing our Customer Support at assessmentservices@nbme.org or by contacting us by postal mail at the contact information listed below. We will respond to your request within 30 days.

B.  NBME Licensing Examination Services

Using the Site, you may access and verify or change your personal information such as mailing and e-mail addresses and telephone number. You may also submit a name change request. The submission of a name change request will generate further instructions regarding how to complete the request. NBME must receive appropriate documentation before we will make such a name change. You may also check the status of your USMLE applications, scheduling permits, score reports, and document requests. To do so, you must have both your USMLE identification number and a password. If you do not have your password, you may obtain one by accessing the NLES website and following the instructions for logging in. The NLES website is available 24 hours a day, 7 days a week, with the exception of maintenance periods. Upon written request accompanied by appropriate documentation, NBME will change your social security number or birth date. To request such a change to your personal information, you may write to us at the address listed in Section 14, "Inquiries and Concerns," below.

C. MyNBME® Portal

If you wish to verify or modify any of the information you have submitted to us on the MyNBME Portal(s), please contact your MyNBME account administrator or you may contact us at: support@nbme.org

NBME acknowledges that you have the right to access your personal information. In some cases, NBME has no direct relationship with the individuals whose personal data it processes. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate data should direct their query to NBME’s client (the data controller).

In some case, NBME collects information under the direction of its clients, and has no direct relationship with the individuals whose personal data it processes. If you are a customer of one of our clients and would no longer like to be contacted by one of our clients that use our service, please contact the client that you interact with directly. We may transfer personal information to companies that help us provide our service. Transfers to subsequent third parties are covered by the service agreements with our clients. We will retain personal data we process on behalf of our clients for as long as needed to provide services to our client.

D. MedVR Education
If you wish to verify, modify, or request deletion of your MedVR User Data, you may contact us at: support@medvr.education. 

E. Data Retention

We will retain your information only for the period necessary to achieve the purpose of the storage, or as permitted by law. The criteria used to determine the period of storage of information is the respective statutory retention period or, in the case of data we use for marketing purposes, five (5) years from the time you provide us with such data or from your most recent affirmative statement that you would like us to continue to use your data for such purposes. After expiration of the applicable period, the corresponding information is routinely deleted, deidentified, or aggregated, as long as it is no longer necessary for the fulfillment of a contract, for the initiation of a contract, or for the maintenance of permanent examination records required for long-term licensing verification purposes.

F. For Nevada Residents

Although we do not currently conduct sales of personal information, Nevada residents may submit a request directing us to not sell personal information we maintain about them if our practices change in the future. To do so, please contact us at support@nbme.org.

11. Links to and from NBME

This Site may contain links to other Internet websites or apps. However, NBME does not endorse, and is not responsible for, the privacy practices or the content of these websites. If you submit information to any of those sites, your information is governed by their privacy policies. We encourage you to carefully read the privacy notice of any website you visit.

Our website includes social media features, such as social networking tools offered by third parties. If you use these tools to share personal information or you otherwise interact with these features on the Site, those companies may collect information about you and may use and share such information in accordance with your account settings, including by sharing such information with the general public. Your interactions with these features are governed by the privacy notice of the company providing them.

12. Children’s Privacy

This Site is not designed to attract children. Accordingly, we do not knowingly collect personal information from anyone under 13 years of age.

13. Communications from the Site

You may sign-up to receive newsletters or other email marketing from us. If you would like to discontinue receiving this information, you may update your email preferences by using the "Unsubscribe" link found in emails we send to you or by contacting us at medicalschoolservices@nbme.org. If you opt out of our email marketing, we will still send you messages related to our transactions and relationship with you. For instance, if our service is temporarily suspended for maintenance, we might send you an email.

For choices with respect to third-party interest-based advertising activities, please see the “Digital Advertising & Analytics” section above.

14. Inquiries and Concerns

If we decide to change our Notice, we will post those changes to this privacy statement, the home page, and other places we deem appropriate so that you are aware of what information we collect, how we use it, and under what circumstances, if any, we disclose it. We reserve the right to modify this privacy statement at any time, so please review it frequently. If we make material changes to this Notice, we will notify you here, by email, or by means of a notice on our home page prior to the change becoming effective.

If you have any questions regarding this Notice, you may contact NBME, in its role as data controller, at:

National Board of Medical Examiners (NBME)
Legal Services Department
3750 Market Street 
Philadelphia, PA 19104 
Phone: (215) 590-9500
Email: privacy@nbme.org

For inquiries related to your rights under the General Data Protection Regulation (GDPR), please contact us at privacy@nbme.org. VeraSafe has been appointed as NBME's representative in the European Union and the United Kingdom for data protection matters, pursuant to Article 27 of the GDPR and the UK GDPR, respectively. VeraSafe can be contacted in addition to privacy@nbme.org, only on matters related to the processing of personal data. To make such an inquiry, please contact VeraSafe using this contact form available at: https://verasafe.com/public-resources/contact-data-protection-representative 

Alternatively, VeraSafe can be contacted at:

VeraSafe Czech Republic s.r.o
Klimentská 46
Prague 1, 11002
Czech Republic

In the United Kingdom, VeraSafe can be contacted at:

VeraSafe United Kingdom Ltd.
37 Albert Embankment
London, SE1 7TL