Privacy Policy

Last Updated: August 3, 2026

Definitions

“Company” (also “we”, “us”, or “our”) refers to MedSim.AI.
“Service” refers to MedSim.AI, accessible at https://www.medsim.ai, including all related websites, applications, features, and content.
“User” (also “you” or “your”) refers to any individual or entity that accesses or uses the Service.

This Privacy Policy describes how the Company collects, uses, and shares personal information when you use the Service.

1. Information We Collect

a. Information You Provide Directly

Account information: email address, password, first and last name, and profession, collected when you register.
Profile and study information: professional role, target examination, country of education, planned test date, weekly study goals, and similar onboarding details you choose to provide.
Learning activity content: the messages you type or speak during simulated clinical encounters, your free-text answers to assessment questions, and related submissions. Transcripts of your simulated encounters are stored as part of your learning history.
Voice input: if you use voice features, audio from your microphone is captured and transcribed into text in real time. The resulting transcript is treated as learning activity content. We do not use your voice to create a biometric voiceprint or to identify you.
Payment information: if you purchase a subscription, your payment card details are collected and processed directly by our third-party payment processor. We do not store your full card details; we retain subscription and transaction records (such as plan, status, and billing history).
Communications: information you provide when you contact us, including your name, email address, and the content of your message.

b. Information Collected Automatically

Session and device data: IP address, browser type and version, operating system, and device information, including records of your login sessions.
Usage data: features used, simulations attempted, scores and feedback, progress, streaks, badges, and similar activity data generated as you use the Service.
Log data: server logs, error logs, and access timestamps.
Cookies and similar technologies: as described in Section 3.

c. Information from Third Parties

Social login providers: if you sign in using a third-party identity provider (such as a social or email account provider), we receive information from that provider such as your name, email address, and account identifier, as permitted by your settings with that provider.
Payment processor: we receive confirmation of payments, subscription status, and limited billing details from our payment processor.

2. How We Use Your Information

We use personal information to:

provide, operate, and maintain the Service, including running simulated encounters, generating assessments and feedback, and tracking your progress;
process transactions and manage subscriptions, and send related information;
send administrative communications, such as email verification, password resets, security alerts, and service updates;
respond to inquiries and provide support;
monitor and analyze usage trends to maintain and improve the Service;
detect, investigate, and prevent fraudulent, abusive, or unauthorized activity, and enforce usage limits;
comply with legal obligations;
enforce our Terms of Service;
improve and personalize the Service and develop new products, services, features, and functionality; and
for any other purpose disclosed to you at the time of collection or with your consent.

3. Cookies and Tracking Technologies

We use strictly necessary cookies that are required for the Service to operate — specifically, a session cookie that keeps you signed in and a security (CSRF) cookie that protects forms and requests. These do not require consent. We do not use analytics, advertising, or tracking cookies of any kind.

The Service also uses your browser’s local storage to hold preferences and session state on your own device — such as interface settings, onboarding progress, personal notes you take during simulations, and a session token. This data stays in your browser and is not used to track you across other websites.

You can configure your browser to refuse or delete cookies, but the Service cannot function without the strictly necessary cookies described above (for example, you will not be able to stay signed in).

4. Third-Party Services

We use the following categories of third-party service providers, which may process your information on our behalf:

AI providers: third-party artificial intelligence services process the content of your simulated encounters and answers to generate patient responses, assessments, and feedback, and to generate and review educational content (see Section 11).
Speech services: a third-party speech-to-text provider processes your microphone audio in real time to produce transcripts when you use voice input; a third-party text-to-speech provider generates the simulated patient’s audio.
Payment processing: a third-party payment processor handles subscription payments and stores your payment card details.
Email delivery: a third-party email provider delivers transactional emails such as verification, password reset, and security notifications.
Identity providers: third-party sign-in providers, if you choose to use social login.
Hosting and infrastructure: cloud infrastructure providers host the Service and its database.

These third-party services have their own privacy policies governing their use of your information. We are not responsible for the privacy practices of third-party services. We encourage you to review the privacy policies of any third-party services you interact with through the Service.

5. Information Visible to Other Users

The Service includes competitive and social features. If you appear on a leaderboard, other Users of the Service can see your name, profession, and performance statistics (such as average score and number of completed simulations). If you do not wish this information to be visible to other Users, contact us at [email protected].

We may share personal information in the following circumstances:

Service providers: with third parties that perform services on our behalf, as described in Section 4;
Legal compliance: when required by law, regulation, legal process, or governmental request;
Protection of rights: to enforce our Terms of Service, or to protect the rights, privacy, safety, or property of the Company, our Users, or the public;
Business transfers: in connection with any merger, acquisition, reorganization, financing, sale of assets, or bankruptcy, in which case personal information may be transferred as a business asset;
With consent: when you have given explicit consent to a disclosure; and
Aggregated or anonymized data: we may share aggregated or de-identified information that cannot reasonably be used to identify you.

We do not sell personal information, and we do not share personal information with third parties for advertising purposes.

7. Data Retention

We retain personal information for as long as necessary to provide the Service and fulfill the purposes described in this Privacy Policy. Learning history, including encounter transcripts and assessment results, is retained while your account is active so that your progress tracking works over time.

After account deletion, we may retain certain information as required by law, to resolve disputes, enforce agreements, or for legitimate business purposes (such as billing records). We may retain aggregated or anonymized data indefinitely.

8. Data Security

We implement commercially reasonable technical and organizational security measures designed to protect personal information, including encryption of data in transit (HTTPS/TLS), hashed password storage, and support for multi-factor authentication (including authenticator apps and passkeys).

However, no method of transmission over the Internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security. We are not responsible for unauthorized access to your information that occurs despite our reasonable security measures. You are responsible for maintaining the security of your account credentials.

9. Children’s Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from an individual under 18, we will take steps to delete that information promptly. If you believe a person under 18 has provided us with personal information, please contact us at [email protected].

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States, where our infrastructure and service providers are located. These countries may have data protection laws that differ from those in your jurisdiction. Where we transfer personal information out of the EEA or UK, we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses (SCCs). We will take reasonable steps to ensure your information is treated securely and in accordance with this Privacy Policy.

11. AI Processing

Core features of the Service use artificial intelligence. Content you submit to these features — including your typed messages, transcribed voice input, and free-text answers — is transmitted to and processed by third-party AI providers to generate simulated patient responses, assessments, and feedback. Educational content in the Service (such as cases and lessons) is also generated with third-party AI services and reviewed before publication.

We do not control how third-party AI providers use data beyond our agreements with them; their privacy policies apply to their processing. AI-generated output may be retained to provide, improve, and secure the Service.

Do not submit sensitive personal information to AI-powered features. In particular, never enter information about real, identifiable patients, your own health information, financial account details, or government identifiers into simulated encounters or free-text fields. The Service is an educational tool that uses fictional patients only and is not designed to receive real health information.

12. Your Privacy Rights

Depending on your jurisdiction, you may have the right to:

Access: request a copy of the personal information we hold about you;
Correction: request correction of inaccurate information;
Deletion: request deletion of your account and personal information;
Portability: request a copy of your information in a machine-readable format; and
Objection: object to certain processing activities.

To exercise any of these rights, contact us at [email protected]. We may need to verify your identity before processing your request. We reserve the right to charge a reasonable fee for manifestly unfounded or excessive requests.

13. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you may have additional rights under the California Consumer Privacy Act, as amended, including the right to know what personal information we collect, the right to delete personal information, the right to opt out of the sale or sharing of personal information, and the right to non-discrimination for exercising your rights. We do not sell personal information as defined by the CCPA, and we do not share personal information for cross-context behavioral advertising. To exercise your California privacy rights, contact us at [email protected].

If you are in the European Economic Area or the United Kingdom, we process your personal information on the following lawful bases:

Contract performance: providing the Service you signed up for, including accounts, simulations, assessments, progress tracking, and subscriptions;
Legitimate interests: securing the Service, preventing fraud and abuse, and improving the Service;
Consent: where we ask for it (for example, optional features that require your permission, such as microphone access); and
Legal obligation: where processing is required to comply with law.

You have the rights of access, rectification, erasure, restriction of processing, data portability, and objection, and the right to withdraw consent at any time where processing is based on consent (withdrawal does not affect the lawfulness of processing before withdrawal). You also have the right to lodge a complaint with a supervisory authority. To exercise your GDPR rights, contact us at [email protected].

15. Changes to This Privacy Policy

We may update this Privacy Policy at any time. Changes are effective when posted on this page, with the “Last Updated” date revised accordingly. Your continued use of the Service after any changes constitutes acceptance of the updated Privacy Policy. We encourage you to review this Privacy Policy periodically.

16. Contact

If you have any questions about this Privacy Policy, please contact us at [email protected].