Privacy Policy

3.1 Account Information

• Email address (required, used as your unique identifier)
• Username (auto-generated from your email, editable)
• Password (securely hashed using bcrypt; not used if you sign in with Google, Microsoft or your organization's single sign-on)
• Company name (optional)
• Sign-in method (email and password, Google, Microsoft, or, on the enterprise platform, your organization's learning management system or Salesforce)
• Role (on the enterprise platform: workspace administrator or member, and the workspace you belong to)

3.2 Authentication Data

• Google or Microsoft account ID and profile information (if you sign in with Google or Microsoft)
• JWT tokens (stored in secure HTTP-only cookies for session management)
• Temporary tokens (for password reset and email verification)

3.3 Conversation and Learning Data

• Conversation transcripts (complete message-by-message exchanges with timestamps)
• Your voice during a session, streamed live to the AI character; stored as an audio recording (OGG format) only if you give consent (see Section 7)
• Case scenario details (character descriptions, learning objectives, situations, reference documents you upload)
• Performance evaluations (skill scores, written feedback quoting your own words)
• Practice session metadata (start and end times, case played)
• Development data (enterprise platform: your training plan and skill gaps, weekly self check-ins on your skills, and 1 to 5 skill ratings your manager gives you)

3.4 Workspace and Classroom Data (enterprise platform)

• Workspace membership (workspace, role, who invited you, invitation status)
• Classroom memberships and the roleplays assigned to your classrooms
• Roleplays you created
• Notifications and your email preferences (for example the weekly digest)

3.5 Meeting Feedback and Call Analysis (enterprise platform, optional)

• Meeting feedback: when you ask for it, our meeting assistant joins a Google Meet or Microsoft Teams call and we receive the meeting audio, a transcript that includes participants' names, and the meeting link and title
• Calendar auto-join: if you connect Google Calendar or Microsoft Outlook, your upcoming calendar events, including attendees' email addresses, so you can choose which meetings the assistant joins
• Call analysis: call recordings uploaded by workspace administrators, or retrieved from your organization's Yeastar phone system together with caller and callee numbers, call time, duration and extension, and the resulting transcripts and evaluations

3.6 Integration Data (enterprise platform, optional)

• Calendar access and refresh tokens (encrypted at rest)
• Your identifier in your organization's learning management system (LTI 1.3) or Salesforce, when single sign-on is used
• For a Microsoft 365 directory import: your organization's tenant ID and name, and the email and role of the people an administrator chose to invite. The rest of the directory never reaches us, and no Microsoft token is stored.

3.7 Usage Analytics

We compute analytics from the data above to provide the Service:

• Performance metrics (evaluation counts, score distributions)
• Skill averages and progress trends (improvement over time)
• Activity (enterprise platform: sessions practiced and last activity, shown to workspace administrators)

6.1 AI and Voice Services

• Scaleway Generative APIs (Paris, France): the language and speech models that generate case scenarios, write coaching, transcribe meetings and uploaded calls, and write the evaluations in SimCase OSCE. Scaleway does not store the content of these requests and does not use it to train models.
• Google (Gemini): the real-time voice model that plays the AI character in SimCase OSCE and on the enterprise platform's US voice pipeline, which is the default for new workspaces. Your voice and the scenario are processed by Google in the United States.
• ElevenLabs: voice synthesis on the enterprise platform's EU voice pipeline, which a workspace can choose instead. It receives only the text of the AI character's replies, never your voice, and runs in the United States. On that pipeline everything you say during the call is processed in Paris; the transcript is then sent to OpenAI for your feedback.
• OpenAI: writes the skills feedback on the enterprise platform, for roleplays, meetings and uploaded calls. It receives the conversation transcript, the roleplay brief and reference material, and the skills being assessed, and processes them in the United States. OpenAI does not use this data to train its models and keeps it for up to 30 days for abuse monitoring. In SimCase OSCE, OpenAI answers questions asked to the Ask AI help assistant.
• LiveKit: open-source real-time audio software that carries your voice sessions, operated by us on our own servers in Paris.
• Recall.ai (enterprise platform, optional): the meeting assistant that joins your Google Meet or Microsoft Teams call to record and transcribe it, at your request, so we can give skills feedback. We use its EU region (Frankfurt, Germany) and delete the recording from Recall.ai as soon as we have retrieved it. If you connect a calendar for auto-join, Recall.ai receives the calendar access token and reads your events on our behalf.

6.2 Hosting, Network and Payments

• Scaleway: application, database and media-server hosting in the European Union (Paris, France region).
• Cloudflare and Vercel: route traffic to our applications and to our sign-in page at getsimmy.com/login; your requests pass through their networks on the way to our servers.
• Stripe: Payment processing for SimCase OSCE subscriptions and credit purchases. We do not store your card details. The enterprise platform does not process payments.

6.3 Email Services

• Brevo (formerly Sendinblue): For contact management and CRM (EU-hosted). We share your email address and first name when your account is created. On the enterprise platform, contacts are deleted automatically when you delete your account; you can also ask us to remove yours at any time.
• Postmark: For transactional email delivery (invitations, password resets, data exports, notifications), hosted in the United States. Open and click tracking are switched off.

6.4 Storage Services

• Scaleway Object Storage (enterprise platform): audio recordings, meeting audio and uploaded calls are stored in Paris, France, encrypted at rest, and organized by workspace and user to facilitate deletion.
• Cloudflare R2 (SimCase OSCE): audio recordings are stored in the European Union and organized by user ID to facilitate deletion.

6.5 Authentication

• Google OAuth 2.0: If you sign in with Google, we receive your Google ID, email, name, profile picture, and verification status from Google. See Section 17 for the full description of how we handle Google user data.
• Microsoft Entra ID: If you sign in with Microsoft, we receive your Microsoft account ID, email and name. On the enterprise platform, connecting Microsoft Outlook uses the read-only Calendars.Read permission.

6.6 Integrations Enabled by Your Organization (enterprise platform)

When your organization connects its own systems, data flows to systems it operates, under its own agreements with those vendors:

• Learning management system (LTI 1.3): single sign-on and passback of your scores to the gradebook
• Salesforce: single sign-on and a training record (score, framework, roleplay, completion time) in your organization's Salesforce
• Yeastar phone system and Microsoft Teams: call recordings are retrieved for analysis, and call reports can be posted to a Teams channel

8.1 Active Accounts

We retain your data for as long as your account is active and as necessary to provide the Service, except for the following:

• Meeting recordings (enterprise platform): deleted 30 days after the meeting
• Uploaded call recordings (enterprise platform): kept until a workspace administrator deletes them
• Data export files: the download link expires after 48 hours
• Invitations (enterprise platform): invitation links expire after 7 days

8.2 Deleted Accounts

When you delete your account:

• Immediate deletion: your audio recordings; on the enterprise platform also your calendar tokens and calendar connection, notifications, training plan, classroom memberships, self check-ins, the skill ratings about you, invitations sent to your email, your identities in connected learning systems, and your Brevo CRM contact
• Anonymization: your email, username, password and sign-in identifiers are removed from your account record
• Deactivation: your conversations, evaluations and cases are marked as deleted and are no longer accessible in the Service. They are not purged automatically; you can ask us to delete them permanently at [email protected]

On the enterprise platform, when a Customer's workspace is deleted, every member account is anonymized as above, the workspace's audio files are deleted and its records are removed. Copies already passed to your organization's own systems (for example its learning management system or Salesforce) are governed by your organization.

8.3 Legal Obligations

We may retain certain data longer if required by law or to resolve disputes.

9.1 Right of Access (Art. 15)

You can download a copy of your main data via the "Export Data" feature in your account, and request any other personal data we hold about you by contacting us.

9.2 Right to Rectification (Art. 16)

You can update your username and company name directly in your account settings. For other corrections, contact us.

9.3 Right to Erasure (Art. 17)

You can delete your account at any time via the "Delete Account" feature. This will:

• Anonymize your email and username
• Clear your credentials and tokens
• Delete all your audio recordings
• Mark all associated data as deleted

Section 8.2 describes exactly what is deleted. You can also ask for permanent deletion of your remaining records.

9.4 Right to Data Portability (Art. 20)

The "Export Data" feature provides a JSON file containing:

• User profile information
• All cases you created
• All conversation transcripts
• All evaluation records

The export link is valid for 48 hours and delivered via email.

9.5 Right to Restrict Processing (Art. 18)

You can request restriction of processing by contacting us at [email protected].

9.6 Right to Object (Art. 21)

You can object to processing based on legitimate interests by contacting us.

9.7 Right to Withdraw Consent (Art. 7(3))

You can withdraw audio recording consent at any time via your account settings, and disconnect a calendar at any time from the application.

9.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection authority (see Section 16.1).

11.1 Essential Cookies

We use only essential cookies for authentication:

• Cookie name: access_token
• Purpose: Session management (JWT token)
• Type: HTTP-only, Secure
• Expiration: 24 hours

11.2 Analytics Cookies (SimCase OSCE only)

The SimCase OSCE application uses Google Analytics to understand how the product is used. It is loaded only after you accept the cookie banner; if you decline, no analytics cookies are set. The SimCase AI enterprise platform does not use third-party analytics.

11.3 No Tracking Cookies

We do NOT use:

• Advertising cookies
• Social media tracking pixels
• Session recording tools

16.1 Supervisory Authority

You have the right to lodge a complaint with a data protection authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (www.edoeb.admin.ch). In the European Union, you can contact the authority of your country; for a list of EU supervisory authorities, visit: https://edpb.europa.eu/about-edpb/board/members_en

16.2 Automated Decision-Making

We use AI models for case generation, voice conversations and performance evaluation (OpenAI for feedback on the enterprise platform, language models hosted by Scaleway in Paris for the rest, and Google Gemini for real-time voice). These systems make automated assessments of your performance, but:

• You can review and understand the evaluation criteria
• You can request human review of evaluations by contacting us
• Evaluations are for learning purposes only and do not have legal or similarly significant effects; our Terms ask organizations not to use them as the sole basis for employment decisions

17.1 Signing in with Google

If you choose to sign in with Google, we receive your Google account ID, email address, name, profile picture and email verification status. We use them for one purpose only: to create your account, identify you at each subsequent sign-in, and display your name and picture inside the application. We do not post, modify or delete anything in your Google account.

17.2 Google Calendar (SimCase Enterprise only, optional)

SimCase Enterprise offers an optional Google Calendar connection for the Meeting Feedback feature. It is never enabled automatically: you connect it yourself from the application, and you can disconnect it at any time.

• Scope requested: https://www.googleapis.com/auth/calendar.events, together with your email address.
• What we do with it: read your upcoming calendar events so you can choose which meetings our meeting assistant joins. We do not create, modify or delete calendar events, and we read no other part of your Google account.
• Sharing: to schedule the assistant, the refresh token is passed to Recall.ai, our meeting-assistant processor (EU region), which reads your events on our behalf for this purpose only.
• Storage: the access and refresh tokens Google issues are encrypted at rest on our EU infrastructure. Event details are used to display your upcoming meetings and are not retained beyond what that requires.
• Withdrawal: disconnecting Google Calendar in the application deletes our stored tokens and removes the calendar connection at Recall.ai. You can also revoke access at any time at myaccount.google.com/permissions.

17.3 Limited Use

SimCase AI's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained from Google APIs is:

• used only to provide or improve the user-facing features described above
• never sold, and never used for advertising or profiling
• never used to train, fine-tune or evaluate generalised AI or machine-learning models
• never transferred to third parties except as necessary to provide the feature, to comply with applicable law, or as part of a merger or acquisition following your notification
• never read by our staff, except with your explicit consent for support purposes, for security investigations, or where required by law