Privacy Policy

SimVitals is the data controller for the personal data used to manage accounts, billing relationships, service security, and support. "Data controller" means we decide how and why that information is processed. You can contact us at [email protected].

For institution-managed learning activity and workspace content, the institution may determine the purposes of processing and SimVitals may act on its instructions as a service provider or processor. The applicable roles depend on the information and arrangements involved. Institution-specific data processing terms may be agreed separately; this policy is not a Data Processing Agreement or a promise of HIPAA compliance.

SimVitals is for healthcare simulation and education. It is not designed to collect or store protected health information (PHI). Do not submit identifiable patient information, medical record numbers (MRNs), real patient dates of birth (DOBs), real patient names, or other protected clinical information. Use fictional cases, including in scenarios, attachments, and support requests. If information is submitted accidentally, contact us promptly without resending it so we can address its removal.

• Account data — name, email address, login credentials, chosen plan, and role (learner, professional, instructor, student).
• Institution data — institution name, workspace membership, role, invitations, licensed seat requests, and registration details.
• Service and learning data — user-created scenarios, simulation session activity, lessons and practice progress, and related account activity.
• Support data — messages, feedback, error details, and attachments you choose to send.
• Usage and technical data — feature usage, device and browser information, IP address, session identifiers, and diagnostic or security logs generated when you use the Service.
• Subscription records — plan, subscription status, renewal or access dates, seat quantities, and Paddle customer and subscription identifiers needed to manage access.

Information comes from you, your institution's administrators, your use of the Service, and subscription updates from Paddle. Payment card and checkout billing details are collected and processed directly by Paddle; SimVitals does not store your full card number. Paddle handles purchase information under its own Privacy Policy.

• Providing the Service (contract performance, or legitimate interests in delivering an institution's service) — using account, institution, learning, and content data to create accounts, manage memberships, run simulations, save learning progress, and deliver the Learning Lab.
• Subscription access (contract performance) — using subscription records and billing contact details to activate the purchased plan, manage seats, and communicate with the billing account holder. Institution instructors and students do not receive billing emails simply because they are members.
• Security and fraud prevention (legitimate interests) — using account activity, device/IP information, and logs to protect accounts and investigate misuse.
• Reliability and improvement (legitimate interests) — using usage data, diagnostics, and feedback to fix problems and improve the Service.
• Customer support (contract performance / legitimate interests) — using contact details, messages, and relevant service records to respond to requests.
• Legal obligations — where we must keep or disclose records by law.
• Marketing (consent, where required) — we will only send marketing communications where permitted, and you can opt out at any time.

• Hosting and infrastructure providers — Lovable Cloud provides application services, database, authentication, and transactional email infrastructure; Cloudflare provides hosting, content delivery, and asset storage infrastructure. These providers process information needed to operate, secure, and deliver the Service.
• Paddle (Merchant of Record) — for product sales, subscription management, payment processing, sales taxes/VAT, refunds, and invoicing. Paddle acts under its own privacy terms for those activities.
• Your institution and authorized workspace members — administrators and authorized instructors may see membership and learning information according to their access rights. Shared scenarios are available to authorized workspace members; personal scenarios are not automatically shared.
• Professional advisers — legal and accounting advisers where needed.
• Authorities — where required by law.

We do not sell your personal data.

Account, membership, and learning records are kept while needed for your account or the institution's service. Support messages and technical logs are kept only as long as reasonably needed to address requests, maintain security, and investigate issues. Subscription and related business records may be retained longer to meet legal obligations or resolve disputes. The appropriate period depends on the record's purpose and applicable requirements; we do not promise a single fixed deletion deadline for all data.

Canceling a subscription does not automatically delete your account. When information is no longer needed, we delete or anonymize it; backup copies may remain until their normal replacement cycle, with access restricted. Institutional shared scenarios may remain in the workspace when an instructor leaves, subject to the institution's rights and retention requirements. This does not remove an individual's applicable personal-data rights.

Depending on your location, you may have the right to access, correct, or delete your personal data; restrict or object to processing; receive a portable copy of your data; withdraw consent at any time; and complain to your supervisory authority. To request correction or deletion, or exercise other privacy rights, email [email protected] or use the in-app help and feedback form. You do not need an active subscription to email us. We may need to verify your identity, but do not send passwords or patient information.

We respond within the time required by applicable law. For UK/EEA requests this is normally one month; if a lawful extension is needed, we will explain it. Some records may need to be retained for legal or security reasons. For institution-controlled information, we may coordinate with or direct you to your institution. Paddle handles requests concerning the payment data it controls.

We use appropriate technical and organisational measures — including encryption in transit, access controls, and workspace data isolation — to protect your personal data. No online service can guarantee complete security. These measures do not make SimVitals suitable for PHI or real patient care.

Some of our service providers process data outside your country. Where data leaves the UK/EEA, we rely on applicable safeguards such as adequacy decisions or standard contractual clauses where required. Contact us for information about the safeguards relevant to your data.

We use essential cookies and local storage to keep you signed in and make the Service work. We do not use third-party marketing cookies. You can manage cookies through your browser settings; disabling essential cookies may prevent sign-in. Paddle may use cookies or similar technologies for checkout, fraud prevention, and its billing portal under its own privacy notice. Any optional analytics or marketing cookies introduced in the future will be disclosed with consent controls where required.

You must be at least 13 to use SimVitals. It is not intended for children under 13, and we do not knowingly collect their personal information. Users below the legal age to enter a contract must have a parent or legal guardian's consent and supervision as described in our Terms of Service. If you believe a child under 13 has supplied personal information, contact us so we can investigate and arrange deletion as appropriate.

We may update this notice from time to time and will post the new version here. Questions or requests about your data can be sent through the in-app help and feedback form or to SimVitals at [email protected]. We will communicate material changes where required by law.