MedSimAI Product Privacy Notice
This notice explains how MedSimAI handles personal data when people use our platform, participate in an authorized study, or communicate with us about the service.
Data we process
The data involved depends on the features an institution or user chooses. It may include:
- Account information, including name, email address, institution, role, and authentication metadata.
- Simulation content, including messages, transcripts, uploaded materials, notes, assessments, and performance results.
- Audio recordings when a voice-enabled activity is used.
- Technical and security data, including IP address, browser and device information, audit events, and diagnostic logs.
- Support, partner, and business communications sent to MedSimAI.
- Research data described in the applicable study consent and protocol when someone participates in a research study.
Do not submit real patient identifiers or protected health information unless a written agreement expressly authorizes it. Simulations should use synthetic or appropriately de-identified information.
How we use and protect data
- Provide, operate, support, and improve the MedSimAI platform.
- Authenticate users, administer accounts, and enforce institution-scoped permissions.
- Deliver simulations, generate feedback, and provide voice features selected by the user or institution.
- Monitor reliability, investigate security events, prevent abuse, and meet contractual or legal obligations.
- Conduct research only under the applicable consent, protocol, and institutional requirements.
MedSimAI uses encryption, access controls, audit logging, and other administrative and technical safeguards appropriate to the data. No system can guarantee absolute security.
Service providers and disclosure
We disclose data to approved service providers only as needed to operate the selected features, subject to contractual and access restrictions. Relevant provider categories include:
- Cloud infrastructure and security providers
- Cloud hosting, databases, storage, logging, and security services.
- AI inference providers
- Language-model inference for configured simulation and assessment features.
- Voice and AI-agent providers
- Voice generation and simulated-participant experiences when those features are used.
We may also disclose data when required by law, to protect the service or its users, or as directed by the customer that administers the applicable account.
Retention and deletion requests
- Account, simulation, and assessment data is retained while needed for the active customer, research, or operational purpose, unless a shorter contractual or consent-based period applies.
- Product playback access to stored conversation recordings expires after 30 days. Broader physical S3 lifecycle automation is still being completed under a reviewed deletion gate.
- Production database backups are retained for 35 days. Security and database audit logs are retained for up to one year.
- A legal hold, contract, research protocol, security investigation, or other documented obligation may require longer retention.
Request access, correction, or deletion
Email contact@medsimai.com with the subject “Privacy Request - Data Deletion.” Include your name, account email, institution, relationship to the data, and the records or account involved. Do not email a password, real patient details, or other unnecessary sensitive information.
We acknowledge requests within five business days. After verifying identity and authority, we target deletion or anonymization in active primary systems within 30 calendar days. Applicable provider-side data is included where supported. Backup copies expire through the normal 35-day cycle, and a deletion must be reapplied if a backup is restored during that period.
A customer institution may control data associated with its account. In that case, MedSimAI may coordinate the request with the institution. We will explain any contractual, legal, research, security, or technical exception that changes the scope or timing.
Questions and changes
Contact contact@medsimai.com with privacy questions. We may update this notice as the product or our practices change and will revise the date at the top.