Privacy Policy

The controller responsible for processing your data is:

NYU Shanghai
⟦Street and number, postcode, city⟧
⟦Country, e.g. Germany⟧
Email: ⟦Contact email⟧

You can contact us at this address for any question about your data or to exercise your rights.

• Account data: your email address and a hash of your password, managed by Supabase Auth. We never see your password in plain text.
• Profile data: your age range, gender, professional role and experience (years of clinical experience, supervised client hours), therapeutic orientation, work or training setting, country and working languages. Age range and gender are required; for gender you can choose "prefer not to say". All other profile fields are optional. The profile is stored with your account in Supabase.
• Training data: the text of your practice sessions (transcripts of what you and the simulated patient said), the session settings you chose, and any custom patients you create.
• Nonverbal cues (only in live conversation mode and only if you switch on the camera and consent): short facial-expression labels (at most two per turn) and numerical voice features such as pitch and loudness. These are derived on your device; see section 10.
• Scores and feedback: the automated scores for each session and the AI-written feedback and coaching.
• Credits ledger (if credits are enabled): your credit balance, purchases and usage.
• Technical logs: server logs that contain your user ID and session IDs, timestamps and error information, and the usual connection data (such as IP address) processed by our hosting providers.

• Providing the training service (your account, sessions, simulated patient replies, scoring, feedback, history and credits): performance of the contract with you, Art. 6(1)(b) GDPR.
• Profile data, used to tailor practice and feedback, for aggregate statistics on how the platform is used, and for research only with your separate consent: the required fields (age range and gender) are part of your account, performance of the contract, Art. 6(1)(b) GDPR; the optional fields are based on your consent, Art. 6(1)(a) GDPR, which you can withdraw at any time by deleting them in Settings. Your gender is never shared outside the processors listed in section 4 and is never used to make decisions about you.
• Camera-derived nonverbal cues: your consent, Art. 6(1)(a) GDPR. You can use the service without the camera.
• Participation in a research study: your separate consent for that study, Art. 6(1)(a) GDPR (and Art. 9(2)(a) GDPR where the study involves special categories of data).
• Security, abuse prevention and fault finding through technical logs: our legitimate interest in running a secure and reliable service, Art. 6(1)(f) GDPR.
• Keeping payment records (if credits are enabled): legal obligations under tax and commercial law, Art. 6(1)(c) GDPR.

You can withdraw consent at any time with effect for the future; this does not affect the lawfulness of processing before the withdrawal.

We use the following service providers, who process data on our behalf. Which of them are involved depends on the conversation mode (engine) you use.

• Supabase: database, authentication and file storage for all account and training data.
• Vercel: hosting of the website.
• Railway: hosting of the backend server, including its technical logs.
• Anthropic: generates simulated patient replies in the video clip mode, and produces scores and feedback in all modes. It receives the session transcript and aggregated nonverbal cues, without your email, name or user ID.
• OpenAI (Whisper): speech-to-text in the video clip mode. It receives the audio of each of your turns, without identifiers.
• ElevenLabs: spoken audio of the patient briefing. It receives only the fictional patient text, no data about you.
• Seedance (through its reseller): video clips of the patient. It receives only the patient's lines, no data about you.
• Our own avatar engine, when you use that mode: Daily.co (real-time audio transport), Deepgram (speech-to-text), OpenAI (patient replies), Cartesia (patient voice) and Simli (patient face). They receive your microphone audio and the conversation text, without your email or user ID. Daily's software may also send technical error reports to its own monitoring provider.
• Stripe: payments, only if credits are enabled and only when you buy credits. It receives your email address and user ID, and the payment details you enter directly with Stripe.

We do not sell your data and do not share it for advertising.

Several of these providers are based in the United States or process data there. Where data is transferred to a country without an EU adequacy decision, the transfer is based on the EU standard contractual clauses or, where the provider is certified, on the EU-US Data Privacy Framework (Art. 45 and 46 GDPR). You can ask us for more information about these safeguards.

• Account data (including your profile) and training data: until you delete your account or ask us to delete it. Deleting your account deletes your sessions, transcripts, scores and feedback.
• Technical logs: for as long as the hosting provider keeps them under its standard log retention.
• Study data: as described in the consent form of the study you joined.
• Payment records: as long as tax and commercial law requires.

Under the GDPR you have the right to:

• access the data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict processing (Art. 18);
• receive your data in a portable format (Art. 20);
• object to processing based on legitimate interest (Art. 21);
• withdraw any consent you have given, at any time (Art. 7(3)).

To exercise these rights, write to ⟦Contact email⟧. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77), for example the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit, www.datenschutz-berlin.de), or the authority where you live or work.

Scores and feedback are generated automatically, but they are training feedback only. No decision with legal effect or similarly significant effect on you is made by automated means (Art. 22 GDPR).

We use only what is strictly necessary for the service to work:

• sign-in session cookies set by Supabase Auth, which keep you signed in;
• the interface language cookie (fis_ui_lang), which remembers your EN / 中文 choice;
• device preferences in your browser's local storage: theme (light or dark), session language, conversation engine, turn-taking mode and whether the camera starts switched on;
• a short-lived note in session storage after you change your password.

We do not use tracking, analytics or advertising cookies, and no third-party tracking scripts. Because only strictly necessary storage is used, no consent banner is required (§ 25(2) TDDDG).

Usage statistics: we count page views and a few steps such as signing up, finishing the welcome and opening your feedback, to understand how the platform is used and to improve it. This is done by our own backend only: no cookies, no IP address stored, no third parties and no tracking across other websites. Visits while signed out are counted without any identifier, and not at all when your browser sends a Do Not Track or Global Privacy Control signal. While you are signed in, this activity is linked to your account. The legal basis is our legitimate interest in understanding and improving the service, Art. 6(1)(f) GDPR. The records are kept for 13 months and deleted with your account.

In live conversation mode you can switch on your camera. The video is analysed on your device only, in your browser, to derive short facial-expression labels; the same capture also gives your microphone signal for on-device voice features such as pitch and loudness. Only these labels and numbers are sent to us. Your video is never uploaded, recorded or stored.

Your microphone audio is sent to the speech-to-text and conversation providers of the mode you use (section 4) so the simulated patient can hear and answer you. It is not stored by our application.

To run the on-device analysis, your browser downloads model files from public content delivery networks (jsDelivr and Google). These receive your IP address and browser information, as with any download.

The service is not intended for anyone under 18, and we do not knowingly process data of children. If you believe a child has created an account, please contact us and we will delete it.

We may update this policy when the service or the law changes. The current version and its date are shown at the top of this page. If a change materially affects you, we will tell you in advance.

For any question about privacy, write to ⟦Contact email⟧ or to NYU Shanghai, ⟦Street and number, postcode, city⟧.