Privacy Policy

1. Who We Are

SimAcademy LLC (“SimAcademy,” “we,” “us,” or “our”) operates the SimAcademy platform at www.simacademy.io, providing simulation-based medical education courses for healthcare professionals. SimAcademy LLC is the data controller for the personal information described in this policy.

For privacy-related inquiries, contact us at privacy@simacademy.io.

2. Information We Collect

2.1 Information You Provide Directly

2.2 Information Collected Automatically

2.3 Information from Third Parties

We may verify your NPI number against the publicly available NPPES NPI Registry maintained by the Centers for Medicare & Medicaid Services (CMS) to confirm your status as a healthcare professional. We do not purchase personal data from data brokers.

3. How We Use Your Information

We use the information we collect for the following purposes:

1. Providing the Service. Creating and maintaining your account, delivering course content, tracking your progress through simulations, and personalizing content based on your specialization(s).
2. Verifying credentials. Confirming that users are healthcare professionals through NPI validation.
3. Improving the platform. Analyzing usage patterns and feedback to enhance course content, develop new features, and fix issues.
4. Communications. Sending you service-related notices (e.g., account confirmation, Terms of Service updates, new course announcements). We will not send marketing emails without your opt-in consent.
5. Safety and security. Detecting and preventing fraud, unauthorized access, and other harmful activity.
6. Legal compliance. Fulfilling legal obligations and responding to lawful requests from authorities.

4. How We Share Your Information

We do not sell your personal information. We share information only in the following limited circumstances:

5. Cookies and Tracking Technologies

We use strictly necessary cookies to operate the Service (e.g., session management and authentication). We also set a first-party analytics cookie named sa_session containing a randomly generated identifier with a one-year lifetime. This cookie is used solely to connect events from the same browser session for product and marketing analysis (page views, link attribution, signup conversion).

We do not use advertising or third-party tracking cookies. No analytics data is shared with third-party advertising networks, and we do not use any third-party analytics processors — all analytics data is collected by our own infrastructure.

IP addresses: When you visit the Service, your IP address is hashed at the server with a rotating secret and the original is discarded. The resulting hash cannot be reversed to recover your IP. We retain the hash only for bot detection and coarse geographic attribution (country and region).

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the Service. Specific retention periods:

1. Account data and professional credentials: Retained while your account is active and for up to 12 months after account deletion, to allow for account recovery and to comply with legal obligations.
2. Usage and analytics data: Retained in identifiable form for up to 24 months, then aggregated or de-identified.
3. Feedback: Retained indefinitely in anonymized form for product improvement. Identifiable feedback is retained while your account is active.
4. Legal and compliance records: Retained as required by applicable law.

Upon account deletion, we will remove or de-identify your personal information within the timeframes above, except where retention is required by law.

7. Data Security

We implement reasonable administrative, technical, and physical safeguards to protect your personal information, including:

1. Encryption of data in transit (TLS/SSL) and at rest.
2. Access controls limiting employee access to personal data on a need-to-know basis.
3. Regular security assessments of our systems and infrastructure.
4. Secure password hashing — we never store passwords in plain text.

No system is completely secure. While we take commercially reasonable measures to protect your data, we cannot guarantee absolute security. If we become aware of a data breach that affects your personal information, we will notify you in accordance with applicable law.

8. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

1. Access. Request a copy of the personal information we hold about you.
2. Correction. Request that we correct inaccurate or incomplete information.
3. Deletion. Request that we delete your personal information, subject to legal retention requirements.
4. Data portability. Request a machine-readable copy of your data.
5. Opt out of marketing. Unsubscribe from marketing communications at any time using the link in any marketing email, or by contacting us.
6. Withdraw consent. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing performed before withdrawal.

To exercise any of these rights, contact us at privacy@simacademy.io. We will respond within 30 days (or sooner if required by applicable law). We may ask you to verify your identity before fulfilling a request.

9. State-Specific Privacy Rights

9.1 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (as amended by the CPRA):

1. The right to know what personal information we collect, use, and disclose.
2. The right to delete your personal information.
3. The right to opt out of the “sale” or “sharing” of personal information. Note: we do not sell or share personal information as defined under the CCPA/CPRA.
4. The right to non-discrimination for exercising your privacy rights.

To make a request, email privacy@simacademy.io with the subject line “California Privacy Request.”

9.2 Other U.S. State Privacy Laws

Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, and others) may have similar rights. We honor all applicable state privacy rights. Contact us at privacy@simacademy.io to exercise your rights under your state’s law.

10. Children’s Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from minors. If we learn that we have collected information from a person under 18, we will promptly delete it. If you believe a minor has provided us with personal information, please contact us at privacy@simacademy.io.

11. International Users

The Service is operated from the United States and is primarily intended for users in the United States. If you access the Service from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country. By using the Service, you consent to this transfer.

12. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any external sites you visit.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through a prominent notice on the Service at least 30 days before the changes take effect. The “Effective Date” at the top of this page indicates when the policy was last revised.

Your continued use of the Service after an updated Privacy Policy takes effect constitutes your acceptance of the changes. If you do not agree, you should discontinue use of the Service and request deletion of your account.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

SimAcademy LLC
Email: privacy@simacademy.io
General inquiries: support@simacademy.io
Website: www.simacademy.io