Privacy policy

Who is responsible

For students and staff, your medical school decides how MedSim is used and is responsible for your data; we process it on the school's behalf and only as our agreement with the school allows. For people who learn on their own with an account of their own, visitors to this website, the free trial and the demo request form, VirtualVerse Studio is responsible.

Write to contact@virtualverse.studio with any question about your data.

What we keep

• Your account: your name, your email address (your institutional one, if a school added you), your school, your role and your classes if you have them. You sign in with a code we email you; if your school gave you a password, only a one-way hash of it is stored.
• Your consultations: what you say or type to the patient and what the patient answers (the transcript), what you examine, the tests you order, your diagnosis, differentials and plan, your score, and any change an educator makes to it with their reason.
• How long each consultation lasted, and your school's credits used.
• When you sign in on a headset or phone: which kind of device, the app's version, and a token that keeps it signed in (we store only its hash).
• From visitors who try MedSim without an account: nothing that names you, unless you fill in the trial's form. To limit free sessions, we count them against a random code kept in a cookie in your browser for 30 days, and against a one-way code made from your internet address for a day.
• From the trial's form, if you fill it in for two more free sessions: your name, email, phone number if you give one, whether you are a student, intern, doctor or educator, your university or hospital, the patient you were seeing, and the country and city your internet address points to.
• From the demo request form: your name, work email, school, role, country, number of students and your message.
• Website measurement: page visits, language and referral labels, plus whether a public trial session was created, a diagnosis was submitted or a school demo request was saved. These outcome measurements use pseudonymous codes and do not include consultation text, diagnosis choices or the details entered in a booking form.
• Learning on your own: your credits (those given when you join, the packs you buy and each month of MedSim Plus, each with the store's transaction number; never your card, which only Apple or Google sees), what you spent them on, today's free typed consultations, and the rewarded ads you chose to watch.
• If you subscribe to MedSim Plus: which store you subscribed in, the store's reference for the subscription (Apple's original transaction number, or a one-way hash of Google Play's purchase token), whether it's monthly or yearly, and when the time you paid for ends.
• If you choose to watch a rewarded ad in the apps, Google (AdMob) shows it and may use your device's advertising identifier and rough location to pick it, as Google's own privacy policy describes. Where the law asks for it, Google's form asks for your consent first.

Voice

When you talk to a patient, your voice is turned into text and the patient's reply into speech as you speak. No recording of your voice is kept: the audio is deleted, and our voice provider deletes its copy of the transcript after 7 days. The transcript MedSim keeps is the one described above.

What we use it for

• To run MedSim for your school: sign-in, assignments, consultations, scores and the results educators see.
• To score consultations: an AI reads the transcript and your plan against the case's score sheet. Educators can change any mark.
• To sell credits and MedSim Plus and give you what you paid for, and one more free typed consultation for an ad you watched.
• To answer demo requests and to keep the service secure and working.
• To tell people who filled in the trial's form about MedSim, its news and its offers, by email or phone, as they agreed when they sent it. Ask us to stop at any time and we will.
• To understand which pages and studio links lead to a trial or a school enquiry, and improve those paths.

We do not sell your data or use it to train AI models. MedSim shows an ad only when someone learning on their own chooses to watch one: a school's students and staff never see ads.

Who processes it, and where

These companies run parts of MedSim for us, under their data processing terms, and see only what their part needs:

• Supabase: the database and sign-in, in Frankfurt, Germany.
• PostHog: website usage and public trial and school-enquiry measurements, in the United States. These outcome measurements do not include consultation content or booking-form details.
• Vercel: the website and app servers, in Frankfurt, Germany, with pages delivered from locations near you. On the free trial page it counts visits without cookies.
• ElevenLabs: the patients' voices and speech-to-text, in the United States.
• Anthropic: the AI that scores consultations and helps educators write cases, in the United States.
• Amazon Web Services: the emails that carry sign-in codes and replies, in the United States.
• Apple (the App Store) and Google (Google Play): buying credits and MedSim Plus in the apps. They take the payments, renewals included; we receive only the transactions.
• Google (AdMob): the rewarded ads in the apps, and the consent form where the law asks for one.

Data that leaves your country

Because these services run in Germany and the United States, your data leaves Egypt or Saudi Arabia. We transfer it only to the services above, for the purposes above, with the safeguards the data protection laws of Egypt (Law No. 151 of 2020) and Saudi Arabia (the Personal Data Protection Law) require.

How long we keep it

• Accounts and consultations: while your school uses MedSim. A school can ask us to delete a student's data at any time, and when its agreement ends we delete its data within 90 days.
• Demo requests: up to two years, unless you ask us to delete yours sooner.
• The trial's form: up to two years, unless you ask us to delete it sooner.
• The free trial's counts: 30 days for your browser, one day for your internet address.
• An account of your own: until you delete it, in the app (Your account, then Delete my account) or by writing to us. It goes at once, with any credits left on it. We keep only a one-way code made from its email address, which can't be turned back into the address, so that a new account doesn't get the free credits again.

Cookies

MedSim uses cookies to keep you signed in, remember your time zone and limit free trials, and browser storage for settings such as your chosen language. PostHog uses a pseudonymous browser identifier to measure website visits. A separate cookie remembers a fixed studio-link label for up to 30 minutes so we can associate a trial or school enquiry with that link; it contains no name, email address or unique visitor identifier. The website does not use advertising cookies.

Your rights

You can ask to see the data MedSim keeps about you, to correct it, to delete it, or to object to how it is used. Students and staff can ask their school or write to us; we pass requests about school data to the school and help it answer. You can also complain to the data protection authority in your country.

Security

Data is encrypted between your device and our servers. The database keeps each school's data apart from every other school's, and staff see only what their role allows. Access on our side is limited to the people who run the service.

Age

MedSim is for medical students and the staff who teach them. It is not meant for anyone under 18.

Changes

When this policy changes, we update the date above and tell schools of any change that matters to them before it applies.