Privacy Policy

This Privacy Policy explains what information SimPT ("we," "us") collects when you use simpt.us (the "Service"), operated by 3D Medical LLC, how we use it, and the choices you have.

The short version: we collect your email to sign you in, your practice encounters to show you your work and improve the Service, and operational logs to keep the Service safe and affordable. We don't sell your data. Simulated patients are fictional — there is no real patient data in SimPT, and you must not enter any.

1. Information we collect

Account information. Your email address (used for passwordless sign-in links), the invite code you signed up with (if any), your account role (e.g., student or clinician), your acceptance of the Terms of Service, and sign-in timestamps.

Practice activity. For signed-in users: your simulated encounters — transcripts of what you typed, tests you ordered, findings revealed, evaluations you submitted, and the scores and feedback generated — are stored on our servers so your work follows your account across devices. For anonymous play of the public case, encounter state is stored in your browser, not on our servers, with one narrow exception: we keep short fragments of exam requests you typed and how they were matched — up to 300 characters, without your IP address, account, or any other identifier — to improve test recognition.

Feedback you give. Case endorsements, "something was off" reports, and any notes you submit.

Operational data. Server logs (including IP address and request metadata), rate-limit and abuse events, aggregate AI-usage cost accounting, and product events (e.g., case created, case reviewed, case shared). We use session cookies (httpOnly) to keep you signed in; we do not use advertising cookies or third-party analytics trackers.

Payment information. When paid plans are active, payments are processed by Stripe. We receive subscription status and limited billing metadata; we do not store full payment card numbers.

2. What we do not collect

Do not enter real patient information into SimPT. The Service is for fictional simulated encounters only. We do not knowingly collect protected health information, and the Service is not intended to create, receive, or transmit PHI under HIPAA. We do not knowingly collect information from children under 18; the Service is for adults in professional and pre-professional education.

3. How we use information

• To operate the Service: sign you in, save your encounters and cases, show your history across devices, and display aggregate endorsement counts.
• To generate simulated responses and scoring: the text you type during an encounter is processed by our AI model provider (Anthropic) to produce patient replies and graded feedback.
• To keep the Service safe and affordable: rate limiting, abuse detection, and cost monitoring.
• To improve the Service: analyzing product events, error reports, and feedback — including reviewing encounter data in aggregate or individually to fix bugs, calibrate grading, and improve cases.
• To communicate with you: sign-in links, service announcements, and (with your consent) product updates. We do not send third-party marketing.

4. How information is shared

We do not sell personal information. We share it only with:

• Service providers processing data on our behalf: Anthropic (AI model responses; encounter text is sent to generate replies and scores), DigitalOcean (hosting and database), Resend and ImprovMX (email delivery and forwarding), Stripe (payments), and an uptime monitoring service that receives no user data.
• Case authors and reviewers, in limited aggregate form: if you play a case shared with your cohort, aggregate feedback (such as endorsement counts) is visible; individually identifying instructor visibility (such as per-student results dashboards) is not currently a feature, and if it becomes one under an institutional arrangement, we will make that visibility clear in-product before it applies to you.
• Legal and safety: if required by law, or to protect the rights, safety, and integrity of the Service and its users.
• Business transfers: if SimPT is acquired or merged, data may transfer with appropriate protections and notice.

5. AI processing — plain-language note

SimPT's simulated patients and grading are powered by large language models via the Anthropic API. What you type in an encounter is sent to that API to generate the patient's reply and your scored debrief. Under Anthropic's commercial API terms, API inputs and outputs are not used to train Anthropic's models.

6. Students and FERPA

Individual accounts you create yourself are consumer accounts, not education records maintained by your school. If your institution adopts SimPT with rostering or instructor dashboards in the future, encounter records tied to that program may constitute education records under FERPA; in that case SimPT would act as a service provider to the institution under a written agreement, use such records only to provide the Service, and look to the institution for FERPA compliance decisions.

7. Retention and deletion

We retain account and encounter data while your account is active. You may request deletion of your account and associated personal data at [email protected]; we will delete or de-identify personal data within 30 days, except records we must keep for legal, billing, or security purposes. De-identified, aggregate data (e.g., scoring statistics, case-quality metrics) may be retained to improve the Service.

8. Security

Sign-in is passwordless via time-limited email links; sessions are revocable server-side tokens in httpOnly cookies. Data in transit is encrypted (TLS), including database connections verified against a certificate authority. Access to production data is limited to the operator. No system is perfectly secure; we will notify affected users of a breach as required by law.

9. Your choices and rights

You can sign out everywhere (revoking sessions), request a copy of your data, or request deletion at [email protected]. Depending on where you live, you may have additional rights under applicable privacy laws; we honor verified requests consistent with applicable law.

10. Changes to this Policy

We may update this Policy; material changes will be announced via the Service or email with an updated effective date.

11. Contact

3D Medical LLC · Boise, Idaho
[email protected]