Privacy Policy

Last updated: 5 October 2026

This policy says what SimLab does with personal data when you use the training simulator. We have written it the way things actually are today, including where that is not how we would like them to be.

In short

What we store: your account, your conversations as text, the feedback you receive, and technical details of the session (browser, microphone, timings).
What we never store: audio. Your voice is streamed to the speech vendor while you speak, but SimLab does not record or store it.
Where it is processed: what SimLab itself stores is kept on one server in Germany. Your speech and the conversation text for the language model are sent to Google's endpoint in the EU. Sign-in (Clerk) is processed in the US. The video avatar (Anam) runs in the EU and may be moved to the US under high load.
No training on your content: SimLab does not train AI models on your conversations. In the setup pilot accounts use, we buy the vendors' services for businesses, whose terms say that content is not used to train their models. The video avatar vendor (Anam) has confirmed this in writing.
Who can see what: you see your own conversations and feedback. Your employer or lecturer does not see your conversations. SimLab staff can read conversation text to operate and improve the service.
Deletion: under Settings in the app you can download your data, and delete your account with all its content.

1. Who is responsible

SimLab AS is the data controller for personal data in the service when you use it on your own. Questions can be sent to support@simlab.as.

If you use SimLab through your employer or your place of study, they are as a rule the data controller for the training data, and SimLab is their data processor. Their legal basis then applies, and you can also contact them.

2. What we process and why

Account and sign-in

Data: Pilot account: user ID, password (held by the sign-in provider), organisation and group, language and settings. Ordinary account: also name and e-mail address.
Legal basis: Contract (GDPR Art. 6(1)(b))
Retention: Until the account is deleted.

Training sessions

Data: Text transcript of the conversation, the help tips you were given, the feedback with scores, the character's account of the conversation, turns you have marked as misheard, progress and certifications.
Legal basis: Contract (GDPR Art. 6(1)(b))
Retention: Until the account is deleted. There is no automatic deletion after a set time.

Technical session data (troubleshooting)

Data: What each speech recogniser heard (text), browser and version, platform and device type, the name of the microphone (an owner's name is removed) and microphone settings, timings and counters, and which vendors and countries processed the session. Never audio, and not your IP address.
Legal basis: Legitimate interest (Art. 6(1)(f)): finding faults and improving speech recognition.
Retention: Until the account is deleted.

Speech in the moment

Data: The audio of your voice is streamed to the speech vendor while you speak, so the character can hear you and answer.
Legal basis: Contract (GDPR Art. 6(1)(b))
Retention: SimLab does not store the audio. What the vendors buffer for a short time for operations and abuse monitoring follows from their terms.

Video avatar

Data: The character's audio, a random session label and your IP address go to the avatar vendor. SimLab stores that an avatar was used, its duration and region.
Legal basis: Contract (GDPR Art. 6(1)(b))
Retention: The session is deleted at the vendor when the conversation is over. Our own record is deleted with the account.

Self-regulation (optional)

Data: Analysis of your wording and response time in the transcript. Never of your voice.
Legal basis: Consent (Art. 6(1)(a)). You turn it on and off in Settings.
Retention: Until the account is deleted.

Billing

Data: Subscription, number of users, voice minutes used and the customer ID at the payment provider. Customer ID and payment only when billing is set up.
Legal basis: Contract (Art. 6(1)(b)) and bookkeeping obligations (Art. 6(1)(c)).
Retention: For as long as the agreement lasts. Accounting records for as long as the Norwegian Bookkeeping Act requires.

Support and enquiries

Data: E-mail you send us, feedback you give in the app (rating and comment), and the details in the demo form: name, organisation, e-mail, and where given phone number and message.
Legal basis: Legitimate interest (Art. 6(1)(f)): answering you and improving the service.
Retention: Feedback in the app: until the account is deleted. Enquiries: until you ask us to delete them.

Operations and security

Data: Server logs (time, requests and error messages; they may contain an IP address), the log of administrative actions in the organisation, and backups of the database.
Legal basis: Legitimate interest (Art. 6(1)(f)): keeping the service running and secure.
Retention: Server logs are overwritten continuously once they reach a fixed size; there is no fixed time limit. Backups are deleted after about two weeks.

Purpose	Data	Legal basis	Retention
Account and sign-in	Pilot account: user ID, password (held by the sign-in provider), organisation and group, language and settings. Ordinary account: also name and e-mail address.	Contract (GDPR Art. 6(1)(b))	Until the account is deleted.
Training sessions	Text transcript of the conversation, the help tips you were given, the feedback with scores, the character's account of the conversation, turns you have marked as misheard, progress and certifications.	Contract (GDPR Art. 6(1)(b))	Until the account is deleted. There is no automatic deletion after a set time.
Technical session data (troubleshooting)	What each speech recogniser heard (text), browser and version, platform and device type, the name of the microphone (an owner's name is removed) and microphone settings, timings and counters, and which vendors and countries processed the session. Never audio, and not your IP address.	Legitimate interest (Art. 6(1)(f)): finding faults and improving speech recognition.	Until the account is deleted.
Speech in the moment	The audio of your voice is streamed to the speech vendor while you speak, so the character can hear you and answer.	Contract (GDPR Art. 6(1)(b))	SimLab does not store the audio. What the vendors buffer for a short time for operations and abuse monitoring follows from their terms.
Video avatar	The character's audio, a random session label and your IP address go to the avatar vendor. SimLab stores that an avatar was used, its duration and region.	Contract (GDPR Art. 6(1)(b))	The session is deleted at the vendor when the conversation is over. Our own record is deleted with the account.
Self-regulation (optional)	Analysis of your wording and response time in the transcript. Never of your voice.	Consent (Art. 6(1)(a)). You turn it on and off in Settings.	Until the account is deleted.
Billing	Subscription, number of users, voice minutes used and the customer ID at the payment provider. Customer ID and payment only when billing is set up.	Contract (Art. 6(1)(b)) and bookkeeping obligations (Art. 6(1)(c)).	For as long as the agreement lasts. Accounting records for as long as the Norwegian Bookkeeping Act requires.
Support and enquiries	E-mail you send us, feedback you give in the app (rating and comment), and the details in the demo form: name, organisation, e-mail, and where given phone number and message.	Legitimate interest (Art. 6(1)(f)): answering you and improving the service.	Feedback in the app: until the account is deleted. Enquiries: until you ask us to delete them.
Operations and security	Server logs (time, requests and error messages; they may contain an IP address), the log of administrative actions in the organisation, and backups of the database.	Legitimate interest (Art. 6(1)(f)): keeping the service running and secure.	Server logs are overwritten continuously once they reach a fixed size; there is no fixed time limit. Backups are deleted after about two weeks.

Documents administrators upload: administrators can build scenarios from an incident report or a procedure. The document is not stored. It is read in memory, automatically scrubbed of e-mail addresses, national identity numbers and phone numbers, and the text is then sent to a language model (see section 3) that drafts the scenario. Do not upload documents containing patient or service-user data.

Cookies: we use only necessary cookies and local storage in the browser, for sign-in, language and settings. We use no analytics or advertising tools.

3. Who processes the data

These sub-processors process data for us. The setup pilot accounts use comes first. The vendors at the bottom are used only in other setups.

The setup pilot accounts use (EEA mode)

Hetzner Online GmbH

What it does: Runs the server that holds the application, the database and the backups.
What it receives: Everything SimLab stores: account, transcripts, feedback and technical session data.
Where it is processed: Germany (Falkenstein)
Transfer basis: Inside the EEA. No transfer.

Clerk, Inc.

What it does: Sign-in.
What it receives: Pilot account: user ID and password, and IP address and browser type when you sign in. Ordinary account: also name and e-mail address.
Where it is processed: USA
Transfer basis: EU–US Data Privacy Framework and the EU Standard Contractual Clauses (SCC).

Google Cloud

What it does: The character's voice (Gemini Live), speech recognition (Chirp 3) and the language model Claude, which runs on Vertex AI. The language model writes the character's lines, the help tips during the session, the feedback report and the character's own account of the conversation.
What it receives: The audio of what you say, while you speak, the conversation as text and the scenario description. No user ID, name or e-mail address.
Where it is processed: EU (Google's “eu” multi-region; the country is not stated)
Transfer basis: Sent to Google's EU endpoint.

Anam.ai Ltd

What it does: Video avatar: renders the picture of the character speaking. When it is unavailable, a 3D figure is drawn in your own browser with no vendor involved.
What it receives: The character's audio (not your voice), a random session label and your IP address, because your browser connects directly to the vendor. We request that the session is not recorded, and delete it at the vendor when the conversation is over.
Where it is processed: The closest region: the EU for every session we have recorded. May be the US under high load. The company is in the United Kingdom.
Transfer basis: United Kingdom: the European Commission's adequacy decision. US: the transfer terms in the vendor's data processing agreement.

Used only in other setups, not for pilot accounts

OpenAI

What it does: Voice engine (voice and speech recognition) in setups without EEA mode. Also drafts scenarios and demo conversations for administrators.
What it receives: The audio of what you say, the conversation as text and the scenario description. From administrators: the text of an uploaded document after automatic scrubbing.
Where it is processed: USA
Transfer basis: The EU Standard Contractual Clauses (SCC).

Simli AS

What it does: Video avatar for organisations that use this vendor.
What it receives: The character's audio (not your voice) and your IP address. The vendor's terms allow it to use the content to train its own models.
Where it is processed: Norwegian company. The audio is sent to an endpoint in the EEA (the Netherlands). The vendor states that the picture may be rendered on servers in Finland and in the US.
Transfer basis: EEA. For the US: the Standard Contractual Clauses in the vendor's data processing agreement.

Stripe

What it does: Payment and subscriptions, only when billing is set up.
What it receives: The payer's e-mail address, and customer and subscription IDs. You give card details directly to the payment provider.
Where it is processed: USA
Transfer basis: The EU Standard Contractual Clauses (SCC).

Resend

What it does: Sends e-mail (invitations, reminders, notifications), only when e-mail is set up. Pilot accounts are never sent e-mail.
What it receives: The recipient's e-mail address and the content of the e-mail.
Where it is processed: USA
Transfer basis: The EU Standard Contractual Clauses (SCC).

Cartesia

What it does: Norwegian character voice in a voice engine only system administrators can choose.
What it receives: The character's lines as text. Not your voice, and no user ID.
Where it is processed: USA
Transfer basis: The EU Standard Contractual Clauses (SCC).

Vendor	What it does	What it receives	Where it is processed	Transfer basis
The setup pilot accounts use (EEA mode)
Hetzner Online GmbH	Runs the server that holds the application, the database and the backups.	Everything SimLab stores: account, transcripts, feedback and technical session data.	Germany (Falkenstein)	Inside the EEA. No transfer.
Clerk, Inc.	Sign-in.	Pilot account: user ID and password, and IP address and browser type when you sign in. Ordinary account: also name and e-mail address.	USA	EU–US Data Privacy Framework and the EU Standard Contractual Clauses (SCC).
Google Cloud	The character's voice (Gemini Live), speech recognition (Chirp 3) and the language model Claude, which runs on Vertex AI. The language model writes the character's lines, the help tips during the session, the feedback report and the character's own account of the conversation.	The audio of what you say, while you speak, the conversation as text and the scenario description. No user ID, name or e-mail address.	EU (Google's “eu” multi-region; the country is not stated)	Sent to Google's EU endpoint.
Anam.ai Ltd	Video avatar: renders the picture of the character speaking. When it is unavailable, a 3D figure is drawn in your own browser with no vendor involved.	The character's audio (not your voice), a random session label and your IP address, because your browser connects directly to the vendor. We request that the session is not recorded, and delete it at the vendor when the conversation is over.	The closest region: the EU for every session we have recorded. May be the US under high load. The company is in the United Kingdom.	United Kingdom: the European Commission's adequacy decision. US: the transfer terms in the vendor's data processing agreement.
Used only in other setups, not for pilot accounts
OpenAI	Voice engine (voice and speech recognition) in setups without EEA mode. Also drafts scenarios and demo conversations for administrators.	The audio of what you say, the conversation as text and the scenario description. From administrators: the text of an uploaded document after automatic scrubbing.	USA	The EU Standard Contractual Clauses (SCC).
Simli AS	Video avatar for organisations that use this vendor.	The character's audio (not your voice) and your IP address. The vendor's terms allow it to use the content to train its own models.	Norwegian company. The audio is sent to an endpoint in the EEA (the Netherlands). The vendor states that the picture may be rendered on servers in Finland and in the US.	EEA. For the US: the Standard Contractual Clauses in the vendor's data processing agreement.
Stripe	Payment and subscriptions, only when billing is set up.	The payer's e-mail address, and customer and subscription IDs. You give card details directly to the payment provider.	USA	The EU Standard Contractual Clauses (SCC).
Resend	Sends e-mail (invitations, reminders, notifications), only when e-mail is set up. Pilot accounts are never sent e-mail.	The recipient's e-mail address and the content of the e-mail.	USA	The EU Standard Contractual Clauses (SCC).
Cartesia	Norwegian character voice in a voice engine only system administrators can choose.	The character's lines as text. Not your voice, and no user ID.	USA	The EU Standard Contractual Clauses (SCC).

None of the vendors learn who you are from us beyond what the table says. But what you say in the conversation becomes part of the audio and the text they process.

4. Where the data is processed

Not everything is processed in the EU/EEA. The table shows each place and what makes the processing there lawful.

Germany (EEA)

Who: Hetzner
What is processed there: All storage: database, application and backups.
Legal basis for the place: Inside the EEA. No transfer.

Elsewhere in the EU (EEA)

Who: Google, Anam
What is processed there: Speech while you speak and conversation text for the language model (EU multi-region), and the video avatar (the vendor states Spain).
Legal basis for the place: Inside the EEA.

United Kingdom

Who: Anam
What is processed there: The avatar vendor is a UK company and manages the sessions from there.
Legal basis for the place: The European Commission's adequacy decision for the United Kingdom.

USA

Who: Clerk, Anam, OpenAI, Cartesia, Simli, Stripe, Resend
What is processed there: Sign-in, always. The video avatar under high load. In other setups also the voice engine, payment and e-mail.
Legal basis for the place: The EU–US Data Privacy Framework for vendors certified under it, and the EU Standard Contractual Clauses (SCC). See each vendor in the table above.

Place	Who	What is processed there	Legal basis for the place
Germany (EEA)	Hetzner	All storage: database, application and backups.	Inside the EEA. No transfer.
Elsewhere in the EU (EEA)	Google, Anam	Speech while you speak and conversation text for the language model (EU multi-region), and the video avatar (the vendor states Spain).	Inside the EEA.
United Kingdom	Anam	The avatar vendor is a UK company and manages the sessions from there.	The European Commission's adequacy decision for the United Kingdom.
USA	Clerk, Anam, OpenAI, Cartesia, Simli, Stripe, Resend	Sign-in, always. The video avatar under high load. In other setups also the voice engine, payment and e-mail.	The EU–US Data Privacy Framework for vendors certified under it, and the EU Standard Contractual Clauses (SCC). See each vendor in the table above.

5. Pseudonymous pilot accounts

Some users, for example students in a pilot, get an account through a registration link. For these accounts:

The account is a random user ID (for example “abc-482”) and a passphrase. We do not ask for a name, and the account has no real e-mail address.
We cannot send you e-mail, and you cannot reset the passphrase yourself. If you lose it, the administrator of your organisation, for example your lecturer, can give you a new one.
SimLab does not know who is behind a user ID. But what you say in the conversation is stored as text. Do not say your name, or details about yourself or real people, in the role-play.
The account is pseudonymous, not anonymous. Your voice is processed by the speech vendor while you speak, and your IP address is visible to SimLab's server, the sign-in provider and the avatar vendor.
Your lecturer or administrator sees that a user ID exists, how many sessions it has, and whether assigned tasks are completed. They do not see the conversations, and in pilot mode not your scores either.

6. Who can see what

You see your own transcripts, feedback and history.
The administrator of your organisation (manager or lecturer) sees the member list, the number of sessions, the status of assignments and aggregate statistics for the group, including the average score. The administrator never sees conversation text. Individual scores are shown only if the organisation has turned that on, and in pilot mode it cannot be turned on. In a small group an average may still say something about individuals.
SimLab staff with system access can read conversation text, feedback and technical session data to operate, troubleshoot and improve the service. When they open the app the way you see it, it is read-only, limited to 60 minutes, requires a written reason and is logged.

7. Your rights and how to use them

You have the right to access, rectification, erasure, data portability and restriction, and to object to processing based on legitimate interest. You can withdraw consent at any time.

Access and copy: under Settings in the app you download a copy of your data (JSON): profile, sessions with transcripts, feedback, certifications, consent log, what the speech recognisers heard, and the description of your device.
Deletion: under Settings you delete your account permanently, with all sessions, transcripts and feedback. The account is also deleted at the sign-in provider, and avatar sessions still held by the avatar vendor are deleted.
After deletion: data may remain in a backup for about two weeks. The log of administrative actions is kept. It says that an account was deleted and, for a pilot account, that the user ID was created. Name and e-mail address are removed from the log.
Other requests, for example rectification or restriction, are sent to support@simlab.as. We answer without undue delay and within one month at the latest. If you have a pilot account, we cannot find your data from your name. State your user ID.

You can complain to the Norwegian Data Protection Authority (Datatilsynet), see datatilsynet.no. We appreciate it if you contact us first, so we can put things right.

8. Retention

Account, transcripts, feedback and technical session data are stored until the account is deleted, by you or under the agreement with your organisation. We do not yet have automatic deletion after a set time.
Audio is never stored by SimLab.
The avatar session is deleted at the avatar vendor when the conversation is over.
Backups of the database are deleted after about two weeks.
Server logs are overwritten continuously. There is no fixed time limit.

9. Security

Traffic between your browser and SimLab, and between SimLab and the vendors, is encrypted in transit. The service runs on one rented server in Germany, and only SimLab's own staff have access to the server and the database. SimLab does not store your password; it is held by the sign-in provider. We back up the database every day, and the copies are kept on the server in Germany. If we discover a personal data breach, we notify your organisation and the Norwegian Data Protection Authority as the GDPR requires.

10. Changes

We update this policy when the service, the vendors or the law change. The date at the top shows the latest change. A new sub-processor is announced to organisation customers before it is taken into use, as the data processing agreement says.

11. Contact

Questions about privacy in SimLab? Write to support@simlab.as. See also the terms of use and the page on privacy and security.