Effective date: September 27, 2026 · Contact us with questions.

Overview

Simorio ("we", "us", or "our") is a browser-based clinical simulation platform operated during an alpha development period. This policy explains what information we collect, why we collect it, and how we handle it. Simorio is an educational tool: we do not collect, store, or process any real patient data or protected health information (PHI).

What we collect

We collect the following categories of information:

Account information. When you create an account, we collect your email address and, if you choose to provide it, a display name. We do not require your real name.
Usage and session metadata. We log activity such as when sessions are created or joined, scenario selections, and simulator interactions. This data is linked to your account and used to power debriefing features (e.g. playback timelines). It contains no real patient information.
Contact-form submissions. If you reach out via our contact form, we store the name, email address, and message you submit so we can respond to you.
Log and diagnostic data. Our hosting infrastructure automatically records standard server logs (IP address, browser type, pages visited, timestamps). We use this for security monitoring and debugging.
Security records. To detect abuse and protect the service, we record the IP addresses your account signs in from and security events, such as repeated refused requests or hitting a usage limit, together with the account and IP address involved. We keep these records for up to 90 days, then delete them. Our sign-in provider also keeps the IP address of each active sign-in for as long as that sign-in lasts.
Bot-protection signals. When you sign in, join a session, or send us a form, Cloudflare Turnstile runs a brief check in your browser to tell people apart from automated traffic. It processes technical information about your browser and device for that check only, and it does not read what you type into our forms. Cloudflare describes how it handles this data in itsTurnstile Privacy Addendum.

No real patient data

Simorio is a simulator for education and training purposes only. It is not connected to any electronic health record system and is not designed or intended to hold real patient information. Please do not enter real patient names, identifiers, or clinical data into Simorio.

Cookies and local storage

We use browser localStorage and session cookies to maintain your login session and remember lightweight preferences (such as your last-used display settings). We do not use advertising or third-party tracking cookies.

Site analytics

We measure aggregate traffic on our public marketing pages using Vercel Web Analytics, our hosting provider's built-in measurement. It records the page visited, the referring site, and coarse country, device, and browser information. It does not set cookies, does not follow you across other websites, and does not build a profile of you: visits are counted using a value derived from your request that is rotated daily and cannot be reversed to identify you. Analytics is not used inside the simulator itself, so nothing you enter into a scenario is collected.

Diagnostics and problem reports

To keep live sessions reliable, the Simorio app on each device keeps a short, rolling record of technical events from the last several minutes: connection status, the timing of updates between devices, how long our servers took to respond, screen-refresh stalls, and errors. This record stays in your browser's memory and is discarded when you close the tab. It is sent to us only when the app detects a technical problem, when an instructor or organization administrator files a "Something's wrong" report for the session, or when a Simorio engineer captures diagnostics while investigating a live issue. When it is sent, it is tagged with the session code, your role in the session, a random identifier for the browser tab, the app version and your browser type, and it is linked to your account if you are signed in. It does not include patient information. A report may include an image of the monitor's waveform display.

Diagnostics and monitor images are deleted after 30 days. Problem reports and their message threads are kept so we can follow up; they are visible to the person who filed them, their organization's administrators, and Simorio staff.

Data processors

We rely on the following sub-processors to operate the service:

Supabase: database, authentication, and server-side functions. Data is stored in Supabase's managed PostgreSQL infrastructure.
Vercel: hosting, edge functions, and CDN delivery for our web application and marketing site, plus the cookieless traffic analytics described above.
Cloudflare: the realtime servers that run live simulation sessions and keep every device in a session in step, and Turnstile, the bot-protection check on sign-in, session joins, and our forms.
Resend: delivery of transactional email, such as sign-in links, invitations, and replies to problem reports.

Each processor operates under its own privacy and security frameworks. We do not sell your data to any third party.

How we use your information

To provide and improve the Simorio service.
To allow you to log in and manage your account.
To store session recordings so you can play them back for debriefing.
To respond to support and sales inquiries submitted via our contact form.
To monitor for abuse, bugs, or security incidents.

Data retention

We retain account and session data for as long as your account is active. You may request deletion of your account and associated data at any time by contacting us. Diagnostic data is kept for 30 days, and IP addresses and security events for up to 90 days, as described above. During the alpha period, data may be wiped across all accounts as part of platform resets prior to general availability. We will provide advance notice where practicable.

Your rights

Depending on your jurisdiction, you may have rights to access, correct, or delete your personal data, or to object to certain processing. To exercise any of these rights, please contact us.

Security

We use industry-standard measures (HTTPS, encrypted databases, row-level access controls) to protect your data. No system is perfectly secure; please use a strong, unique password for your account.

Children

Simorio is intended for healthcare educators and students aged 18 and over. We do not knowingly collect personal information from children under 13. If you believe we have done so inadvertently, please contact us and we will delete the information promptly.

Changes to this policy

We may update this policy as the product evolves. We will update the effective date at the top of the page. Material changes will be communicated via email or an in-app notice for registered users.

Contact

Questions or requests regarding this policy: contact us here.

Privacy Policy