Privacy Policy

1. Who We Are

This Privacy Policy describes how BVS Trade F.Z.C, Ajman Free Zone Building B1, office 550, United Arab Emirates ("we", "us"), the data controller for clintalk.app (the "Service"), collects, uses, and protects personal data. It applies together with our Terms of Service.

2. What We Collect

• Account data: your email address, name entered in My settings, and, if you enable password sign-in, a salted one-way password hash. Magic-link and one-time-code login remain available; plaintext passwords and login codes are never stored.
• Session data: when you run a simulation, we store the scenario used, session status and timestamps, the text transcript of your conversation with the simulated patient, and the automated rubric scores ("judgments") generated for that session.
• Billing data: if you subscribe, we store your selected plan, subscription status, and payment records (amount, currency, status, timestamps). We do not store your full card number — card details are handled directly by our payment processor.
• Technical data: IP address and basic request metadata, used for security, rate-limiting, and abuse prevention (e.g., during checkout and login).

3. Voice & Facial-Expression Data

During a session, numeric voice and facial-expression features (aggregated, roughly one data point per second) may be computed in your browser and sent to our server solely to generate self-reflection feedback in your session report. We do not store raw audio, raw video, or camera images, and we do not persist biometric identifiers. Only the aggregated numeric features and the text transcript are retained.

4. Cookies

We use a single first-party, strictly-necessary session cookie to keep you signed in (HTTP-only, transmitted only over HTTPS). We do not use third-party advertising or analytics cookies.

5. How We Use Your Data

• to create and operate your account and deliver the Service you request (contract performance);
• to process payments and manage subscriptions (contract performance);
• to generate your session feedback, scores, and progress history (contract performance);
• to secure the Service, prevent fraud and abuse, and enforce our Terms (legitimate interest);
• to improve the Service, including in aggregated or de-identified form (legitimate interest);
• where you have given consent, for any additional optional feature that requests it (consent, which you may withdraw at any time).

6. Who We Share Data With

We share personal data only with service providers ("subprocessors") who need it to help us operate the Service, under contractual confidentiality and data-protection obligations:

• AI processing providers (e.g., OpenAI and Microsoft Azure), to generate the simulated patient's responses and compute automated feedback;
• Our hosting provider, which hosts the Service's infrastructure;
• Our payment processor, to process subscription payments;
• Professional advisers or authorities, where required by law or to protect our legal rights.

We do not sell your personal data.

7. International Data Transfers

We are established in the United Arab Emirates, and the Service's infrastructure is currently hosted in the United States. This means your data is transferred to, and processed in, a country other than your own. Where required by applicable law, we rely on appropriate safeguards for such transfers (such as data processing agreements with our providers). By using the Service, you acknowledge this cross-border transfer.

8. Data Retention & Deletion

We keep your account and session data for as long as your account is active, and afterwards only as needed for legitimate business, accounting, or legal purposes.

You can delete your own session data at any time from your account, without contacting an administrator:

• delete a single session — permanently erases that session's transcript and scores;
• delete all your sessions — permanently erases all of your session data.

These are hard, permanent deletions (no recovery copy is kept). To delete your entire account or request a broader erasure, email us at the address in Section 13.

9. Your Rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal data, to object to certain processing, and to withdraw consent where processing is based on consent. To exercise any of these rights, contact us at the address in Section 13. If you are in the European Economic Area, you also have the right to lodge a complaint with your local data protection authority; if you are in the United Arab Emirates, you may contact the UAE Data Office.

10. Children

The Service is intended for adults (18+) in healthcare education and is not directed at children. We do not knowingly collect personal data from children.

11. Security

We use encryption in transit (HTTPS), one-way hashing for login codes, and access controls to protect your data. No system is completely secure; if we become aware of a data breach affecting your personal data, we will notify you and any relevant authority as required by applicable law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through a notice on the Service before the change takes effect.

13. Contact

For any privacy question or to exercise your rights, contact us at info@clintalk.me, or by post to BVS Trade F.Z.C, Ajman Free Zone Building B1, office 550, United Arab Emirates.