Legal
Privacy Policy
Version 2026-07-30 · Effective 30 July 2026
In brief
We collect the data needed to run Rounds and save your learning progress. We do not sell your personal data. You can request a copy or correction through support, and you can permanently delete your account yourself.
1. Scope and contact
This policy explains how Rounds handles personal data when you use our website, app, clinical simulations, and support channels. For privacy requests or grievances, use the public support route, which can associate the request with your signed-in account without asking you to paste private identifiers, or email hello@rounds.med.
2. Data we collect
Account and profile
Name, email address, profile image, and—if you choose to provide them—phone number, college, training year, internship month, and country.
Learning activity
Cases opened and completed, scores, clinical actions, answers, hints, time spent, streaks, and progress.
Simulator content
Questions, orders, management actions, submitted diagnoses, handovers, generated patient replies, and case transcripts needed to run, grade, save, and review a simulation.
Technical and support data
Device/browser details, IP address, security and reliability logs, consent preference, and information you include in feedback or support requests.
Do not enter information about a real patient. Rounds cases are fictional and the simulator is not designed to receive real patient records or personal health information.
3. How we use data
- Authenticate accounts and provide the Service.
- Run simulations, generate patient responses, grade attempts, and show scorecards.
- Save progress, history, streaks, preferences, and learning analytics.
- Secure, debug, monitor, and improve product and case quality.
- Send necessary account and service communications and respond to support.
- Meet applicable legal obligations and enforce our Terms.
4. Services that process data
Supabase
Authentication and database services, including account and saved learning data.
Google Gemini
AI processing for fictional patient responses, assistance, and grading. We do not intentionally add your account email or profile name, but simulator prompt content and text you submit are sent for processing, so do not enter real patient or other confidential data.
Vercel and Google Cloud Run
Frontend and backend hosting, delivery, security, and service logs.
Redis
Short-lived active simulator state, rate limits, and cost controls. Active session state normally expires within eight hours.
Sentry
Access-restricted error diagnostics with default personal-information collection disabled.
PostHog, Google Analytics, and Vercel Analytics
Optional product analytics that load only after consent. Analytics events exclude simulator transcripts, diagnoses, patient-case text, email, and phone number.
5. Storage and retention
Account and learning data are retained while your account is active so that history and progress remain available. Active simulator state normally expires within eight hours. Self-service account deletion immediately removes your login and account-linked application records from primary systems. Limited security logs, provider backups, and already-aggregated or de-identified statistics may remain for their configured retention periods and are not used to recreate your account.
6. Your choices and rights
Subject to applicable law, you may request access or export, correction, deletion, withdrawal of consent, or grievance redressal. You can permanently delete your account from Dashboard → Account & Settings; the public account deletion page explains the steps and retention exceptions. Use support for other requests. We may verify your identity and will respond within applicable legal timelines.
7. Cookies and analytics consent
We use essential storage for authentication, security, and saved preferences. Optional analytics do not load until you consent, a browser Do Not Track signal disables product analytics, and declining does not remove core functionality. You can change your choice here:
8. Security and international processing
We use access controls, row-level permissions, transport encryption, rate limits, and monitoring intended to protect personal data. No online service can guarantee absolute security. Our service providers may process data in countries other than your own under their applicable safeguards.
9. Age and policy updates
Rounds is intended for people aged 18 or above, or the age at which medical training may lawfully be undertaken in their jurisdiction. We may update this policy; material changes will be communicated and may require acceptance before continued use.