Privacy Policy

Last updated: August 10, 2026

Who We Are.

OneSim Inc. (“OneSim”, “we”, and “us”) respects your privacy and are committed to protecting it through our compliance with this Privacy Policy (this “Privacy Policy”). This Privacy Policy describes how we collect, process, retain, and disclose Personal Data (defined below) about you when providing services to you through our websites (including, without limitation, www.MyOneSim.com), applications, products, software, and services (including, without limitation, voice-based clinical encounter, clinical skills EMR simulation, and inventory management software services) that link to this Privacy Policy (collectively, the “Services”) and our practices for using, maintaining, protecting, and disclosing that information. Capitalized but undefined terms have the meanings set forth in our End User Terms available at: https://www.myonesim.com/terms (the “End User Terms”).

This Privacy Policy applies only to information we collect:

Through the Services;
In communications, including email, text, chat, and other electronic messages, between you and the Services (including, without limitation, when you send us an email through the Contact Us option on our website, www.MyOneSim.com); and
When you interact with our advertising and applications (including mobile apps) on third-party websites and services, if those applications or advertising include links to this Privacy Policy.

It does not apply to information collected by:

Us offline or through any other means, including on any other website operated by Company or any third party (including our affiliates and subsidiaries) that does not link to this Privacy Policy; or
Any third party (including our licensors, affiliates, and subsidiaries), including through any application or content (including advertising) that may link to or be accessible from or through the Services.

We may provide additional or different privacy policies that are specific to certain features, services, or activities.

Please read this Privacy Policy carefully to understand our policies and practices regarding your information and how we treat it. By interacting with our Services or providing us with your information, you agree to the collection, use, and sharing of your information as described in this Privacy Policy. This Privacy Policy may change from time to time (see the section below titled “Changes to Our Privacy Policy”). Your continued use of the Services after we make changes as described here is deemed to be acceptance of those changes, so please check this Privacy Policy periodically for updates.

Information We Collect.

“Personal Data” is information that identifies, relates to, or describes, directly or indirectly, you as an individual, such as your name, email address, telephone number, home address, payment information (for example, account information such as name, postal address, and email address), and any other identifier we may use to contact you online or offline.

The types and categories of Personal Data we collect or process that you directly provide include:

Account data: name, email address, and password;
EMR exercise data: charting entries, orders, scores, and completion records from clinical skills EMR sessions;
Inventory records: asset, consumable, and space data you enter into the inventory manager application of the Services;
Device information: Such as your IP address, device identifiers, operating system and version, preferred language, hardware identifiers, browser type and settings, and other device information;
Your User Content and information: data, materials and information that elect to provide as part of your Account or use with the Services or emails, chats, or other communications sent to us;
Billing information: your Organization's payment information for access to and use of the Services; and
Institution data: we store seat assignments, member roles, and access configurations set by your Organization.

We collect limited technical data automatically:

Usage analytics: page views, referrer, device type, browser, and approximate region; and
Session data: authentication session tokens stored in secure httpOnly cookies.

We also collect:

Technical information: Technical information includes information about your internet connection and usage details about your interactions with the Services, such as clickstream information to, through, and from our Services (including date and time), features, materials, pages, and products that you view or search for, page response times, download errors, length of your visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), or methods used to browse away from a page.

If we combine or connect non-personal statistical or technical data with Personal Data so that it directly or indirectly identifies an individual, we treat the combined information as Personal Data.

How We Collect Your Personal Data and Other Information About You.

From Your Submissions. When you directly provide Personal Data, other information, or any User Content directly, including email, text, chat, and other electronic messages, to the Services or us.

Automatically Through Our Services. As you navigate through and interact with our Services, we may use automatic data collection technologies to collect information that may include Personal Data. Information collected automatically may include usage details, IP addresses, operating system, and browser type, and information collected through cookies, web beacons, and other tracking technologies including details of your interactions with our Services, such as traffic data, general location data, logs, and other communication data, and which resources and Services features that you access and use (collectively, “Usage Data”).Using automatic collection technologies helps us to improve our Services and to deliver a better and more personalized experience.The technologies we use for this automatic data collection may include:

Cookies: A cookie is a small file placed on your device when you interact with the Services. We use a cookie to keep you logged in to your Account. This cookie is required for the Service to function and cannot be disabled. We do not use advertising cookies, third-party tracking cookies, or cross-site analytics cookies.
Web Beacons: Some parts of the Services and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Company, for example, to count users who have visited those parts or opened an email and for other related statistics (for example, recording the popularity of certain content and verifying system and server integrity).

No Usage Data is sold or shared with advertisers. We do not use Google Analytics, Meta Pixel, or any other third-party advertising trackers.To the extent any of these automated technologies are considered a Personal Data sale, targeted advertising, or profiling, under applicable laws, depending on where you live, you may opt out from use of these automated technologies for such uses by emailing us at: info@myonesim.com. Please note that some Services features may be unavailable as a result.When you interact with the Services, there are third parties that may use automatic collection technologies to collect information about your or your device. These third parties may include:

Advertisers, ad networks, and ad servers;
Analytics companies;
Your device manufacturer;
Your internet or mobile service provider;

These third parties may use tracking technologies to collect information about you when you use the Services. The information they collect may be associated with your Personal Data or they may collect information, including Personal Data, about your online activities over time and across different websites, apps, platforms, and other online services. They may use this information to provide you with interest-based (behavioral) advertising or other targeted content.We do not control these third parties' tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly.

From Your Organization. We also receive Personal Data about you from your Organization and combine that with information we collect directly from you in order to make the Services available to you.

How We Use Your Information.

We use your Personal Data and other information we collect about you to:

Provide, operate, and improve the Services;
Authenticate your Account and maintain your session on the Services;
Calculate, invoice, and bill your Organization;
Send transactional emails (such as account invites, receipts, and password resets) and other notices abouts the Services;
Enable your Organization's administrators to manage seat access and shared case libraries and other content;
Understand aggregate usage patterns and improve the Services;
Respond to support requests from you and/or your Organization;
Carry out our obligations and enforce our rights arising from any contracts entered into between you and us (including the End User Terms) and/or between your Organization and us;
In any other way we may describe when you provide the information; and
For any other purpose with your consent.

We do not sell your Personal Data to third parties. We do not use your Personal Data for advertising.

Statistical or aggregated data does not directly identify a specific person, but we may derive non-personal statistical or aggregated data from Personal Data. For example, we may aggregate Personal Data to calculate the percentage of users accessing a specific Services feature.

We use Usage Data we collect, whether connected to your Personal Data or not, helps us improve our Services and deliver a better and more personalized experience. For example, we may use such Usage Data to:

Estimate our audience sizes and usage patterns;
Store information about your preferences, allowing us to customize the Services according to your individual needs and interests;
Speed up your searches; and
Recognize you when you return to our Services.

Who We Disclose Your Information To.

We may disclose aggregated information about our users, and information that does not identify any individual, without restriction.

We may also disclose Personal Data that we collect or you provide as described in this Privacy Policy:

To provide the Services to your Organization. Your Organization administrator may have visibility into your Account status, seat assignment, and product access. Simulation transcripts, EMR exercise scores, inventory records, and other information regarding your use of the Services may be accessible to facilitators and administrators within Organization. Please contact your Organization's administrator for details about their data policies.
To our subsidiaries and affiliates.
To contractors, service providers, licensors, and other third parties we use to support our organization and who are bound by contractual obligations to keep Personal Data confidential and use it only for the purposes for which we disclose it to them.
To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Data held by us is among the assets transferred.
To fulfill the purpose for which you provide it.
For any other purpose disclosed by us when you provide the information.
With your consent.

We may also disclose your Personal Data:

To comply with any court order, law, or legal process, including to respond to any government or regulatory request.
To enforce or apply our End User Terms and/or the agreement(s) between your Organization and us.
If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of our organization, our customers, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction.

The categories of Personal Data we may disclose include:

Account and contact information;
Payment information;
Account history;
Location information, including general geographic location;
Device information;
Your User Content and information you elect to provide to us;
Images, voice recordings, and videos collected or stored in connection with the Services; and
Identity document information.

AI Processing.

Transcriptions in our AI Patient Simulator feature of the Services are sent to Anthropic's Claude API to generate AI responses. Anthropic processes this data subject to their own privacy policy available at: https://www.anthropic.com/legal/privacy.

Data Storage and Security.

We use commercially reasonable administrative, physical, and technical measures designed to protect your Personal Data from accidental loss or destruction and from unauthorized access, use, alteration, and disclosure including using row-level security policies to ensure users can only access their own data and encrypting data in transit (TLS 1.2+) and at rest (AES-256). However, no website, mobile application, system, electronic storage, or online service is completely secure, and we cannot guarantee the security of your Personal Data transmitted to, through, using, or in connection with the Services. In particular, email, texts, and chats sent to or from the Services may not be secure, and you should carefully decide what information you send to us via such communications channels. Any transmission of Personal Data is at your own risk.

The safety and security of your information also depends on you. You are responsible for taking steps to protect your Personal Data against unauthorized use, disclosure, and access.

Data Retention.

We retain your Personal Data for as long as your Account is active. If the administrative user of your Organization deactivates your Account, your Personal Data will be retained until your Organization requests us to delete your Account. Unless otherwise required to comply with our legal obligations, resolve disputes, or for other safety or security purposes, we will delete your Account's Personal Data within thirty (30) days of receiving your Organization's request to delete your Account. Usage Data may be retained indefinitely. Institution members whose accounts are deactivated by an admin retain their data until account deletion is requested.

Your State Privacy Rights.

Depending on your state of residency, you may have certain rights related to your Personal Data, including:

Access and Data Portability: You may confirm whether we process your Personal Data and access a copy of the Personal Data we process. To the extent feasible and required by state law, depending on your state, data will be provided in a portable format. Depending on your state, you may have the right to receive additional information and it will be included in the response to your access request.
Correction: You may request that we correct inaccuracies in your Personal Data that we maintain, taking into account the information's nature and processing purpose.
Deletion: You may request that we delete Personal Data about you that we maintain, subject to certain exception under applicable law.
Opt Out of Using Personal Data for Sales, Targeted Advertising, and Profiling for Certain Legal or Similarly Significant Decisions: You may request that we do not use your Personal Data for these purposes.

Important: The exact scope of these rights vary by state. There are also several exceptions where we or your Organization may not have an obligation to fulfill your request.

To exercise any of these rights, please contact your Organization. If you send us any requests to exercise these rights, we will forward your request to your Organization for their consideration.

Some browsers and browser extensions support the Global Privacy Control (“GPC”) that can send a signal to process your request to opt out from certain types of data processing, including data “sales” as defined under certain laws. When we detect such a signal, we will make reasonable efforts to respect your choices indicated by a GPC setting as required by applicable law.

Your Organization's administrators may manage its applicable user accounts through the admin panel of the Services. We will respond to requests in the period of time required by applicable law or within thirty (30) days, whichever is less.

Children's Privacy.

Our Services are not intended for, and we do not knowingly collect any Personal Data from, children under the age of eighteen (18). If we learn we have collected or received Personal Data from a child under eighteen (18) years old without verification of parental consent, we will delete that information. If you believe a minor has provided us information, contact us at info@myonesim.com and we will promptly delete such information unless otherwise required by applicable law.

Changes to This Privacy Policy.

We may update this Privacy Policy from time to time, and we will provide notice of any such changes to this Privacy Policy as required by law. We will use our commercially reasonable efforts to notify you via email or a prominent notice within the Service of any material changes to this Privacy Policy or the practices described herein at least fourteen (14) days before they take effect. The date this Privacy Policy was last updated is identified at the top of the page. We will notify you of changes to this Privacy Policy by updating the “last updated” date and posting the updated Privacy Policy on the Services. We may email or otherwise communicate reminders about this Privacy Policy, but you should check our Services periodically to see the current Privacy Policy and any changes we have made to it. Your continued use of the Services after such changes constitutes your acceptance.

Contact Us.

To exercise your rights or ask questions or comment about this Privacy Policy or our privacy practices, contact us at: info@myonesim.com.