Privacy Policy

1. Information We Collect

ForTheWards ("we," "us," or "our") collects and processes personal information to provide our simulation-based medical education platform. This includes:

• Account information (name, email, institutional affiliation)
• Learning activity data (scenario attempts, transcripts, feedback)
• Temporary oral-presentation audio uploads used for transcription and deleted after transcription succeeds
• Voice audio from calls and spoken review comments, which our speech and AI providers process to produce transcripts and replies; we do not store this audio
• Technical data (IP address, browser type, device information)
• Communication records (support tickets, feedback submissions)

2. How We Use Your Information

We use collected information for:

• Providing and improving our educational services
• Generating personalized AI feedback on your performance
• Allowing learners to review their feedback and performance history
• Enabling specifically authorized institutional faculty to review learning progress
• Supporting IRB-approved research when any required participant consent has been obtained
• Complying with legal and regulatory requirements

3. FERPA and Educational Records

ForTheWards is designed for institutional learning workflows that may be governed by FERPA. We treat retained learner transcripts, feedback, and attempt records as educational records that require controlled access.

• Raw oral-presentation recordings are deleted after transcription succeeds
• Retained transcripts and feedback remain available to the learner and for authorized educational review
• Role-based access controls limit who can access retained learner records
• Privileged transcript and feedback review workflows are audited

4. Fictional Scenarios Only

ForTheWards is designed for educational simulations only. All scenarios and patients are fictional, and the platform is not designed to collect, store, or process actual patient health information (PHI). Please do not enter information about real patients.

5. Data Sharing and Third Parties

We share your data only as necessary to provide our services:

• Your Institution: Specifically authorized faculty with a legitimate educational role can view your learning progress
• Approved Research Personnel: Interaction data may be accessed for IRB-approved research when any required participant consent has been obtained
• Platform Administration: Authorized ForTheWards platform administrators may access the minimum information reasonably necessary for security, troubleshooting, maintenance, or responding to support requests; this access is not performed routinely
• Service Providers: The companies listed below, which process data on our behalf to run the platform
• Legal Requirements: When required by law or to protect rights and safety

Our service providers are:

• Supabase: database, sign-in, and file storage
• Vercel: website hosting and performance measurement
• Google (Gemini): AI patient conversations and voices, performance feedback, and scenario tools
• Deepgram: speech recognition for calls, oral presentations, and spoken review comments
• Anthropic (Claude): drafting new scenarios for course authors
• Brevo: assignment and reminder emails
• Upstash: rate limiting and email scheduling
• Sentry: error monitoring
• GitHub and Backblaze: database backups
• Zoho: email for support and privacy requests

Our AI providers (Google, Deepgram, and Anthropic) do not use your content to train their models under the terms we use with them.

We do not sell interaction data, use it for advertising, or disclose it to unauthorized third parties.

For detailed vendor information, please contact slaton@forthewards.com.

6. Retention and Research Use

Learning activity data is retained to provide learners with access to their feedback, support authorized institutional review, and, where applicable, conduct IRB-approved research. Research use is subject to the approved study protocol and any required participant consent. Accepting this Privacy Policy or our Terms of Service does not constitute consent to participate in research.

Research records are retained for the period required by the applicable IRB, institution, law, or study protocol. Direct identifiers are removed or replaced with study codes when practicable and when they are no longer needed for the approved purpose. Deletion requests remain subject to applicable educational and research record-retention requirements.

7. Your Rights

You have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion of your data (subject to institutional requirements)
• Opt out of non-essential communications
• File a complaint with a supervisory authority

To exercise these rights, contact us at slaton@forthewards.com.

8. Data Security

We protect your information with:

• Encryption in transit (TLS) for all connections
• Encryption at rest (AES-256) for our database and file storage
• Role-based access controls and database row-level security
• Audit logging of privileged access to learner records
• Passwordless sign-in through one-time email links

No system is completely secure. Because sign-in links are sent to your email, keep your email account secure, and report any security concerns to us immediately.

9. Children's Privacy

Our platform is designed for medical professionals and students in professional training programs. We do not knowingly collect information from individuals under 18 years of age.

10. Policy Changes and Do Not Track

We will post any changes to this Privacy Policy on this page and update the "Last Updated" date at the top.

We do not respond to browser "Do Not Track" signals.

11. Contact Us

For questions about this Privacy Policy or our data practices, please contact: