Pharmacy Simulator - Privacy Statement

Privacy Policy

At Imitated Environments Pty Ltd (Australian Business Number: 71 625 288 575) (defined here as ‘We’ or ‘Our’), We value your comments, suggestions and feedback. Our Privacy Policy sets out how we collect, use and disclose “personal information” and other “non-personal information” we have gathered about you in relation to your use of our application titled ‘Pharmacy Simulator’ and its associated website which can be found here https://www.pharmacysim.com (“Website”) (collectively, The Website and the application are referred to as the “Service”).

This policy will let you know:

What information is collected from you;
How your information is used, and our lawful basis for using it;
With whom your information may be shared, including overseas recipients;
How long we keep it;
How you can access, update, export, or delete your information, and how to complain.

Imitated Environments Pty Ltd is the data controller for the personal information described in this policy. We are bound by the Australian Privacy Act 1988 (Cth) (“Act“) and the Australian Privacy Principles (“APPs”) regarding the manner in which We handle your personal information and how We respond to your requests to access and correct it. Where you are located in the European Economic Area or the United Kingdom, We also handle your personal information in accordance with the General Data Protection Regulation (“GDPR”) and the UK GDPR, and the sections below headed Lawful Basis, Your Rights, Overseas Disclosure and International Transfers and Complaints describe the rights those laws give you.

We will comply with all relevant legislative requirements in the territories in which the app is available, and, in the event of any inconsistency, the legislative requirements will override the provisions of this document.

What is Personal Information and why do we collect it from you?

‘Personal Information’ is information or an opinion that identifies you or others as an individual. We collect and store your content within the app which may hold personal information and use it for the provision and ongoing improvement of the Service, including:

Account information — your email address, username and password (stored only as a cryptographic hash), your language and region, and the educational institution or organisation you belong to where you have been enrolled by one. This is used to create and manage your account, to authenticate you, and to contact you about the Service;
Licence, order and payment information — the licences and subscriptions attached to your account, and the billing details necessary to process an order. Card details are entered with and held by our payment provider, not by us;
Content you enter in the Service — the answers, decisions and free text you submit while completing a simulation, and, if you are a scenario author, the scenario material you write;
Usage and assessment data — the simulations and exams you attempt, your scores and session durations, used to provide results to you and, where you are enrolled through an institution, to the educator responsible for your cohort;
Technical and log data — your IP address, device and browser type, and the dates and times you use the Service. We derive an approximate location from your IP address using a database held on our own servers; your IP address is not sent to the provider of that database for this purpose;
Customer analytics — for internal service purposes, to provide improved services in each jurisdiction we operate within. The third parties who assist with this are listed below.

When you sign up to become a member of our Service or where you nominate to specifically allow our software to collect your personal information, you consent to your personal information being used for the purposes of providing the Service to you. If you contact us directly for any reason, we may also keep a copy of that correspondence.

Lawful Basis for Processing

Where the GDPR or UK GDPR applies to you, we rely on the following lawful bases:

Performance of a contract — to create and operate your account, deliver the simulations and exams you or your institution have paid for, process orders, and provide support;
Legitimate interests — to secure the Service against misuse and fraud, to fix defects, to understand in aggregate how the Service is used so that we can improve it, and to meter the cost of the optional AI features described below. We balance these interests against your rights and expectations;
Consent — for non-essential cookies and analytics, for marketing emails, and for the disclosures to overseas recipients described below. You may withdraw consent at any time, without affecting processing carried out before you withdrew it;
Legal obligation — to retain records, including financial records, where the law requires it.

When you elect to join our mailing list for the purpose of receiving our newsletter we may use that “personal information” to provide you with direct marketing communications about our software, features of our websites and other events and promotions related to our software. You may unsubscribe from our newsletter at any time. All you need to do is unsubscribe from the link in the email, or let us know in writing that you want to be removed.

Sensitive Information

Sensitive information includes information or opinion about such things as an individual’s racial or ethnic origin, political opinions, membership of a political association, religious or philosophical beliefs, membership of a professional body, criminal records or health information.

We will not attempt to obtain nor record any sensitive information. The clinical scenarios in the Service concern fictional patients; they are training material and are not records about you or about any real person.

Artificial Intelligence Features

Parts of the Service use third-party artificial intelligence providers. We want to be explicit about what is sent, by whom, and to whom, because these providers are located overseas.

Authoring assistance — scenario authors may ask for help drafting scenario dialogue and answer options. When an author uses this feature, the text of their request, together with the scenario material it relates to, is sent to OpenAI or to Anthropic. The author chooses which provider and model handles each request. This feature is available only to licensed scenario authors; it is not part of completing a simulation, and the answers and results of people taking a simulation are not sent to these providers.
Translation — where a scenario is displayed in a language other than the one it was written in, the scenario text is sent to Google Cloud Translation to be translated.
Spoken dialogue — where a scenario is played with audio, the dialogue text is sent to Google Cloud Text-to-Speech to be synthesised into speech.

In each case what is sent is the scenario or dialogue text and the technical parameters of the request. We do not send your name, email address or account credentials to these providers. Each of these providers processes the request on our behalf under their business or API terms, which provide that the content submitted through those interfaces is not used to train their models. We keep a record of each request for billing, quota and troubleshooting purposes; the text of authoring requests and their responses is erased from that record after 90 days, and the log entry that remains records only the account, the size of the request and the cost.

Their privacy policies are:

OpenAI: https://openai.com/policies/privacy-policy

Anthropic: https://www.anthropic.com/legal/privacy

Google Cloud: https://cloud.google.com/terms/cloud-privacy-notice

Disclosure of Personal Information

We will not sell, trade, rent or disclose any of the personal information you provide to us for any reason, without your prior consent. Otherwise, your Personal Information will only be disclosed where required for the delivery of the Service or allowable by law.

Where you have been enrolled in the Service by an educational institution or employer, we disclose your results and progress in the simulations and exams they have set to the educators and administrators responsible for your cohort at that organisation. That organisation handles those results under its own privacy policy.

We will engage from time to time third party contractors to provide maintenance and development of the software application. We will instruct all third-party contractors to comply with our privacy policy and also in accordance with other relevant security and privacy/confidentiality measures.

Overseas Disclosure and International Transfers

Our Service is stored, gathered and managed through third party providers that conduct their business overseas in third party cloud servers. This is to allow the Service to effectively operate. As a user, or member of the Service, you will be asked to consent that the personal information you provide will be disclosed to an overseas third-party storage facility. This is an overseas disclosure for the purposes of APP 8. Details on their privacy policies can be found below.

Where personal information of individuals in the European Economic Area or the United Kingdom is transferred to a country that has not been the subject of an adequacy decision, that transfer is made under the European Commission’s Standard Contractual Clauses, or the UK International Data Transfer Addendum, incorporated into our agreement with the recipient, together with the technical measures described under Security of Personal Information below. You may request further information about these safeguards using the contact details at the end of this policy.

Our third-party partners, as at the date below, are as follows. Please note their privacy policies are as follows:

Amazon Web Services: The Service is hosted on Amazon Web Services (Amazon EC2), and our database backups are stored in Amazon S3. Amazon Web Services is a cloud hosting platform headquartered in the United States of America. Their privacy policy can be found here: https://aws.amazon.com/privacy/

Stripe: We use Stripe for payment, analytics, and other business services. Stripe collects identifying information about the devices that connect to its services. Stripe uses this information to operate and improve the services it provides to us, including for fraud detection. You can learn more about Stripe and read its privacy policy at: https://stripe.com/privacy

BunnyCDN: This is a worldwide content delivery network that allows us to serve content within our Service as effectively as possible. Their privacy and data policy can be found here: https://bunny.net/privacy

Fastmail: We use Fastmail to send the email the Service generates — account activation, password resets, notifications and newsletters — and to process delivery failures so that we stop emailing addresses that no longer work. Fastmail is located in Australia and the United States of America. Their privacy policy can be found here: https://www.fastmail.com/about/privacy/

OpenAI: We use OpenAI to provide the authoring assistance described above. OpenAI is located in the United States of America. Their privacy policy can be found here: https://openai.com/policies/privacy-policy

Anthropic: We use Anthropic to provide the authoring assistance described above. Anthropic is located in the United States of America. Their privacy policy can be found here: https://www.anthropic.com/legal/privacy

Google Cloud Platform: We use Google Cloud Platform to translate scenarios and to create audio dialog from scenario data, as described above. For more information see Google’s privacy policy: https://policies.google.com/privacy

Google Analytics: Our Website uses Google Analytics to help analyse how users use the site, as described under Cookies and Analytics below. The Google Analytics privacy policy can be found here: https://policies.google.com/privacy

Google Play: We use Google Play to distribute our products on Android devices, and to verify that a purchase made through Google Play is genuine before we issue a licence. For more information on Google Play privacy, see: https://play.google.com/intl/ALL_us/about/play-terms/index.html

Apple: We use the Apple App Store to distribute our products on iOS devices, and to verify that a purchase made through Apple is genuine before we issue a licence. For more information on Apple privacy, see: https://www.apple.com/au/legal/privacy/en-ww/

Security of Personal Information

Your Personal Information is stored offsite in a manner that reasonably protects it from misuse, loss, unauthorized access, modification or disclosure. Traffic between you and the Service is encrypted in transit, passwords are stored only as cryptographic hashes, and access to the systems holding personal information is restricted to those who need it to operate the Service.

If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme. Where the GDPR applies, we will notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach where that regulation requires it, and will notify you where the breach is likely to result in a high risk to your rights and freedoms.

We don’t guarantee website links or policy of authorised third parties and you access those sites at your own risk.

How Long We Keep Your Information

We keep personal information only for as long as it is needed for the purpose it was collected for, or for as long as an Australian law requires us to retain it. In particular:

Account and licence records are kept for as long as your account is open, and afterwards only where required for financial or legal record-keeping;
The text of authoring requests sent to an AI provider, and the responses, are erased after 90 days;
Synthesised audio is deleted when it has been unused for 180 days;
Detailed activity logs from simulation sessions are removed after 12 months; your results are retained so that your record of completion remains available to you and, where applicable, your institution;
Records of email we have sent you are removed on a rolling basis once they are no longer needed to manage delivery.

We will remove or permanently de-identify personal information when it is no longer required for use or disclosure, and where We are not required to retain the information in accordance with an Australian law.

Your Rights

Under the Act, you have the right to access the Personal Information We hold about you and to update and/or correct it, subject to certain exceptions. If you wish to access your Personal Information, please make your request to us in writing using the contact details below. We will not charge any fee for your access request, but may charge an administrative fee. Please be aware that in order to protect the Personal Information in our database, we will require identification from you before releasing any information. We will respond within 30 days.

Where the GDPR or UK GDPR applies to you, you also have the right to:

obtain a copy of the personal information we hold about you, and to receive it in a portable, machine-readable format or have it transmitted to another controller;
have inaccurate personal information corrected, and incomplete information completed;
have your personal information erased, where it is no longer necessary for the purpose it was collected for, where you withdraw the consent it relied on, or where you successfully object to it;
restrict how we process your personal information while a dispute about its accuracy or our grounds for using it is resolved;
object to processing we carry out on the basis of legitimate interests, and to object at any time to the use of your personal information for direct marketing;
withdraw any consent you have given, at any time.

To exercise any of these rights, contact us using the details below. We will respond within one month, and will tell you if we need to extend that period or if an exception prevents us from acting on your request. We do not make decisions producing legal or similarly significant effects about you by automated means alone.

The Service is intended for use by adult learners and by students enrolled through an educational institution. It is not directed at children under the age of 16, and we do not knowingly collect their personal information. If you believe a child has provided us with personal information, please contact us and we will delete it.

Non-Personal Information

Some non-personal information may be gathered while you use Our Service. Non-personal information is general, non-identifiable and anonymous information that is gathered for statistical, analytical, service improvement and research purposes such as the improvement of our software (for example, bug fixes).

Cookies and Analytics

Cookies are small pieces of text data that websites can save on your computer. These cookies allow the website to "remember" small details about your visits, until such a time as the cookie expires or is removed manually by you.

We use cookies for the following reasons:

Make our Website work as you expect - i.e. it remembers you when you login, and it remembers that you have clicked the "I understand" button on the cookie settings page.
Save you having to login every time you visit the site.
Remember your settings during and between visits.
Better understand our users, by tracking when and how they use our website.
If you do not wish to use cookies, you can adjust your browser settings to disable cookies. This will unfortunately break some features of the Website. To opt out from the use of cookies, you can change your settings at: https://www.pharmacysim.com/cookie_settings

Our Website uses Google Analytics to help analyse how users use the site. The tool uses cookies to collect internet log information and general visitor behaviour information. The information generated by the cookie about your use of the Website, including your IP address, is transmitted to Google. Where you are signed in to the Service, we also pass your account identifier to Google Analytics so that visits from the same account can be recognised as one person rather than several. This information is used to evaluate use of our Website and to compile statistical reports on website activity. Analytics cookies are non-essential, and you can decline them at the cookie settings page linked above.

Our Website and apps may also contain APIs from other third parties. We do not control how they interact with you and you should ensure that you consent to the terms of use and privacy policies offered by the third-party services before providing them with your information.

Opting Out of targeted, or ‘interest based’ advertising

You can opt-out of interest-based advertising on mobile applications by checking the privacy settings of your Android or iOS device and selecting "limit ad tracking" (Apple iOS) or "opt-out of interest-based ads" (Android).

Policy Updates

This Policy may change from time to time. The most current version of our Privacy Policy can be found at https://www.pharmacysim.com/privacy. Any such changes or modifications will be effective immediately upon posting. If we make any changes to this Policy, we will change the “Last Updated” date below. We will always keep this up to date so that you know what information we will collect from you, how we may use it, and when we may disclose it.

Complaints

You can lodge a complaint with us about any breach of our Privacy Policy using the contact details below, and we will investigate and respond to you.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at https://www.oaic.gov.au/privacy/privacy-complaints. If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with the data protection supervisory authority in the country where you live or work, or where you believe the breach occurred.

Privacy Policy Contact Information

If you have any questions about our Privacy Policy, or wish to exercise any of the rights described above, please contact us at: admin@imitated-environments.com