Privacy Policy

NGN Simulation Labs Ltd. (“ngnsimulation”, “we”, “us”) is an Alberta corporation with its registered office at 11 South Shore Rd, Chestermere, Alberta T1X 2Y4, Canada. This Privacy Policy applies to our marketing website and to the products we operate (including NCLEX IT, Lumina AI, CareAide, SimMedAi, NOTCE AI-Tutor, and the MyLMS AI engine), together the “Services.”

Our role: controller vs. processor

When you deal with us directly (you visit our site, contact us, or buy a personal subscription as an individual learner), we are the controller of your personal information and this policy governs.

When you access a product through an institution (your college, employer, or another organization licenses or white-labels our product), that institution is the controller. We act as their service provider / processor, handling learner information on their instructions under a Data Processing Addendum. In that case, the institution's privacy notice governs your data, and you should direct requests to them; we will support them in responding.

As required by section 5 of Alberta's PIPA, we have designated an individual accountable for our privacy program:

We collect only what we need for the purposes described in this policy:

Information you provide

• Contact & inquiry data — name, email, organization, and message content when you contact us, book a demo, or subscribe to updates.
• Account data — email address (institutional or personal), a salted password hash, role, program/semester, and region.
• Learning & performance data — simulation inputs, typed scenario transcripts, quiz and exam scores, SOAP notes, flashcard records, study activity, and progress metrics.
• Voice data — transient microphone audio captured during voice drills, the resulting text transcript, and acoustic delivery analytics (speech pace, clarity, pause cadence). See Section 14.
• Payment data — for paid plans, billing details processed by our payment processor. We store only the card brand, expiry date, and last four digits; never a full card number.
• AI assistant inputs — messages you send to our assistant (“Sage”) and to other AI-enabled features, used to generate responses.

Information collected automatically

• Technical & log data — IP address, device and browser metadata, operating system, and security logs.
• Usage & analytics data — pages viewed and interactions, via consent-gated analytics. See our Cookie Policy.

We do not seek to collect sensitive personal information beyond what is necessary to provide the Services, and we do not knowingly collect information from children (see Section 12).

• Deliver simulation features and evaluate clinical reasoning.
• Personalize study plans and adaptive learning.
• Populate instructor analytics for institutional cohorts.
• Operate our enterprise AI models (see Section 13).
• Process payments and manage subscriptions.
• Respond to inquiries and provide support.
• Maintain security, detect and prevent fraud and abuse, and meet legal obligations.
• Improve platform performance using de-identified, aggregated analytics.

We display no third-party advertising in the products, we never sell personal information, we do not use learner content to train third-party foundation models, and we do not make decisions producing legal or similarly significant effects about you solely by automated means (see Section 13).

Under PIPA and PIPEDA we collect, use, or disclose personal information with your consent (express or implied, depending on sensitivity and context) and only for purposes a reasonable person would consider appropriate. You may withdraw consent at any time, subject to legal or contractual limits, by contacting us (Section 17).

Where the GDPR applies, our legal bases are: performance of a contract, your consent, our legitimate interests (e.g., securing and improving the Services), and compliance with legal obligations.

Marketing & CASL

Commercial electronic messages are sent in accordance with Canada's Anti-Spam Legislation (CASL): we rely on your express or implied consent, identify ourselves, and include a one-click unsubscribe mechanism in every message, honoured within 10 business days. Operational messages — password resets, security alerts, billing notices — are not marketing and are sent regardless of marketing preferences.

Our website uses privacy-first analytics that load only after you consent, plus strictly necessary cookies needed for the site to function. You can change your choice at any time. For details and categories, see our Cookie Policy.

We share personal information only as described here:

• Service providers (sub-processors) — vendors who host, secure, and support the Services, under contract and only as needed. See Section 8 and our sub-processors list.
• Institutions — where you access a product through an institution, with that institution as controller.
• Legal & safety — where required by law, or to protect rights, safety, and the integrity of the Services.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this policy.

We do not sell your personal information, and we do not “share” it for cross-context behavioural advertising as those terms are defined under California law.

Notice is hereby given under section 13.1 of Alberta's PIPA that personal information collected by NGN Simulation Labs Ltd. is transferred to, stored, and processed by third-party service providers located outside Canada, primarily in the United States and the European Union. Our principal providers and their processing locations are:

While information is outside Canada, it is subject to the laws of that jurisdiction, including lawful access by foreign courts and government authorities. You may obtain information about our policies and practices regarding service providers outside Canada — including the countries involved and who to contact with questions — by emailing our Privacy Officer at privacy@ngnsimulation.com. The complete, current list is maintained in our sub-processors list.

Where we transfer personal information of EEA/UK residents outside those regions, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum), or another lawful transfer mechanism. We offer Canadian-region data residency where available; contact us for details.

We keep personal information only as long as necessary for the purposes it was collected, to provide the Services, and to meet legal, accounting, or reporting obligations, after which it is deleted or anonymized. Indicative periods:

Deletion requests

On receipt of a verified account-deletion request, we purge your personal data from production systems within thirty (30) days. Residual copies in encrypted backups are overwritten on a rolling ninety (90) day cycle, after which no copy remains. Minimal transaction records are retained where tax and financial statutes require it.

Where an institution is the controller, retention follows its instructions and the DPA.

We use technical and organizational safeguards appropriate to the sensitivity of the information, including encryption in transit, least-privilege access, tenant isolation, vendor review, and a defined incident-response process. No method of transmission or storage is perfectly secure.

If a breach involving a real risk of significant harm occurs, we will notify the Alberta Information and Privacy Commissioner and affected individuals without unreasonable delay, as required by PIPA s. 19.1 and PIPEDA, and will support institutional controllers in meeting their own notification obligations.

Subject to legal limits, all individuals may ask us to: access the personal information we hold about you; correct inaccurate or incomplete information; delete information where we are able; and withdraw consent to communications or optional processing. To exercise a right, email privacy@ngnsimulation.com or use the data-rights request form on our compliance page. We verify identity before acting and respond within 45 days, as prescribed by PIPA.

Additional rights by region

If you are unsatisfied with our response, you may complain to the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca) or the Office of the Privacy Commissioner of Canada.

The Services are intended for learners aged 17 and over and for institutions; they may not be used by anyone under 14. We do not knowingly collect personal information directly from children. Where an institution enrolls minors, it is responsible for obtaining any required parental or guardian consent, and we process that information solely on the institution's instructions.

Our assistant (“Sage”), adaptive learning, and simulation features use AI to generate responses and personalize study. These features assist learning; they do not make decisions that produce legal or similarly significant effects about you without human involvement. Do not enter real patient information or unnecessary personal details into AI features.

No training on your inputs. Inputs to AI-enabled features are processed on enterprise cloud infrastructure (Google Cloud Vertex AI). Under our enterprise terms, AI service providers are contractually restricted from using customer inputs or outputs to train public or foundation AI models. Providers are listed in our sub-processors list.

Voice audio & biometrics

Microphone audio captured during voice OSCE stations, SBAR drills, and speech exercises is processed transiently, in volatile memory, solely to produce a text transcript and analyze acoustic cadence (pace, clarity, pauses). Raw audio recordings are purged immediately on session completion. Transcripts and scorecards are saved to your learning record. We do not generate or store biometric voiceprints, and we do not use audio for biometric identification.

Where we provide a product to an institution — including on a white-label/reseller basis — the institution is the controller of its users' personal information and we act as its processor (or sub-processor) under a Data Processing Addendum that sets out security measures, sub-processor terms, breach-notification timelines, and data return/deletion on termination. Institutions can request our DPA and security documentation via the compliance page.

Where access is provisioned by an Alberta public post-secondary institution or another public body governed by FOIP, NGN Simulation Labs Ltd. acts as a service provider to that body. Student learning records are disclosed to authorized Institutional Personnel — instructors and program directors — solely for academic administration and evaluation.

Our products are simulation and exam-preparation tools built on fictional patient profiles. We do not collect real patient health records, and NGN Simulation Labs Ltd. is not a custodian or information manager under Alberta's *Health Information Act*. Entering identifiable real patient information into the Services is prohibited by our Terms of Service.

We may update this policy from time to time; material changes will be reflected by the “Last updated” date and, where appropriate, additional notice.

Contact: NGN Simulation Labs Ltd., attention Jay Kambo, Privacy Officer, 11 South Shore Rd, Chestermere, Alberta T1X 2Y4, Canada · privacy@ngnsimulation.com.