Privacy Policy

[REGISTERED LEGAL NAME] (“ngnsimulation”, “we”, “us”) is an organization based in Alberta, Canada. This Privacy Policy applies to our marketing website and to the products we operate (including NCLEX IT, Lumina AI, CareAide, SimMedAi, and the MyLMS AI engine), together the “Services.”

Our role: controller vs. processor

When you deal with us directly (you visit our site, contact us, or buy a personal subscription as an individual learner), we are the controller of your personal information and this policy governs.

When you access a product through an institution (your college, employer, or another organization licenses or white-labels our product), that institution is the controller. We act as their service provider / processor, handling learner information on their instructions under a Data Processing Addendum. In that case, the institution's privacy notice governs your data, and you should direct requests to them; we will support them in responding.

We collect only what we need for the purposes described in this policy:

Information you provide

• Contact & inquiry data — name, email, organization, and message content when you contact us, book a demo, or subscribe to updates.
• Account data — credentials and profile details when you create an account.
• Learning & performance data — your answers, scores, progress, study activity, and similar data generated as you use the products.
• Payment data — for paid plans, billing details processed by our payment processor (we do not store full card numbers).
• AI assistant inputs — messages you send to our assistant (“Sage”), used to generate responses.

Information collected automatically

• Technical data — IP address, device, browser, and similar log data.
• Usage & analytics data — pages viewed and interactions, via privacy-first analytics. See our Cookie Policy.

We do not seek to collect sensitive personal information beyond what is necessary to provide the Services, and we do not knowingly collect information from children (see Section 11).

• Provide, operate, personalize, and improve the Services.
• Respond to inquiries and provide support.
• Process payments and manage subscriptions.
• Provide learning analytics to an institution where it is the controller.
• Send service messages and, with consent where required, marketing communications (see Section 4).
• Maintain security, prevent fraud and abuse, and meet legal obligations.

We do not use learner content to train third-party foundation models, and we do not make decisions producing legal or similarly significant effects about you solely by automated means (see Section 10).

Under PIPA and PIPEDA we collect, use, or disclose personal information with your consent (express or implied, depending on sensitivity and context) and only for purposes a reasonable person would consider appropriate. You may withdraw consent at any time, subject to legal or contractual limits, by contacting us (Section 14).

Where the GDPR applies, our legal bases are: performance of a contract, your consent, our legitimate interests (e.g., securing and improving the Services), and compliance with legal obligations.

Marketing & CASL

Commercial electronic messages are sent in accordance with Canada's Anti-Spam Legislation (CASL): we rely on your express or implied consent, identify ourselves, and include an unsubscribe mechanism in every message. You can opt out at any time.

Our website uses privacy-first, cookieless analytics that load only after you consent, plus strictly necessary cookies needed for the site to function. You can change your choice at any time. For details and categories, see our Cookie Policy.

We share personal information only as described here:

• Service providers (sub-processors) — vendors who host, secure, and support the Services, under contract and only as needed. See our sub-processors list.
• Institutions — where you access a product through an institution, with that institution as controller.
• Legal & safety — where required by law, or to protect rights, safety, and the integrity of the Services.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this policy.

We do not sell your personal information, and we do not “share” it for cross-context behavioural advertising as those terms are defined under California law.

Some of our service providers store or process personal information outside Canada, including in the United States and the European Union. While information is outside Canada, it is subject to the laws of those jurisdictions, including lawful access by courts and government authorities.

This notice is provided under PIPA. You can obtain information about our policies and practices regarding service providers outside Canada — including the countries involved and who to contact with questions — by emailing privacy@ngnsimulation.com. The current list of providers and their locations is in our sub-processors list.

Where we transfer personal information of EEA/UK residents outside those regions, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum), or another lawful transfer mechanism. We offer Canadian-region data residency where available; contact us for details.

We keep personal information only as long as necessary for the purposes it was collected, to provide the Services, and to meet legal, accounting, or reporting obligations, after which it is deleted or anonymized. Indicative periods:

Where an institution is the controller, retention follows its instructions and the DPA.

We use technical and organizational safeguards appropriate to the sensitivity of the information, including encryption in transit, least-privilege access, vendor review, and a defined incident-response process. No method of transmission or storage is perfectly secure.

If a breach involving a real risk of significant harm occurs, we will notify the Alberta Information and Privacy Commissioner and affected individuals without unreasonable delay, as required by PIPA and PIPEDA, and will support institutional controllers in meeting their own notification obligations.

Subject to legal limits, all individuals may ask us to: access the personal information we hold about you; correct inaccurate or incomplete information; delete information where we are able; and withdraw consent to communications or optional processing. To exercise a right, email privacy@ngnsimulation.com or use the data-rights request form on our compliance page. We verify identity before acting and respond within the timeframes required by law.

Additional rights by region

You may also complain to the Office of the Information and Privacy Commissioner of Alberta or the Office of the Privacy Commissioner of Canada.

The Services are intended for adult learners and institutions. We do not knowingly collect personal information directly from children. Where an institution enrolls minors, it is responsible for obtaining any required parental/guardian consent, and we process that information solely on the institution's instructions.

Our assistant (“Sage”) and adaptive learning features use AI to generate responses and personalize study. These features assist learning; they do not make decisions that produce legal or similarly significant effects about you without human involvement. Messages you send to AI features are processed by our model provider(s) listed in our sub-processors list. Do not enter real patient information or unnecessary personal details into AI features.

Where we provide a product to an institution — including on a white-label/reseller basis — the institution is the controller of its users' personal information and we act as its processor (or sub-processor) under a Data Processing Addendum that sets out security measures, sub-processor terms, breach-notification timelines, and data return/deletion on termination. Institutions can request our DPA and security documentation via the compliance page.

We may update this policy from time to time; material changes will be reflected by the “Last updated” date and, where appropriate, additional notice. Our Privacy Officer is [PRIVACY OFFICER NAME / TITLE].

Contact: privacy@ngnsimulation.com · [REGISTERED LEGAL NAME] (“ngnsimulation”, “we”, “us”), 655 Tamarack Rd NW, Edmonton, Alberta T6T 0N4, Canada.