Security
What we do with your data
We don't keep what you type. Here's exactly what happens.
Today
- Every case is fictional. No real patients, insurers, companies or systems appear in the game.
- We don't store what you type. Game turns go to our AI provider so the characters can reply. We don't keep them.
- Personal details are stripped first. In Mentor mode, names, dates of birth, member IDs, phone numbers, emails and passwords are removed in your browser, and again on our server.
- Your progress stays on your device. Results are kept in your own browser, not on our servers.
- Keys never reach your browser. HTTPS only, strict security headers, requests accepted only from our own site, and rate limits on every endpoint.
Not yet
- Not HIPAA-compliant. Please don't paste real patient records into Mentor mode. A version for clinics with a signed business associate agreement is on our roadmap.
- No SOC 2 report. We're an early-stage company. We'll start the audit with our first enterprise pilot.
Where your words go
| When you… | What's sent | Sent to | Kept by us? |
|---|---|---|---|
| Play the game | What you type, plus the scene | Our AI provider | No |
| Use Mentor mode | Your text, with personal details removed | Our AI provider | No |
| Talk to a human | Name, work email, company, message | The founders | Only to reply |
| Visit the site | Standard request logs (IP, time) | Our hosting provider | Short-term, for security |
Need something for a security review? Talk to a human.