1. Information We Collect
Account Information: Name, email, company, title, billing information, credit card details.
Usage Data: Log data (IP address, browser type, pages visited), platform usage, performance and error data.
Survey Data: Our platform generates synthetic data only. We do not collect personal respondent data or PHI.
Client-Uploaded Data: For features such as Augmented Data, Expanded Data, and digital twin builds, clients may upload their own seed data. Clients are responsible for ensuring uploaded data is properly de-identified or that they have appropriate authority to share any personal information it contains. Simsurveys treats uploaded data as Confidential — encrypted in transit and at rest, access-restricted to authorized personnel, and deleted on written request.
2. How We Use Information
- Provide and manage your account.
- Process payments.
- Communicate with you (updates, support, notices).
- Improve and secure the Services.
- Comply with legal obligations.
3. Sharing Information
We do not sell personal information. We may share with:
- Service providers (hosting, payments, analytics).
- Legal authorities if required.
- Successors in business transfers.
4. Data Security
- Encryption in transit and at rest.
- Role-based access controls.
- Regular monitoring and audits.
- Secure infrastructure.
See our Security & Compliance Policy for more details.
5. Data Retention
We retain personal data only for as long as necessary for the purposes described in this policy. Typical periods are:
- Account data: for the life of your account and up to 24 months after closure.
- Billing and transaction records: up to 7 years, to meet tax and legal obligations.
- Marketing data: until you withdraw consent or opt out.
- Usage and security logs: up to 90 days.
- Backups: a rolling 30-day window, after which data ages out.
Client-uploaded data and client project data are retained until the client requests deletion, or as otherwise agreed with the client. Where we act as a processor, the client controls the applicable retention period.
Upon request, we will securely delete data from active systems and backups within defined timelines.
6. Your Rights
Depending on your jurisdiction, you may request:
- Access, correction, or deletion of personal information.
- Data portability.
- Restriction or objection to processing.
Requests: jlf@simsurveys.com
7. Cookies
We use cookies for preferences, analytics, and improving user experience. You may disable cookies, but some features may not work properly.
8. International Transfers
Data may be transferred outside your country of residence. We use appropriate safeguards for such transfers.
9. Children's Privacy
Services are not directed to children under 13. We do not knowingly collect children's personal data.
10. UK and EEA Users (UK GDPR / EU GDPR)
This section applies only where the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), or related data-protection law governs our processing of your personal data. Where it applies and conflicts with other parts of this policy, this section controls.
10.1 Data Controller
For personal data we process about our account holders and marketing contacts, the controller is:
- Simsurveys, LLC
- 4894 N Paulina St, Chicago, IL 60640, USA
- Privacy contact: jlf@simsurveys.com
10.2 The Data We Handle and Our Role
Our role under data-protection law depends on the type of data:
- Client-user data (names, work emails, account and billing details of the people who use our platform) — we act as controller.
- Client-uploaded data (seed data, source datasets, and inputs used to build digital twins) — the client determines the purposes and means, so the client is the controller and we act as a processor on the client's behalf.
- Source data used to build our models — our population models are built from data such as real US healthcare-professional survey responses. This underlying source data is not UK or EEA personal data.
- Model and digital-twin outputs — our models output synthetic data. Digital twins may be fully synthetic, based on real individuals from client-provided data, or a mix, depending on the use case. Where a digital twin is derived from a real, identifiable person, that data is provided by the client under our processor relationship, and the client remains the controller and is responsible for having a lawful basis and any necessary consents.
Simsurveys does not use client-uploaded UK or EEA personal data to improve its general models unless separately agreed in writing and supported by an applicable lawful basis. We may use information that has been effectively anonymised.
10.3 Purposes and Lawful Bases
Where we act as controller, we rely on the following lawful bases:
| Purpose | Lawful basis |
|---|---|
| Account creation and management | Performance of a contract |
| Billing and payments | Performance of a contract; legal obligation (tax/accounting) |
| Customer support | Performance of a contract; legitimate interests |
| Security, fraud prevention and logging | Legitimate interests; legal obligation |
| Product analytics and improvement | Legitimate interests; consent (where required for cookies) |
| Marketing communications | Consent; legitimate interests (existing customers) |
Where we rely on legitimate interests, we balance those interests against your rights. Where we rely on consent, you may withdraw it at any time.
10.4 Service Providers and Subprocessors
We use a limited set of vetted providers to deliver the Services. These currently include:
- Amazon Web Services (AWS) — cloud hosting and storage.
- Stripe — payment processing.
- Anthropic — AI model processing.
- Google Analytics — website analytics.
- Microsoft Clarity — website analytics.
- LinkedIn — marketing analytics.
- Email delivery providers used to send account and service communications.
10.5 International Transfers
We are based in the United States and process data there. Where required, Simsurveys will implement an appropriate transfer mechanism — such as the EU Standard Contractual Clauses with the UK Addendum, or the UK IDTA — before receiving covered personal data from a client. We are not certified under the EU-US or UK Data Privacy Framework.
10.6 Your Rights
Subject to conditions in the law, you have the right to: access your personal data; correct inaccurate data; request deletion; restrict processing; data portability; object to processing (including direct marketing); and withdraw consent at any time without affecting prior processing.
To exercise any of these rights, contact jlf@simsurveys.com. Where we process your data on behalf of a client (as a processor), we will refer your request to that client and assist them in responding.
10.7 Complaints
If you are in the UK, you may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. If you are in the EEA, you may complain to your local supervisory authority. We would appreciate the chance to address your concerns first.
10.8 Cookies and Marketing Consent
For users in the UK and EEA, we set non-essential cookies and similar technologies (including analytics and marketing tags) only with your consent, which you can give or withdraw through our cookie banner and settings. Marketing emails are sent in line with UK/EU consent rules, and every message includes an unsubscribe option.
10.9 Automated Decision-Making
We do not make decisions producing legal or similarly significant effects concerning you based solely on automated processing.
11. Changes
We may update this policy from time to time. When we make material changes, we will post the revised version here with an updated "Last Updated" date and, where appropriate, notify account holders by email or through the platform before the changes take effect.
12. Contact
- Email: jlf@simsurveys.com
- Website: simsurveys.com/contact