Rounderly Privacy Policy
Effective date: October 9, 2026
Version: 3.0
This Privacy Policy explains what information Rounderly handles when you use the website at rounderly.vercel.app and any successor address (the "Service"), why, who receives it, and what choices you have. "Rounderly", "we", "us" and "our" mean the operator of the Service.
To contact us, sign in, open Your account from your name at the top of any page, and choose Contact us. This policy calls that "the contact form".
Before your first session you are asked to confirm that you have read this policy and agree to it. If you do not agree with it, do not use the Service.
1. The short version
- You sign in with your Google account. Google tells us your name, your email address and an account number. We never see your Google password.
- We do not keep your voice recordings, your transcripts, your notes, your cases or your feedback. Our server handles them only for as long as it takes to answer each request.
- Your voice and your words are sent to outside providers so they can be transcribed, answered and graded. Those providers may keep them for a period under their own policies.
- What we do keep is small: an account record (your name, your email address, how many sessions you have used, what you have bought, and when you accepted our terms), technical records of each request, and any review or message you choose to send.
- Payments are handled by Stripe. You type your card details into Stripe's page. We never see or store your card number.
- We do not sell your information, show ads or use advertising trackers.
- Never speak or type information about a real patient, or sensitive information about yourself.
The rest of this policy gives the detail.
2. Information we handle
2.1 Information you provide
| Information | When | What happens to it |
|---|---|---|
| Google account details: your name, your email address, whether Google has verified that address, and Google's account number for you | When you sign in with Google | Checked by our server with Google. Your name, email address and account number are stored in your account record (Section 2.2). Your first name is shown to you in the Service. We never receive your Google password. |
| Payment details | If you subscribe | Typed into a page run by our payment provider, Stripe, and handled by Stripe. We receive a record of each payment, the amount and the date, and whether your subscription is running, when its current billing period ends, and whether you have cancelled it. We do not receive or store your card number. |
| Access code | Only while the Service is invite-only, when you enter it after signing in | Kept in your browser for the visit so you do not have to retype it, and sent with each request so our server can check it. |
| Case choices (problem area, patient personality, difficulty) and any custom case description you type | When you set up a session | Sent to our server and to our artificial intelligence provider to generate the case. Not stored by us. |
| Voice recordings | Each time you hold a speaking turn, in the encounter or the presentation | Sent to our server, passed to our speech provider for transcription, then discarded by our server. Not stored by us. |
| Transcripts of what you and the simulated patient said, including your corrections | Throughout a session | Held in your browser tab. Sent to our server and to our artificial intelligence provider to produce the patient's next answer, to tidy the transcript and to grade. Not stored by us. |
| Presentation length | At grading | Sent with the transcript. Not stored by us. |
| Notes you type during the encounter | During a session | Stay in your browser tab. They are never sent to our server. |
| Reviews and feedback (any text you write, a star rating if you give one, and which screen you were on) | Only if you choose to send one | Stored by us. Reviews and feedback are not linked to your account. |
| Messages to us (your message, the email address you give for a reply, and which screen you were on) | If you use the contact form | Stored by us, with your account identifier, so we can respond and match a request to your account. |
| Your acceptance of our Terms of Service and this policy | When you tick the box before your first session, and again if they change materially | The version you accepted, and when, are stored in your account record. |
2.2 Information created automatically
| Information | What it is | What happens to it |
|---|---|---|
| Account record | Your name, your email address, Google's account number for you, the number of sessions you have used, including in each billing period, any extra sessions, limit or hold we have placed on the account, your subscription and its payments, any pass or pack you bought before subscriptions, and the version of our terms you accepted and when. | Stored with our payment provider. |
| Sign-in token | A signed token our server gives your browser once you have signed in. It does not contain your email address. | Kept in your browser and sent with each request so our server knows who is asking. It expires after 7 days. |
| Session ticket | A signed token issued when you start a practice session, which shows that the session was started properly. | Held in your browser tab for the length of the session. It expires after 3 hours. |
| Session ID | A new random identifier for each practice session. | Sent with each request. Stored with usage records. |
| Usage records | A record of each request: when it happened, Google's account number for you, the session ID, the type of request and its size. No names, email addresses, words, audio, transcripts, cases or notes are included. | Stored by us. |
| Server and hosting logs | Technical records produced when your browser contacts the Service, such as IP address, date and time, the address requested, browser type and response status. | Held by our hosting provider under its retention settings. |
| Font requests | The Service loads typefaces from Google Fonts. Your browser contacts Google directly to fetch them, which shares your IP address and browser type with Google. | Handled by Google under its privacy policy. |
2.3 Information generated for you
Cases, patient answers, synthetic voice audio, scores, feedback, transcript marks and model presentations are generated for your session. They are sent to your browser and are not stored by us.
2.4 Information we do not collect
We do not collect your school, year of study, precise location, contacts, photos or video. We do not receive your Google password or your card number. We ask Google only for the basic details listed in Section 2.1, and not for access to your email, files, calendar or contacts. We do not use advertising cookies, tracking pixels or third-party analytics tools. We do not build advertising profiles.
2.5 Information you must not give us
Do not speak or type:
- information about any real patient or other identifiable real person;
- protected health information of any kind;
- your own health information, government identifiers, financial details or passwords.
The Service is not designed to protect that kind of information. We are not a covered entity or business associate under the U.S. Health Insurance Portability and Accountability Act, and the Service is not a HIPAA-compliant system. If you believe you have submitted such information by mistake, tell us through the contact form.
3. Your voice
3.1 Your microphone is used only while you hold a speaking turn. You start and end each turn by clicking a button. The Service shows a recording indicator while the microphone is live.
3.2 Each recording is sent over an encrypted connection to our server, which passes it to our speech provider to be converted to text. Our server does not write the recording to storage and does not keep it after the request is answered.
3.3 We do not use your voice to identify you. We do not create or store a voiceprint or other biometric identifier or template from your recordings, and we do not ask our providers to.
3.4 Your microphone can pick up other people nearby. Please use the Service somewhere private.
3.5 You can withdraw microphone permission in your browser settings at any time.
4. How we use information
We use the information described above to:
- sign you in, and recognise you on each request;
- keep count of the sessions you have used, run your subscription, take payment, and send receipts and renewal notices;
- generate cases, patient answers and synthetic speech;
- convert your speech to text;
- tidy transcripts, grade your performance and produce feedback;
- understand how the Service is used;
- read and act on reviews, and improve the Service;
- keep the Service secure, prevent abuse and enforce our Terms of Service;
- contact you about your account, a purchase or a change to the Service, and respond to you when you contact us; and
- comply with the law, including tax and accounting rules.
We do not send marketing email.
We do not use your recordings or transcripts to train artificial intelligence models of our own. We do not make decisions about you that have legal or similarly significant effects. Scores are practice feedback only.
5. Legal bases (European Economic Area, United Kingdom and Switzerland)
Where the General Data Protection Regulation or similar law applies, we rely on:
| Purpose | Legal basis |
|---|---|
| Signing you in, keeping your account record, counting sessions and taking payment | Performance of our contract with you |
| Running a session: generating cases, transcribing, answering and grading | Performance of our contract with you |
| Keeping records of payments | Legal obligation |
| Recording your voice through your microphone | Your consent, given through your browser's permission prompt and your acceptance of our Terms |
| Usage records | Our legitimate interest in understanding and sustaining the Service |
| Messages you send us | Our legitimate interest in answering you, and performance of our contract with you |
| The record of your acceptance of our terms | Our legitimate interest in being able to show what was agreed |
| Security and abuse prevention | Our legitimate interest in protecting the Service and its users |
| Reviews | Your consent, given when you choose to send one |
| Legal compliance | Legal obligation |
You can withdraw consent at any time. Withdrawal does not affect processing that has already happened.
6. Who receives information
We share information only as described here.
6.1 Service providers
| Type of provider | What it receives |
|---|---|
| Sign-in provider (Google) | Google signs you in, so it knows that you used your Google account with Rounderly and when. Our server sends the sign-in back to Google to confirm it is real. |
| Payment provider (Stripe) | Your account record (Section 2.2), and, if you subscribe, the payment details you type into its page. Stripe also emails you receipts and, if a payment fails, a notice. |
| Artificial intelligence model provider | Case choices and custom case text, the generated case, transcripts of the encounter and presentation |
| Speech provider (transcription and synthetic voice) | Your voice recordings and the text needed to transcribe and speak the session |
| Hosting provider | All traffic to the Service passes through it in transit. It keeps technical logs. |
| Cloud storage provider | Reviews, messages you send us, and usage records. Usage records carry your account identifier, and no name or email address. |
| Font service (Google Fonts) | Your IP address and browser type, sent by your browser when it fetches typefaces |
Each provider handles information under its own terms and privacy policy. They may keep information they receive for a limited period for purposes such as safety, abuse prevention and legal compliance. We do not control their retention.
We may change providers from time to time. Where the law gives you the right to know who has received your information, ask us through the contact form.
6.2 Other disclosures
We may also disclose information:
- to comply with the law, including a court order, subpoena or lawful request from a public authority;
- to protect rights and safety, including to investigate abuse, enforce our Terms, or protect us, our users or the public;
- in a business transfer, such as a merger, sale or reorganisation, in which case the recipient must honour this policy; and
- with your direction or consent.
6.3 What we do not do
We do not sell personal information. We do not share personal information for cross-context behavioural advertising. We have not done either in the past twelve months.
7. Storage in your browser
The Service uses your browser's own storage instead of cookies:
| Item | Purpose | How long |
|---|---|---|
| Sign-in token | Keeps you signed in between visits | 7 days, or until you sign out or clear your browser's site data |
| Session ticket | Shows that a session was started properly | Until you close or reload the tab, or 3 hours |
| Access code, only while the Service is invite-only | Saves retyping during a visit | Until the tab closes |
| Session data (case, transcript, notes, feedback) | Runs your session | Until you close or reload the tab |
These are all necessary for the Service to work. We do not use advertising or analytics cookies. Signing out, or clearing your browser's site data for the Service, removes the stored items. It does not delete your account record. To have that deleted, see Section 11.
Google's sign-in button is loaded from Google and may set its own cookies or storage in order to work. Stripe's payment page is a separate website with its own cookies and privacy policy.
The Service does not respond to "Do Not Track" signals, because it does not track you across other sites.
8. How long we keep information
| Information | Retention |
|---|---|
| Voice recordings, transcripts, cases, feedback | Not kept by us. Discarded once each request is answered. |
| Notes | Never received by us. |
| Account record | Kept while you have an account, and deleted when you ask us to close it, except for payment records we must keep. |
| Payment records | Kept for 7 years, or longer where tax and accounting law requires. |
| Usage records | Kept until no longer needed for cost analysis and accounting, or until you ask us to delete them, whichever is sooner. |
| Reviews | Kept until no longer useful, or until you ask us to delete yours, whichever is sooner. |
| Hosting logs | According to our hosting provider's retention settings. |
| Messages to us | As long as needed to deal with your request and keep a record of it. |
| Information held by providers | According to each provider's own policy. |
9. Security
We protect information with measures that include encrypted connections (HTTPS), access controls, and a design that avoids keeping the content of your sessions on our servers.
We do not hold passwords or card numbers. Sign-in is handled by Google and payment by Stripe. The security of your account depends on the security of your Google account, so protect it with a strong password and two-step verification.
No system is perfectly secure, and we cannot guarantee security. The best protection is the one in your hands: do not put sensitive information into the Service.
If we learn of a security incident that affects your personal information, we will give notice as the law requires, by email to the address on your account, by a statement in the Service, or both.
10. International transfers
We are based in the United States, and our providers operate in the United States and other countries. If you use the Service from elsewhere, your information will be transferred to and processed in countries whose data protection laws may differ from yours. Where the law requires, we rely on appropriate safeguards for those transfers, such as standard contractual clauses offered by our providers.
11. Your rights and choices
11.1 Choices available to everyone
- Do not send a review, and none is stored.
- Sign out to remove the sign-in token from your browser.
- Remove Rounderly from your Google account in your Google account's security settings, under third-party connections.
- Ask us to close your account and delete your account record (Section 11.3).
- Withdraw microphone permission in your browser settings.
- Stop using the Service at any time.
11.2 Rights you may have
Depending on where you live, you may have the right to:
- know what personal information we hold about you and receive a copy;
- correct inaccurate information;
- delete information;
- restrict or object to certain processing;
- receive information in a portable form;
- withdraw consent;
- opt out of the sale or sharing of personal information, and of targeted advertising (we do neither);
- limit the use of sensitive personal information;
- not be discriminated against for using your rights; and
- complain to a data protection authority.
11.3 How to use your rights
Use the contact form while signed in, so we can match the request to your account. The records we can tie to you are your account record, your payment records, the usage records under your account number, and any review you can describe to us. Reviews are not linked to accounts, so we can only find one from your description of it.
If you ask us to delete your information, we will close your account and delete your account record and your usage records. We will keep payment records for as long as the law requires. Closing your account ends your subscription and any pass that is still running.
We will respond within the time the law requires, usually 30 to 45 days. We may need to confirm that the request comes from you. You may use an authorised agent where the law allows. If we refuse a request, you may appeal by replying to our decision, and we will tell you how to take the matter further.
For information held by our providers, you may ask us who they are, where the law gives you that right, and contact them directly.
11.4 California
If you are a California resident, the categories of personal information we have collected in the past twelve months are: identifiers (name, email address, Google's account number for you, session IDs, IP address in hosting logs); commercial information (your subscription and its payments, passes and packs bought, and sessions used); internet or network activity (usage records and logs); audio information (voice recordings, handled in transit and not stored by us); and anything you include in a review or a message to us. The sources are you and your browser. The purposes are set out in Section 4, and the recipients in Section 6. We do not sell or share personal information, and we do not knowingly handle the personal information of anyone under 16.
11.5 Illinois, Texas, Washington and other biometric laws
We do not collect, store or use biometric identifiers or biometric information. Voice recordings are used only to produce a transcript, and we do not extract or keep a voiceprint.
12. Children
The Service is for adults. You must be at least 18 to use it. We do not knowingly collect information from anyone under 18. If you believe a child has used the Service, tell us through the contact form and we will delete what we can identify.
13. Student records
We are not acting on behalf of any school, and the Service does not create education records under the U.S. Family Educational Rights and Privacy Act. We do not share practice scores with any school, instructor or examination body. We do not receive or keep them ourselves.
14. Artificial intelligence
The patient you speak with and the grader that scores you are artificial intelligence systems, not people. Your words are processed by those systems to produce responses. The output can be wrong. It is practice feedback, and no decision with legal or similarly significant effect is made about you.
15. Links
The Service may link to other websites. We are not responsible for their content or their privacy practices.
16. Changes to this policy
We may change this policy. When we do, we will update the version and effective date at the top. Where a change is material, we will ask you to accept the new version before you next use the Service.
17. Contact
Questions and requests about privacy:
Rounderly
Use the contact form: sign in, open Your account from your name at the top of any page, and choose Contact us.