Privacy & GDPR

Privacy & GDPR notice

This notice explains what personal data AB Simulations collects, why, and the rights you have over it under UK GDPR and the Data Protection Act 2018.

Who is responsible for your data

AB Simulations is used for scheduling nursing simulation sessions. For any privacy question, contact Behnam.jafari_salim@kcl.ac.uk.

What we collect

  • Account & profile data — name, email address, organisation, requested role (admin, academic or simulated patient) and approval status.
  • Session & booking data — sessions you create, register for or are assigned to, availability, and any scripts or documents attached to a session.
  • Technical data — sign-in timestamps and basic authentication metadata needed to keep your account secure.

Why we process it, and our legal basis

We process this data to run the booking system: matching simulated patients to sessions, confirming staffing, and sending reminders and reports. Our legal bases are performance of a contract (delivering the service you've registered for) and legitimate interests (administering the simulation programme). Where we ask for explicit consent — for example, optional communications — we rely on that consent instead.

How long we keep it

Account and session data is retained for the current academic year plus one further year for end-of-year reporting, after which it's reviewed and deleted or anonymised unless a longer period is required by law.

Your rights

Under UK GDPR, you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • ask us to erase your data, where there's no overriding reason for us to keep it;
  • restrict or object to certain processing;
  • receive your data in a portable format; and
  • complain to the Information Commissioner's Office (ICO) if you think we've mishandled your data.

To exercise any of these rights, email Behnam.jafari_salim@kcl.ac.uk.

Cookies & local storage

We only use strictly necessary storage: a session token that keeps you signed in, and a small local preference that remembers whether the sidebar is expanded. We don't use analytics, advertising or tracking cookies, so no cookie consent banner is shown.

Where your data is stored

Account, session and booking data is stored with Supabase, our database and authentication provider, acting as a data processor on our behalf under a data processing agreement.

Changes to this notice

We may update this notice from time to time. Material changes will be reflected here with an updated date.

Last updated: draft, not yet published.