Version 2026-08-18. This notice explains what personal data the Birmingham Psychotherapy Simulator collects about you, why, and what rights you have under UK GDPR.

Who is responsible for your data

The platform is currently operated by Dr Richard Chater and Dr Masud Awal, who are joint data controllers. It is an independent educational project and is not operated by, or on behalf of, an NHS organisation. If the platform is later adopted by a training institution, this notice will be updated and you will be told.

For any question about your data, or to exercise any of the rights below, contact r.chater@nhs.net.

What we collect

• Your name, email address and role (trainee, supervisor or administrator)
• The date your account was created and when you last signed in
• Which simulations you have attempted, and when
• Scores against RCPsych core training learning objectives, and written feedback on your performance
• Transcripts of simulated conversations, where a simulation produces one
• A record of administrative actions, such as an invitation being created

What we deliberately do not collect

• NHS numbers, or any patient-identifiable information
• Audio recordings — no audio is stored at any point
• Special category data about you
• Tracking or advertising cookies of any kind

The simulated patients are fictional. You must never enter real patient information into this platform.

Why we process it, and our lawful basis

Our lawful basis is your consent (UK GDPR Article 6(1)(a)), which you give when you activate your account. Use of the platform is voluntary, it forms no part of your formal assessment, and declining to use it has no consequence for your training.

We process your data to give you access to simulations, to show you your own performance and progress, to allow a supervisor you are linked to to review your work, and to improve the platform.

Performance information on this platform is formative. It does not constitute an assessment of your clinical competence and is not shared with your training programme, ARCP panel or employer.

Who else can see it

• You can see all of your own data.
• A supervisor explicitly linked to you can see your attempts, scores and feedback.
• Administrators can see account details and platform activity, and can access performance data where necessary to operate the service.
• Other trainees can never see your data.

Where it is stored

Data is held in a PostgreSQL database operated by Neon, hosted in the London (eu-west-2) region. The application is served by Cloudflare. Both act as processors on our behalf under contract.

Cloudflare operates a global network and may route or cache requests outside the UK in the course of delivering the service; this is covered by their data-processing terms and standard contractual clauses. Your stored data remains in the UK.

How long we keep it

• Transcripts: six months, then automatically deleted.
• Account, attempts, scores and feedback: for as long as your account exists.
• If you delete your account: all of the above is erased immediately.

Your rights

Under UK GDPR you have the right to:

• Access your data — download everything we hold from your profile page, at any time
• Erasure — delete your account and all associated data from your profile page
• Rectification — ask us to correct anything inaccurate
• Withdraw consent at any time, which you do by deleting your account. Withdrawal does not affect processing that has already taken place
• Portability — your data export is machine-readable JSON
• Object to processing, or restrict it

There is no automated decision-making with legal or similarly significant effects. Where the platform later proposes scores automatically, those are formative suggestions reviewed by a person.

Cookies

We set a single cookie to keep you signed in. It is strictly necessary for the service to function, so no consent banner is required. We use no analytics, advertising or third-party tracking cookies.

Security

All traffic is encrypted with HTTPS. Passwords are hashed and never stored in readable form. Administrator tools require an additional one-time code sent by email. Access to your data is restricted by role. Database credentials are held in a secret store and never exposed to the browser.

Complaints

If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Changes to this notice

If we change how we use your data we will update this notice and, where the change is significant, ask for your consent again.

Back to the Birmingham Psychotherapy Simulator