CRAI

Privacy Policy

Last updated: 19 August 2026

1. Who we are

CRAI — Clinical Reasoning powered by AI — is operated by individuals named in our Imprint. For the purposes of the Swiss Federal Act on Data Protection (FADP, revDSG) and the EU General Data Protection Regulation (GDPR), those individuals act as the data controllers.

If you have questions about this policy or wish to exercise your data protection rights, contact us at contact@craimed.ch.

2. What data we collect

We process personal data in two main contexts: visitors to this marketing website (www.craimed.ch) and registered users of the CRAI application (app.craimed.ch).

2.1 Website visitors

  • Technical and usage data: IP address, browser type and version, device type, operating system, referring URL, pages viewed, and approximate access times.
  • Cookies: essential cookies (e.g. to remember your cookie consent choice) and, only if you consent, analytics cookies. See Section 9 below.

2.2 CRAI application users

When you create an account and use the CRAI patient simulator, we may process:

  • Account data: name and email address provided when you create an account via Google Sign-In, Sign in with Apple, or email and password (for invited or legacy users), and any account identifier supplied by the identity provider.
  • Payment data: subscription status, billing history, and payment method metadata processed by Stripe. We do not store full payment card numbers.
  • Simulation and learning data: chat transcripts, voice recordings (where voice interaction is used), diagnostic and clinical choices you make during cases, performance scores, feedback, session timestamps, and related metadata needed to deliver and improve the educational experience.

CRAI is designed for educational simulation with fictional patients. You must not enter real patient data or other sensitive third-party personal data into the service.

3. Why we process data and legal bases

Under the GDPR, we rely on the legal bases in Article 6. Swiss FADP applies in parallel; where Swiss law requires a comparable legal ground, we process data on an equivalent basis.

  • Providing the service (Art. 6(1)(b) GDPR — contract): account creation, authentication, running simulations, storing progress and scores, and managing subscriptions.
  • Payments (Art. 6(1)(b) GDPR — contract): processing billing and subscription management via Stripe.
  • Website security and operation (Art. 6(1)(f) GDPR — legitimate interest): protecting the website and application, preventing abuse, and maintaining basic server logs.
  • Analytics on this marketing website (Art. 6(1)(a) GDPR — consent): understanding aggregate website usage when you opt in via our cookie banner. Non-essential analytics scripts are not loaded before consent.
  • Product improvement (Art. 6(1)(f) GDPR — legitimate interest): analysing aggregated or pseudonymised usage patterns to improve simulation quality, reliability, and educational value, balanced against your rights.
  • Legal compliance (Art. 6(1)(c) GDPR — legal obligation): retaining records where required by tax, accounting, or other applicable law.

4. AI processing

CRAI uses artificial intelligence to generate fictional patient responses, dialogue, and educational feedback during simulations. Content you submit during a session — including text and, where enabled, voice input — is transmitted to and processed by a third-party large language model (LLM) provider (OpenAI).

This processing is necessary to deliver the core simulation experience. Do not submit real patient information or other confidential third-party data. The LLM provider processes data on our instructions as a sub-processor under appropriate data protection agreements.

5. Sub-processors

We use trusted service providers who process personal data on our behalf. Our current sub-processors include:

  • Google Cloud — hosting, database (Cloud SQL), and object storage
  • Google — Google Sign-In via Identity Platform
  • Apple — Sign in with Apple via Identity Platform (where enabled)
  • Stripe — payment processing and subscription management
  • OpenAI — AI inference for patient simulation, voice interaction, case parsing, and educational feedback
  • Vercel Analytics — website analytics (only when you consent on this marketing site)

Data processing agreements or equivalent contractual safeguards are in place with Google Cloud, Google (Identity Platform), Stripe, and OpenAI.

6. International transfers

Some of our sub-processors are located outside Switzerland and the European Economic Area (EEA), including in the United States. Where personal data is transferred to countries without an adequacy decision from Switzerland or the European Commission, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) and, where applicable, participation in the Swiss-US and EU-US Data Privacy Framework programmes by the recipient.

You may request further information about transfer safeguards by emailing contact@craimed.ch.

7. Retention

We retain personal data only for as long as necessary for the purposes described in this policy, unless a longer period is required by law.Retention periods by data type:

  • Account and profile data: for the lifetime of the account, plus up to 24 months after deletion or last activity, unless longer retention is required by law.
  • Simulation data (chat transcripts, voice transcripts, case progress, scores): for the lifetime of the account.
  • Billing records (processed by Stripe): as required by Swiss tax and accounting law (typically up to 10 years).
  • Server and security logs: up to 90 days.
  • Marketing analytics (if consented): per the analytics provider's configuration.

When data is no longer needed, we delete or anonymise it in accordance with our internal retention schedule.

8. Your rights

Depending on your location and applicable law, you may have the following rights regarding your personal data:

  • Access — obtain confirmation and a copy of your data
  • Rectification — correct inaccurate or incomplete data
  • Erasure — request deletion in certain circumstances
  • Restriction — limit processing in certain circumstances
  • Objection — object to processing based on legitimate interests
  • Data portability — receive data you provided in a structured format
  • Withdraw consent — where processing is based on consent (e.g. analytics cookies), without affecting prior lawful processing

To exercise these rights, email contact@craimed.ch. We will respond within the timeframes required by applicable law.

You also have the right to lodge a complaint with a supervisory authority. In Switzerland, you may contact the Federal Data Protection and Information Commissioner (FDPIC). If you are in the EU/EEA, you may contact the data protection authority in your country of residence or place of work.

9. Cookies

This marketing website uses cookies and similar technologies.

  • Essential cookies: required for basic functionality, including remembering your cookie consent choice. These cannot be disabled through our banner because the site needs them to honour your preferences.
  • Analytics cookies: help us understand how visitors use the website (e.g. page views and referral sources). These are non-essential and are loaded only after you give explicit consent via our cookie banner.

When you first visit the site, you can accept all cookies, reject non-essential cookies, or open "Manage preferences" to choose categories individually. You can change your choice at any time via "Cookie settings" in the website footer. Rejecting non-essential cookies is as easy as accepting them; we do not use pre-ticked optional categories.

10. Changes to this policy

We may update this Privacy Policy from time to time, for example when our services, sub-processors, or legal requirements change. We will post the revised policy on this page and update the "Last updated" date above.

Effective date: 19 August 2026