Privacy Policy

Who we are: DeviceRep.ai is operated by Device Rep LLC, a Virginia limited liability company ("DeviceRep," "we," "us"). Contact: support@devicerep.ai.

This policy explains what we collect, why, and who touches it when you use devicerep.ai (the "Service").

What we collect

Account information. Name, email address, password (stored as a secure hash — we never see it), job title and experience level if you provide them, and your subscription tier.

Practice session content. The Service is a conversation simulator. We record and store the full transcript of every practice session: what you type or say, the AI surgeon's responses, and the AI coach's feedback. If you configure a custom scenario, we store that configuration. This is the core of the product — your session history and progress tracking depend on it.

Voice input. If you use voice features, your speech is processed into text by a speech-to-text provider. The resulting text becomes part of your session transcript. We do not retain audio recordings after transcription.

Scores and evaluations. Our AI evaluation system analyzes your session transcripts and generates competency scores, feedback, and progress data, which we store with your account.

Usage data. Sessions started and completed, feature usage, and session counts (used to enforce your plan's session allowance). We use Google Analytics to understand site traffic; Google Analytics sets cookies and collects standard usage data under Google's own privacy policy.

Payment information. Payments are processed by Stripe. Your card details go directly to Stripe and are never stored on our systems. We store only Stripe's identifiers for your customer and subscription records, your subscription status, and your current billing period end date.

What we do NOT want you to submit

Do not enter real patient information, protected health information, or any information identifying a real patient into practice sessions. The Service is a training simulator using fictional scenarios; it is not designed or authorized to hold PHI. Similarly, do not enter your employer's confidential or trade-secret information. We may remove content that violates this.

How we use your information

To run the Service: conducting simulations, generating scores and coaching feedback, tracking your progress, enforcing session allowances, and providing support. To improve the Service: we review session transcripts and evaluation results to calibrate and improve our scoring and coaching systems. To communicate with you about your account and the Service. We do not sell your personal information, and we do not use your data for third-party advertising.

Who processes your data

We use a small set of service providers to operate the Service, each receiving only what their function requires:

• Supabase — database and application backend (account data, transcripts, scores)
• LiveKit — real-time session infrastructure and model routing for practice sessions (session dialogue, and voice audio while a session is live)
• Anthropic — AI models powering the surgeon simulation, the coaching debrief, and session evaluation (session transcripts)
• OpenAI — alternative AI model provider for the same functions, used depending on configuration (session transcripts)
• Deepgram — speech-to-text transcription when you use voice features
• Cartesia — text-to-speech synthesis for the simulated surgeon's and coach's voices
• Voiceflow — conversation platform still powering some legacy practice entry points (session dialogue)
• Google — Google Analytics (site usage)
• Stripe — payment processing and subscription billing (your name, email, and payment details, which you provide to Stripe directly)
• Lovable — website hosting

We may also disclose information if required by law, or as part of a business transfer (in which case this policy continues to apply to your data).

Organization accounts

If you use the Service through your employer or a team account in the future, designated managers in that organization may be able to view your session summaries and scores, and — only if the organization enables it — your session transcripts. Today, all accounts are individual and no one but you (and our systems) sees your sessions.

Data retention and deletion

We retain your account data and session history while your account is active, because progress tracking is the product. You can request deletion of your account and associated data at any time by emailing support@devicerep.ai; we will delete your personal data within 30 days, except records we're legally required to keep.

Security

Data is encrypted in transit, access is restricted by row-level security so users can only reach their own records, and administrative access is limited. No system is perfectly secure; if a breach affects your data, we will notify you as required by law.

Your rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal data. Email support@devicerep.ai and we will honor these requests for all users regardless of location.

Age

The Service is for working professionals and requires users to be at least 18. We do not knowingly collect data from anyone under 18.

Changes

We'll post updates to this policy here and update the effective date. Material changes will be announced to account holders by email.

Questions: support@devicerep.ai