Privacy policy

This policy explains how pecan collects and uses personal data when you use our website and simulations.

Who we are

pecan is operated by Pecan Clinical Limited, a company registered in England and Wales (company number 17541337). We are the data controller for the personal data described here.

What we collect

Account details (name, email, profession), messages you send through our contact form, consultation inputs you enter during simulations (including spoken questions submitted for transcription), saved case attempts and CPD reflections, your acceptance of our terms, and subscription status.

How we use it and our legal basis

To provide your account, run simulations and feedback, take payment, respond to enquiries and improve the service. We rely on performing our contract with you, our legitimate interests in running and improving pecan, and our legal obligations (for example financial records). We do not sell your data.

Who processes data for us

We use trusted service providers: Stripe for card payments (we never see or store your full card details), OpenAI for AI patient replies and voice transcription, and our cloud hosting and database provider for accounts and saved work. Some providers may process data outside the UK under appropriate safeguards.

Voice and AI processing

We do not store voice recordings. Your spoken questions are transcribed so the simulation can respond and generate your feedback, and the recording is discarded once transcribed.

When the simulated patient cannot answer a question from its case file, we keep the text of that question (not your name, email or account) so we can improve our cases. Please don't include personal information in your questions.

Simulated patients

All patients are simulated. Cases are fictional studies and are not based on real patients. Please do not enter real patient information.

How long we keep it

We keep account data and saved work while your account is active. Payment and terms-acceptance records are kept as long as needed for legal and accounting purposes.

Your rights

Under UK GDPR you may request access, correction or deletion of your data, or object to its processing. To make a request, contact us through our contact page. You can also complain to the Information Commissioner's Office (ico.org.uk).