Privacy Policy

Clinic Ready Inc. ("ClinicReady," "we," "our," or "us") operates the ClinicReady dental practice management simulation platform, accessible at sim.getclinicready.com, and the marketing website at getclinicready.com (collectively, the "Platform"). This Privacy Policy explains how we collect, use, store, and protect information in connection with your access to and use of the Platform.

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you are a dental school or educational institution ("Institution") using the Platform under a Pilot Program Agreement or paid license, this Privacy Policy supplements and is incorporated by reference into that agreement.

This Privacy Policy applies to:

• Students and faculty who access the simulation platform at sim.getclinicready.com;
• Visitors to the marketing website at getclinicready.com; and
• Institutions and their authorized representatives who contact ClinicReady regarding pilot participation or licensing.

This Policy does not apply to third-party websites, services, or tools that may be linked from the Platform. We encourage you to review the privacy policies of any third-party services you access.

3.1 Simulation Platform (sim.getclinicready.com)

The simulation platform is designed to minimize collection of personally identifiable information ("PII"). Specifically:

• Simulation decisions and scores: Each practice management decision submitted during a simulation session, and the resulting performance scores, are stored in our database under an anonymized team identifier assigned by the faculty member. No student legal name, email address, or student identification number is collected or required.
• Survey responses: Pre-simulation and post-simulation survey responses are stored under the same anonymized team identifier. Surveys are designed not to solicit PII. Faculty are instructed not to configure team names using real student names.
• School affiliation: An institutional identifier (school ID) is configured by the faculty member to organize cohort data. This identifier does not require any individual student identity.
• No account creation: The Platform does not require students to create accounts, provide email addresses, or set passwords. There is no login tied to individual student identity.

3.2 Marketing Website (getclinicready.com)

The marketing website does not operate contact forms or newsletter subscriptions. If you choose to contact us using the email address published on the website (pilot@getclinicready.com), we will receive your message and email address solely for the purpose of responding to your inquiry. We do not add inbound email contacts to any marketing lists without explicit consent.

3.3 Infrastructure-Level Data

Our hosting provider, Netlify, may collect standard web server access logs — including IP addresses and browser information — at the CDN level as part of normal internet infrastructure operations. This logging is governed by Netlify's own privacy policy and is outside ClinicReady's direct control. ClinicReady does not process or analyze this infrastructure-level data.

We use the information collected through the Platform for the following purposes:

• To operate and deliver the simulation platform to Institutions and their students;
• To generate anonymized cohort outcome reports delivered to the Institution's faculty contact;
• To conduct academic research and produce peer-reviewed publications using anonymized and aggregated cohort data, as described in the applicable Pilot Program Agreement;
• To improve and calibrate the Platform, including scoring methodology and event libraries;
• To communicate with Institutions regarding technical support, pilot coordination, and program administration;
• To comply with applicable legal obligations; and
• To measure platform usage in aggregate for internal product analytics purposes.

ClinicReady uses the following third-party service providers in connection with the operation of the Platform. Each provider processes data only as necessary to perform services on our behalf and is subject to its own privacy and security commitments.

The Family Educational Rights and Privacy Act ("FERPA") governs the privacy of student education records maintained by educational institutions. ClinicReady is designed to operate with FERPA compliance as a foundational constraint.

Where an Institution uses simulation performance data as part of an official course grade or incorporates it into a student's academic record, that data may constitute an "education record" under FERPA, and the Institution bears primary FERPA responsibility as the educational agency. In this context, ClinicReady functions as a "school official" with a legitimate educational interest, acting under the Institution's FERPA authority pursuant to the applicable Pilot Program Agreement or license.

Where the simulation is used as an ungraded learning exercise with fully anonymized data, and where no linkage between team identifiers and individual student identities is maintained by ClinicReady, FERPA applicability to ClinicReady's data holdings is significantly reduced.

Simulation and survey data associated with an Institution is retained in our database for the duration of the Institution's active pilot program or paid license agreement.

Upon termination or expiration of the applicable agreement, or upon written request by the Institution's authorized representative, all data associated with that Institution's school identifier will be permanently deleted from our database within five (5) business days. The Institution will receive a deletion confirmation email from pilot@getclinicready.com.

Where ClinicReady has delivered an anonymized cohort outcome report to the Institution, that report becomes the Institution's permanent record. ClinicReady is not required to retain underlying data after delivery of the report.

Anonymized and aggregated data incorporated into academic publications or internal research benchmarks may be retained indefinitely, as it cannot be used to identify any individual student or Institution.

We implement commercially reasonable administrative, technical, and physical safeguards to protect information stored and processed through the Platform, including:

• Encryption of data in transit using TLS (Transport Layer Security);
• Encryption of data at rest within our Supabase database infrastructure;
• Access controls limiting database access to authorized personnel; and
• Use of anonymized identifiers rather than PII as primary keys for simulation data.

No method of transmission over the internet or electronic storage is 100% secure. While we take the protection of data seriously, we cannot guarantee absolute security.

The Platform is designed for and directed exclusively to students enrolled in accredited dental education programs in the United States. Dental education programs require completion of undergraduate education as a prerequisite for admission; accordingly, all users of the simulation platform are expected to be adults (18 years of age or older).

The Platform does not knowingly collect personal information from individuals under the age of 13, as defined by the Children's Online Privacy Protection Act ("COPPA"). If we become aware that personal information has been collected from a child under 13, we will promptly delete such information. If you believe we have inadvertently collected information from a minor, please contact us at pilot@getclinicready.com.

ClinicReady does not sell, rent, or trade any user data to third parties. We may share information only in the following limited circumstances:

• Service providers: As described in Section 5, we share data with third-party processors solely to operate the Platform on our behalf.
• Pilot outcome reports: Anonymized cohort data is compiled into a report delivered to the Institution's faculty contact. This report contains no individual student PII.
• Academic publications: Anonymized and aggregated cohort data may be used in peer-reviewed publications, as described in the applicable Pilot Program Agreement. Individual students and Institutions are not identified in publications without explicit consent.
• Legal compliance: We may disclose information if required by applicable law, regulation, legal process, or enforceable governmental request, or to protect the rights, property, or safety of ClinicReady, its users, or the public.
• Business transfers: In the event of a merger, acquisition, or sale of substantially all of our assets, user data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy.

Because ClinicReady does not collect PII from individual students, most privacy rights are exercised at the institutional level rather than the individual student level.

If you are an Institution and you wish to request deletion of all data associated with your institution, obtain a copy of the data stored under your school identifier, or correct or update institutional configuration data, please contact us at pilot@getclinicready.com. We will respond to institutional data requests within five (5) business days.

If you are an individual who contacted us via our published email address and wishes to be removed from our correspondence records, you may request deletion of your contact information by emailing pilot@getclinicready.com.

This Privacy Policy is governed by the laws of the State of Texas, without regard to its conflict of law principles. Any disputes arising under or in connection with this Privacy Policy shall be resolved exclusively in the state or federal courts located in Harris County, Texas.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date at the top of this Policy and, where we have a direct communication relationship with an Institution, notify the Institution's faculty contact by email at least ten (10) days before the changes take effect.

Continued use of the Platform after the effective date of any update constitutes acceptance of the revised Privacy Policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out: