Privacy & Data Handling Policy

CASC Master (“we”, “us”) operates casc-master.com and the CASC Master apps. We are the controller of the personal data described here. Contact: info@casc-master.com.

• Account data: name, email address, profile photo (from Google sign-in or email sign-in), and profile details you add, such as a WhatsApp number if you choose to provide one.
• Practice data: the stations you run, your responses and transcripts, AI-generated feedback and scores, session history, and booking or practice-partner details.
• Audio and video: your microphone (and camera for practice with others) is used live during sessions so the AI patient or your partner can hear you. Audio is processed to produce transcripts and feedback.
• Credits, referrals, and payments: credit balance, plan, referral codes, and payment confirmations. Card details are handled by PayPal and are not stored by us.
• Feedback and support: messages you send through the feedback form or by email.
• Usage and device data: pages viewed, feature use, errors, and basic device and browser information, collected through analytics.

• to provide the Service: run stations, generate feedback, track history and credits, and connect you with practice partners;
• to process payments and prevent abuse or fraud;
• to send service messages, such as notifications, booking reminders, and account notices;
• to understand usage, fix bugs, and improve the Service;
• to respond to your requests and meet legal obligations.

Where UK/EU GDPR applies, our legal bases are performance of our contract with you, our legitimate interests in running and improving a secure service, consent where we ask for it (for example optional analytics or a WhatsApp number), and legal obligation. We do not sell your personal data.

• Access: your practice data is tied to your account and is not visible to other users. Practice partners only see what you share live in a session (such as your audio, video, and name).
• Limited internal access: only authorised team members can access user data, and only where needed for support, security, or maintenance.
• Security: data is encrypted in transit (HTTPS/TLS) and stored with reputable cloud providers using access controls. No system is perfectly secure, so please use a strong sign-in method and tell us promptly if you suspect misuse.
• AI processing: session audio and text are sent to our AI provider (Google Gemini) to generate patient responses and feedback. We use these only to deliver the Service to you and do not sell them.
• No real patient data: scenarios are fictional. Please never speak or enter real patient-identifiable information.
• Data minimisation: we collect what is needed to run the Service and keep it only for the periods below.

We delete your account and associated personal data after 6 months of inactivity, or sooner when you ask us to.

• Idle accounts: if you do not sign in or use the Service for 6 months, your account, profile, practice history, transcripts, and feedback are deleted automatically. We may email you beforehand so you can keep your account by signing in.
• On request: email info@casc-master.com from your account email address and we will delete your account and data, normally within 30 days.
• What may remain: limited records we must keep by law (for example payment and tax records), and anonymised or aggregated statistics that cannot identify you. Data in routine backups is overwritten on the normal backup cycle.
• Unused credits: deleting your account forfeits any remaining credits.

We share data only with service providers that help us run CASC Master, under appropriate agreements:

• Google (Firebase for authentication and database; Gemini for AI processing);
• LiveKit (real-time audio and video for sessions);
• PayPal (payments);
• PostHog (product analytics);
• email and messaging providers used to send notifications.

We may also disclose data where required by law, or to protect users and the Service. Some providers are outside the UK/EEA; where so, we rely on safeguards such as standard contractual clauses.

We use local storage and similar technologies to keep you signed in and remember preferences, and analytics tools to understand how the Service is used. You can clear these in your browser settings, though some features may then stop working.

Depending on where you live, you may have the right to access, correct, delete, restrict, or export your data, to object to certain processing, and to withdraw consent at any time.

To exercise these rights, email info@casc-master.com. You can also complain to your data protection authority (in the UK, the Information Commissioner’s Office).

The Service is for adults (18+) and is not directed at children. We do not knowingly collect data from children.

We may update this policy. We will change the “last updated” date and notify you of material changes. See also our Terms of Service.