CASEPLAY PRIVACY POLICY

1. Introduction

Who We Are

This Privacy Policy applies to CasePlay, operated by Mountain Vista Software LLC ("CasePlay," "we," "us," or "our"), a Washington limited liability company. CasePlay provides an online platform for educational, training, and professional development purposes, including simulated case-based learning and AI-assisted practice environments.

Acceptance and Changes

By registering for, accessing, or using CasePlay, you acknowledge that you have read and understood this Privacy Policy and agree to its terms. We may modify this Privacy Policy from time to time. If we make material changes that affect how we use or disclose personal information, we will provide notice through the platform, by email, or by other reasonable means.

2. Children's Privacy

CasePlay is not intended for general use by children.

Individual users must be 18 years of age or older to create an account. Students under the age of 18 may access CasePlay only through enrollment by an educational institution, which is solely responsible for verifying age eligibility and obtaining any required parental or guardian consent.

CasePlay does not independently verify user ages and does not knowingly collect personal information from children outside of institution-managed access.

3. Information We Collect

We collect information you provide directly, information generated through your use of the platform, and certain information collected automatically. For purposes of this Privacy Policy, we refer to all such information as "your data."

Account Information

When you create an account, we collect information such as:

• Email address
• Password (stored in hashed form)
• First and last name
• Account type (e.g., Institution, Private Practice, Therapist, Student)
• Optional demographic information
• Account creation and login timestamps

Institutional and Private Practice Information

CasePlay supports two organizational account types:

Educational Institutions

Institutions may manage members, classes, enrollments, and assignments. Institutional data may include institution identifiers, class structures, and student participation records.

Private Practice Accounts

Private practice accounts are separate and distinct from institutions. Private practices:

• Do not assign tasks or coursework
• Do not manage students
• Only access data created within their own practice

Private practice data may include practice identifiers and simulated client records created by practice members.

Session and Educational Data

When you use CasePlay, we collect and store information related to your activity, including:

• Simulated session transcripts
• Session configurations, metadata, and timestamps
• Reviews, comments, and questions
• Task submissions, grades, and feedback (institutional users only)

AI Client Data

Users may create simulated clients for educational or training purposes. AI client data may include fictional demographics, background narratives, presenting concerns, personality traits, and AI-generated images. These simulated clients do not represent real individuals.

File Uploads

We collect files you upload to the platform (such as assignments or reference documents), along with associated metadata such as file name, size, and content type.

Automatically Collected Information

We automatically collect certain technical and usage information, such as IP address, browser type, device information, and usage logs. This information is used to operate, secure, and improve the platform.

4. How We Use Your Data

We use your data for the following purposes:

• Providing and operating the platform, including authentication, session delivery, and account management
• Supporting educational and training workflows, including simulated sessions and feedback
• Communicating with you, including system notices, account messages, and marketing communications
• Improving and developing the platform, including analytics, troubleshooting, and performance monitoring
• Maintaining security and integrity, including preventing fraud and misuse
• Complying with legal obligations and enforcing our rights

We may use automated systems and algorithms to support these activities.

5. AI Services and Data Handling

CasePlay uses third-party AI services to generate simulated interactions and images.

• Personally identifying information such as names, email addresses, and institution or practice identifiers are never sent to AI service providers.
• Session data is not shared for AI model training.
• AI providers process limited contextual data solely to generate responses or images requested by users.

AI-generated content is provided for educational and training purposes only and may be inaccurate or incomplete.

6. With Whom We Share Your Data

We share data in the following circumstances:

Service Providers

We share data with trusted vendors that help us operate the platform, such as cloud hosting providers, monitoring services, email delivery services, and AI service providers. These vendors are authorized to use data only as necessary to provide services to CasePlay.

Within the Platform

Access to data within CasePlay is governed by role-based permissions:

• Institutional administrators and instructors may access student data within their institution
• Private practice members may access data only within their own practice
• Users cannot access data belonging to other institutions or practices

Legal and Safety Reasons

We may disclose data if we believe disclosure is reasonably necessary to comply with the law, protect rights or safety, investigate wrongdoing, or enforce our Terms of Service.

Business Transactions

If CasePlay is involved in a merger, acquisition, or sale of assets, user data may be transferred as part of that transaction, subject to reasonable confidentiality protections.

Educational Institutions

Educational institutions may request additional documentation regarding student data privacy and the handling of education records, including FERPA-related materials.

7. HIPAA and Health Information Disclaimer

CasePlay is not a HIPAA-covered service and is not intended for use with real patient data.

Users, including private practice users, must not enter real patient information into the platform. All simulated clients and sessions are intended for training and educational purposes only.

8. Data Retention

We retain your data for as long as your account remains active. After account cancellation or termination, we may retain data for up to 12 months, unless a longer retention period is required by law or necessary for legitimate business purposes such as compliance, dispute resolution, or enforcement of our agreements.

Archived institutional or practice data may be retained as required by contractual or legal obligations. When data is no longer required, we will delete or anonymize it.

9. Your Privacy Choices and Rights

You may:

• Access and update your account information
• Request a copy of your data
• Request deletion of your data, subject to legal and contractual limitations
• Opt out of marketing communications

Requests may be submitted through your account or by contacting us.

10. Communications From Us

By creating an account, you consent to receive communications from us, including transactional and marketing emails. You may opt out of marketing communications at any time; however, you will continue to receive service-related messages necessary to operate your account.

11. Security

We use administrative, technical, and organizational safeguards designed to protect your data. However, no system can be completely secure, and we cannot guarantee absolute security. You are responsible for safeguarding your credentials.

12. Your Responsibilities

If you receive information about other users through the platform, you agree to handle such information in compliance with applicable privacy and data protection laws and to use it only for authorized purposes.

13. Third-Party Services

CasePlay may link to third-party services not operated by us. We are not responsible for their privacy practices and encourage you to review their policies before use.

14. Contact Us

For questions or concerns regarding this Privacy Policy or your data, please contact: