Privacy Policy

Section 1

Who we are

KallosSim Ltd ("KallosSim", "we", "our") is the data controller for personal data processed through the KallosSim conversation simulation platform.

KallosSim is a professional development tool for practitioners working in social care, safeguarding, and related sectors in England and the UK. It provides AI-powered simulation scenarios and structured debriefs grounded in UK statutory guidance and best practice.

Data Protection Officer (DPO):
Email: dpo@kallossim.com
For subject access requests, erasure requests, and all data protection queries.

General enquiries:
Email: hello@kallossim.com

Section 2

Data we process

KallosSim is designed on a privacy-first basis. We process the minimum data necessary to deliver the service. The table below shows all data types we handle.

Section 3

Legal bases

We rely on two lawful bases under UK GDPR Article 6:

• Art. 6(1)(f) — Legitimate interests: the primary basis for processing session data, scores, account identifiers, optional scenario realism feedback, and anonymised improvement analytics (when you have not opted out). Our legitimate interest is delivering the simulation service, enabling practitioners to track their professional development, and improving scenario quality. We have assessed that this interest is not overridden by your interests or fundamental rights, given the pseudonymisation measures, k-anonymised aggregates (minimum group size 5), and the nature of the service (professional development, not consumer profiling).
• Art. 6(1)(a) — Consent: used only for the optional research consent preference. You may give or withdraw this consent at any time from within the app (profile → My data usage).

You may object to processing based on legitimate interests (Art. 21) — for improvement analytics, use the Improvement analytics toggle in your profile. Scenario 👍/👎 is always voluntary; you can simply skip it.

No processing relies on automated decision-making that produces legal or similarly significant effects (UK GDPR Art. 22). AI evaluation scores are advisory only — they are intended to support reflection, not replace supervisor assessment or determine employment or training outcomes.

Section 4

Retention schedule

When an account is deleted, we anonymise rather than destroy session records. The session rows themselves (date, scenario, scores) are retained with the user identifier set to null — this preserves aggregate team statistics without linking the data to any individual. This approach is consistent with UK GDPR Recital 26, which treats truly anonymised data as outside the scope of data protection law.

Section 5

Your rights

Under UK GDPR you have the following rights. Most can be exercised directly in the app; others should be directed to the DPO.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. The ICO helpline is 0303 123 1113.

Section 6

How to exercise your rights

Many rights can be exercised directly from within the app without contacting us:

• Data access (Art. 15): sign in → open your profile (top-right) → "My data usage" to see what we store, or "Download my data" for a full JSON export.
• Research consent (Art. 6/13): sign in → profile → "My data usage" → toggle consent at any time.
• Improvement analytics opt-out (Art. 21): sign in → profile → uncheck "Contribute anonymised usage to service improvement". This stops anonymised usage events from being sent; your training is unaffected.
• Transparency notice: sign in → profile → "How we improve the training" to re-read the full notice shown on first login.
• Training history deletion (Art. 17): sign in → profile → "Delete training history" — permanently removes all practice sessions, scores, and evaluations while keeping your account and login.
• Account deletion (Art. 17): sign in → profile → "Delete my account" — this immediately anonymises all personal data and permanently revokes your login.
• Organisation deletion (Art. 17, team leads only): sign in → profile → "Delete organisation data" — anonymises all accounts in your organisation.
• Contest an automated score (DUAA 2025): sign in → profile → "Contact my organisation's DPO" — sends a formal data review request to your organisation's registered Data Protection Officer. See Section 7 for details.

For rights that cannot be exercised in-app (rectification, restriction, objection, portability via alternative formats), contact the DPO:

dpo@kallossim.com

We will respond to all rights requests within one calendar month as required by UK GDPR Art. 12(3). If the request is complex we may extend this by a further two months and will inform you within the first month.

Section 7

Automated decisions & DUAA 2025

The Data (Use and Access) Act 2025 (DUAA) introduces strengthened rights around automated decision-making in England and the UK. This section explains how those rights apply to KallosSim's AI evaluation scores.

What the AI evaluator does

After each practice session, an AI model reads your conversation transcript and scores your communication against up to 29 evidence-based criteria. It produces a numeric score (0–3) and written rationale for each criterion. These scores are:

• Stored against your account for your personal debrief and aggregate team reporting
• Based entirely on observable communication behaviours — not inferred emotions, intent, or personality
• Grounded in retrieval from UK statutory guidance and professional standards
• Never used to make decisions affecting your employment, training pathway, registration, or any legal status

Your right to contest

Even though automated scores do not constitute binding decisions, we respect your right to challenge any score you believe does not accurately reflect your practice.

To exercise this right:

1. Sign in to the app → open your profile (top-right)
2. Under "Your data rights", click "Contact my organisation's DPO"
3. This sends a formal data review notification to your organisation's registered Data Protection Officer
4. Your DPO must acknowledge within 30 days and arrange review through your organisation's internal processes

Alternatively, email dpo@kallossim.com with the subject "Score contestation request". Include your session date and the criterion you are contesting. We will acknowledge within 30 days.

Rubric transparency

Every evaluation criterion is visible in the app (Professional Framework tab). Each criterion describes an observable communication behaviour — what was said, how it was phrased, whether certain techniques were used. The full knowledge base of UK statutory guidance that grounds each criterion is cited in the evaluation debrief alongside every score.

We do not use criteria that infer emotional states, personality traits, or internal motivations — only behaviours that are directly observable in the text of the conversation.

Section 8

International transfers

Your data may be processed by the following sub-processors. We have carried out transfer impact assessments and put appropriate safeguards in place for each.

Section 9

Cookies & local storage

KallosSim uses no tracking cookies and no third-party analytics scripts. We do not use cookies for advertising, profiling, or cross-site tracking of any kind.

We use browser localStorage for two purposes only:

• Login session token (JWT): stored under the key dialogtrainer.token — keeps you signed in between page loads. Cleared when you sign out.
• App state (card deck): stored under dialogtrainer.state.v3 — saves your card deck selections so they persist between visits. Contains no personal data.

Under the UK Privacy and Electronic Communications Regulations (PECR), we are required to inform you of this use. No consent is required for strictly necessary storage of this type (ICO guidance on PECR and session tokens).

Section 10

AI Act transparency

KallosSim uses artificial intelligence in two ways, and we are required to disclose this under EU AI Act Article 52 (and equivalent UK provisions):

1. AI-generated personas: the simulated person you practise with in each scenario is not a real person. The dialogue, responses, emotional reactions, and biographical details are generated entirely by an AI language model (OpenAI GPT-4o). The persona is designed to be realistic for training purposes. You are always interacting with an AI, never with a human.
2. AI evaluation: after each practice session, an AI model evaluates your responses against evidence-based criteria and produces a score and written feedback. This evaluation is intended as a learning support tool only. No AI makes decisions that affect your legal rights, employment, or training pathway. Final assessment of practitioner competence must always involve human judgment.

The AI models used are:

• Scenario generation & persona play: OpenAI GPT-4.1 / GPT-4.1-mini
• Practice evaluation: OpenAI GPT-4.1 (Pipeline C — multi-agent scoring)
• Real-time coaching hints (optional): OpenAI GPT-4.1-mini — see below
• Knowledge retrieval: OpenAI text-embedding-3-small (vector embeddings for UK guidance retrieval)

Real-time coaching mode

If you enable Coaching mode during a practice conversation, the following data is sent to OpenAI after each exchange:

• Your most recent message (the trainee turn)
• The AI persona's reply
• The scenario title and the list of criteria being practised

This data is used solely to generate a brief, in-session coaching tip. It is subject to OpenAI's zero data retention agreement — OpenAI does not store or use it for model training. No names, biographical details, or real case information are transmitted; all scenario content is AI-generated. Coaching mode is off by default and can be toggled at any time from the conversation header. Your preference is saved to your account.

Where configured, AI outputs may retrieve from a curated knowledge index of UK statutory guidance (Working Together to Safeguard Children 2023, KCSIE 2024, Care Act 2014, ACAS Codes, NICE PH49, SCIE guidance, and other authoritative sources). Citations appear in the evaluation debrief when retrieval succeeds. Cases and personas themselves are always AI-generated.

Section 11

Policy updates

We may update this policy when our data processing practices change, when there are changes to UK data protection law, or following our annual DPO review.

When we make material changes, we will notify users via an in-app notice and update the version number and date at the top of this page. Continued use of the service after notification constitutes acknowledgment of the updated policy.

Previous versions of this policy are available on request from dpo@kallossim.com.