Privacy and Data Residency Policy
Last Updated: October 1, 2026
1. Privacy at a Glance
We believe that training tools should be safe, transparent, and private by default. Our platform is used by healthcare professionals, educators and their learners, so we hold ourselves to a high standard of data protection.
- Your Content is Yours: We do not claim ownership of the roleplays you publish or the transcripts and recordings generated in your practice sessions.
- No AI Training: We do not use your data (prompts, transcripts, or audio) to train Artificial Intelligence models, and neither do the AI providers we use.
- Sessions are recorded: Practice sessions are recorded (audio and transcript) so that you can replay them, receive feedback, and choose to share them with a coach or trainer. You are told this before every session starts.
- Audio is deleted after 90 days: Audio recordings are automatically deleted 90 days after the session ends. Transcripts and feedback are kept for as long as your account exists.
- Data Location: Your stored data (transcripts, recordings, feedback, account details) is held in Sweden (EU). Our AI services are Microsoft Azure resources in Sweden, with an overflow resource in France (EU) used when the Swedish capacity is full. Because these are Microsoft “Global Standard” deployments, the live AI processing itself (not the storage) may take place in Microsoft data centres outside the EU. See Section 6.
- Uploaded recordings are real people’s data: Where your organisation has it enabled, you can upload a recording of a real session for AI analysis (“Analyse a recording”). You may only do so with the explicit consent of everyone who can be heard, and you confirm that on every upload. The original file is deleted as soon as its audio is extracted, and you can delete the analysis at any time. See Section 3E.
- Trainers only see what you release: In the MI Practice Lab, a trainer can see that you practised, but cannot open your transcript, recording or feedback until you choose to release that session to them.
- Student Safety: Where our Service is used with children, we design with the “Best Interests of the Child” in mind, complying with the UK Age Appropriate Design Code (AADC).
2. Introduction
This Privacy Policy explains how Zenobits Ltd (“we”, “us”, “our”) collects, uses, and protects personal data when you use our roleplay training platform, including the MI Practice Lab and the roleplay authoring platform (together, the “Service”), and our website at zenobits.co.uk.
We are a company incorporated in the United Kingdom.
- Our Role: For individual accounts (including MI Practice Lab learners who sign up directly or buy practice minutes themselves), trainer and author accounts, and the content you author, we act as the Data Controller.
- Organisational Use: Where a school, institution, trainer or employer assigns roleplays or enrols learners through a cohort link, we generally act as a Data Processor on behalf of that organisation (the Data Controller) for the session data those learners generate.
- Uploaded Recordings: For the people who can be heard in a recording you upload (for example a client or patient), you, or the organisation on whose behalf you made the recording, are the Data Controller and we act as a Data Processor on your instructions. We are the Data Controller for your own account data and for the consent confirmation recorded with each upload (Section 3E).
This policy adheres to the UK General Data Protection Regulation (UK GDPR), the Data (Use and Access) Act 2025, and the EU GDPR.
3. Data We Collect
We collect and process the following categories of personal data:
A. Account Data (Learners, Trainers, Authors and Administrators)
- Identity Data: Names (where you provide them, for example on a CPD record), usernames.
- Contact Data: Email addresses (used for login, email verification, password resets, session-feedback links and service notifications).
- Content Data: The text of the roleplay scenarios, character definitions, and prompts you author.
- Billing Data: For paid plans and practice-minute packs, your billing name and address and, where you provide them, an employer name or purchase-order reference. Card details are entered directly with our payment provider (Stripe) and are never stored by Zenobits.
- Sign-up Attribution: Which invite or cohort link, referral code or campaign (UTM parameters, referring page) you signed up through.
B. Data Generated During Roleplays (Learners and End Users)
- Interaction Data: Transcripts of the conversation between you and the AI character, produced by real-time speech-to-text.
- Audio Recordings: A recording of the practice session (your voice and the AI character’s voice) is captured in your browser and uploaded to our secure storage at the end of the session, so that you can replay it on your review page and share it with a coach or trainer if you choose to.
- Note: Audio recordings are automatically deleted 90 days after the session ends. Live audio streamed to the AI provider during the session is processed in real time and is not retained by the AI provider beyond the abuse-monitoring window described in Section 5.
- Performance and Feedback Data: Scores, coaching feedback, utterance-level coding and evaluation reports generated by the system, plus any self-assessment or reflection you type on the review page. In the MI Practice Lab, your pre-feedback self-ratings and written reflection are visible only to you (and to Zenobits administrators for support).
- Session Telemetry: Technical measurements of the session (connection quality, latency, audio dropouts, which AI model served the session) used to diagnose problems and maintain quality.
- CPD Records: If you issue a CPD record, we freeze the practice totals, session list, the name and registration details you enter, and any reflection you type into an immutable record. The public verification page for a record shows only the name, period and hours; it never shows your email, session list or reflection.
C. Technical Data
- Device Information: IP address, browser type, and operating system.
- Usage Logs: Timestamps of when roleplays are accessed, authentication attempts (for rate limiting and lockout), and a log of the automated emails we send you (recipient, email type, delivery status), to ensure service stability and security.
- Product Analytics (optional, consent-based): Where enabled, we use PostHog (EU Cloud) to understand how the Service is used. If you accept on the in-app banner, we may also record a masked session replay: the replay shows layout, clicks and scrolling, and every piece of rendered text is masked, so transcripts, feedback and personal details never leave your browser. If you decline, only anonymous, cookieless analytics are collected. Nothing is captured until you decide. The live voice practice page never records replay.
D. Website Data (zenobits.co.uk)
- Website Analytics: Our marketing website uses Google Analytics 4 only after you accept cookies on the banner, with IP anonymisation enabled. Your cookie choice is shared between the website and the app, so accepting or declining on either applies to both. If you have accepted, the app tells Google Analytics when you create an account or complete a purchase (the event, the plan and the amount, never your name or email address), so that the sign-up or sale can be attributed to the page you came from. If you decline, the app sends nothing to Google Analytics.
- Enquiry Forms: If you send us a trainer or pilot enquiry, the details you enter are delivered to us through a Google-hosted form endpoint and land in our Google Workspace mailbox.
- Advertising Pixels: Certain product-specific landing pages that we promote through paid advertising may load an advertising pixel from the advertising platform (for example Reddit Ads) to measure the campaign. Like Google Analytics, a pixel loads only after you accept cookies on the banner. Our core product pages do not use advertising pixels.
- Embedded Video: Some pages embed video via YouTube’s privacy-enhanced (no-cookie) player; YouTube receives your IP address when the video loads.
E. Uploaded Recordings (“Analyse a recording”, MI Practice Lab)
Where your organisation has the feature enabled, a learner or trainer can upload a recording of a real conversation (for example a supervised session with a client) to have the practitioner’s skills scored by our feedback models.
- The recording: an audio or video file you choose. Because these recordings usually come from health, care or other support settings, they are likely to contain special category data (such as information about someone’s physical or mental health) about the client and anyone else who can be heard.
- Consent confirmation: before anything is uploaded you must tick a box confirming that you have the explicit consent of everyone who can be heard. With each upload we record which version of that wording you accepted, when, and the IP address and browser (user agent) you accepted it from.
- Upload details: the file type (audio or video, and its extension), size and duration, the language and number of speakers you choose, which feedback model you choose and, for some models, whether the client is an adult or under 18. We do not store the file name.
- Transcript: the recording is transcribed with each speaker separated. You then mark which speaker is the practitioner and which is the client, and can exclude anyone else.
- Analysis: the scored part of the transcript, the feedback report and any notes added on the review page, as for a practice session.
How it is processed:
- The file is uploaded to private storage in Sweden. The audio track is extracted on our own servers, and the original file (including any video, and so any faces) is deleted as soon as the audio has been extracted.
- The audio is transcribed by Microsoft Azure AI Speech in Sweden. Microsoft does not store the audio or the transcript once the request completes, and no voice profile is created.
- The text of the scored part of the transcript (never the audio) is analysed by Anthropic’s Claude models, provided through Microsoft Azure AI Foundry (Section 5).
- Speech from anyone you exclude is transcribed with the rest of the recording but never analysed. It is deleted once the analysis is complete, and if you exclude anyone, no audio is kept with the report at all.
Uploaded recordings are treated as real-client work, not practice: they are not counted towards practice time or CPD records, are not included in any trainer practice statistics or survey, cannot be shared by link, and are not used for our internal quality dashboards.
4. How We Use Your Data & Lawful Basis
We only process your personal data when we have a legal basis to do so.
| Purpose | Lawful Basis (UK GDPR) |
|---|---|
| To provide the Service (hosting roleplays, streaming your voice to the AI character, generating AI responses, storing transcripts and recordings, generating feedback) | Performance of Contract |
| To manage your account (login, email verification, password resets, cohort enrolment, practice-minute balances) | Performance of Contract |
| To take payment and issue invoices, quotes and CPD records | Performance of Contract; Legal Obligation (financial records) |
| To send service emails (welcome, verification, feedback-ready links, low-balance notices, survey invitations for a programme you joined) | Performance of Contract; Legitimate Interests |
| To ensure security (fraud prevention, bot protection, abuse monitoring, safeguarding) | Legitimate Interests (and “Recognised Legitimate Interests” for safeguarding under DUAA 2025) |
| To improve our Service (quality scoring, debugging technical issues, aggregate analytics) | Legitimate Interests |
| Masked session replay and website analytics cookies | Consent |
| To analyse an uploaded recording (storing, transcribing and scoring it, and showing you the report) | For your own data, Performance of Contract. For the people heard in the recording, we act on your instructions as your Data Processor (see below) |
| To keep the consent confirmation for each upload | Legitimate Interests (being able to show that consent was confirmed for every recording we processed) |
Special category data in uploaded recordings: as the Data Controller for the people heard in a recording, you are responsible for having a lawful basis to share it with us and, for health or other special category data, a condition under Article 9 UK GDPR. The Service requires that condition to be the explicit consent of everyone who can be heard, which you confirm on every upload. We process that data only to provide the analysis you asked for.
5. Artificial Intelligence and Automated Processing
Transparency regarding AI is a core part of our commitment to you. The Service uses the following AI systems:
- Conversation and speech (Azure OpenAI Realtime API, provided by Microsoft): powers the interactive roleplay character. Your voice is streamed to Microsoft Azure in real time; Azure produces the character’s spoken reply and a text transcript of both sides of the conversation.
- Coaching and evaluation (Anthropic Claude models, provided through Microsoft Azure AI Foundry): during and after a session, the transcript is sent to a Claude model, which we access through our Microsoft Azure environment, to produce live coaching nudges, the utterance-level coding and the post-session evaluation report. The same models score the transcript of an uploaded recording. Claude models on Azure AI Foundry are offered by Anthropic, which acts as an independent data processor for the text sent to them under its own data processing terms.
- Transcription of uploaded recordings (Microsoft Azure AI Speech): converts the audio of a recording you upload into text and separates the speakers. It runs on our Azure resource in Sweden, and Microsoft does not store the audio or the transcript after the request completes.
- Optional synthesised voices (ElevenLabs): an author may explicitly choose an ElevenLabs voice for a scenario on the authoring platform. In that case only the AI character’s reply text is sent from your browser to ElevenLabs to be turned into speech. Your own voice recording and your side of the transcript are never sent to ElevenLabs, although the character’s replies may naturally refer to things you said. ElevenLabs processes that text under its own privacy policy on standard (non-enterprise) terms, and we cannot give the same no-training assurance for it that we give for Microsoft below. Scenarios that do not use an ElevenLabs voice (including every MI Practice Lab scenario) never contact ElevenLabs.
No Model Training
Microsoft does not use your prompts, completions, transcripts or audio to train its foundation models. Anthropic does not use the data sent to Claude models through Azure AI Foundry to train its models under its commercial terms. Zenobits itself never uses your data, including uploaded recordings, to train any model.
Abuse Monitoring & Retention
To prevent the generation of harmful content (e.g., hate speech, violence), Azure OpenAI may retain prompts and completions for up to 30 days in a secure environment.
- This data is encrypted and accessible only to authorized Microsoft engineers in the event of a flagged abuse incident.
- After 30 days, this data is permanently deleted.
Anthropic’s automated safety systems may flag content sent to Claude models for review, and Anthropic may retain prompts and outputs for a limited period for trust and safety purposes under its terms. Anthropic staff review content only on an exceptions basis, to investigate a potential safety violation.
Automated Decision Making
The AI provides feedback and scoring on a roleplay. These scores are generated to support your learning and reflection; they are not used by Zenobits to make decisions with legal or similarly significant effects on you. Users have the right to request a human review if they believe an AI-generated evaluation significantly impacts their educational or professional progress.
6. Data Residency and International Transfers
We have architected our system so that stored data remains within the European Economic Area (EEA). AI processing is a different matter and we want to be precise about it: our Azure AI deployments are Microsoft “Global Standard” deployments. Under that deployment type, data at rest (including the abuse-monitoring store described in Section 5) stays in the geography of our Azure resource, but Microsoft may route the live inference request itself to Azure data centres anywhere in the world to balance capacity.
Location of Data
| Component | Provider | Region | Status |
|---|---|---|---|
| Primary Database (accounts, transcripts, feedback, CPD records) | Microsoft Azure | Sweden Central | Data At Rest (Storage) |
| Audio Recordings | Microsoft Azure Blob Storage | Sweden Central | Data At Rest (Storage), deleted after 90 days |
| Live Voice AI Processing (Realtime API) | Microsoft Azure | Global Standard deployments on our Sweden Central resource, with an overflow resource in France Central (EU) used only when Swedish capacity is full. Inference may be processed in any Microsoft region | Processing |
| Coaching and Evaluation AI (Claude on Azure AI Foundry) | Anthropic, through Microsoft Azure | Accessed through our Sweden Central resource. Processing may take place outside the EU and UK, including in the United States | Processing |
| Uploaded Recordings (original file and extracted audio, before analysis) | Microsoft Azure Blob Storage | Sweden Central | Data At Rest (Storage), short-lived (Section 9) |
| Transcription of Uploaded Recordings | Microsoft Azure AI Speech | Sweden Central | Processing, nothing retained by Microsoft |
| Application Hosting | Render | Frankfurt, Germany | Processing (Compute) |
| Voice Relay (TURN) | Cloudflare | Global edge network, nearest location to you | Encrypted media relay, only when your network blocks a direct connection |
| Transactional Email | Resend | United States | Email delivery |
| Payments | Stripe | EU / United States | Payment processing |
| Product Analytics | PostHog | EU (Frankfurt) | Analytics (consent-based) |
| Email & Support | Google Workspace | Global | Communication |
International Transfers
While our primary infrastructure is in the EU/EEA, some subprocessors are US-headquartered, and Microsoft’s Global Standard AI deployments may process a request outside the EEA and UK. We ensure these transfers are legal under UK and EU law:
- Anthropic: transfers of the text sent to Claude models are covered by Anthropic’s Data Processing Addendum, which incorporates the EU Standard Contractual Clauses and the UK Addendum.
- Microsoft: transfers are covered by the Microsoft Products and Services Data Protection Addendum, which incorporates the EU Standard Contractual Clauses and the UK Addendum, and by Microsoft’s certification under the EU-US Data Privacy Framework and its UK Extension.
- UK-US Data Bridge: Where a provider is certified under the EU-US Data Privacy Framework and its UK Extension (the UK-US Data Bridge), we rely on that certification.
- Standard Contractual Clauses (SCCs) / UK IDTA: Where the Data Bridge does not apply, we rely on standard contractual clauses (with the UK Addendum) to guarantee the safety of your data.
- Voice relay: When your network blocks a direct connection, session audio may be relayed through Cloudflare’s nearest edge server. The audio is end-to-end encrypted between your browser and Azure (DTLS-SRTP); Cloudflare relays the encrypted packets and cannot listen to them.
7. Who Can See Your Session Data
- You: can replay your recording, read your transcript and feedback, and download your session history.
- Your trainer (MI Practice Lab): if you joined through a trainer’s cohort link, your trainer can see that you practised, when, and for how long. Your trainer cannot open your transcript, recording, score or feedback for a session unless you release that session to them from your history page. You can withdraw a release at any time.
- Coaches you share with: you can generate a time-limited share link for a session’s review page. Anyone holding the link can view that session until the link expires or you revoke it.
- Authors and organisations (authoring platform): for roleplays run on the authoring platform (including embedded roleplays on an organisation’s own site or LMS), the author and their organisation can review the transcripts, recordings and feedback of sessions run on their scenarios. End Users are informed of this before they begin.
- Uploaded recordings: only you can see an analysis you upload. Your trainer cannot see it, or even that it exists, unless you release it to them, and then they can see its transcript and report and hear any audio kept with it. You can withdraw a release at any time. Uploaded recordings cannot be shared by link, are not included when you release all your sessions at once, and are never visible to other members of your cohort or organisation.
- Zenobits staff: a small number of administrators can access session data for support, safety and quality purposes, under strict role-based access control.
If we email you a link to your own feedback (for example because you closed the browser before your report was generated), that link is a private, time-limited magic link to your own session. Keep it private.
8. Children’s Privacy (Age Appropriate Design)
Where the Service is used with children, we comply with the UK Age Appropriate Design Code (AADC).
- High Privacy by Default: Student accounts are set to high privacy settings by default.
- Data Minimization: We only collect the data absolutely necessary to run the roleplay. We do not use “nudge” techniques to keep students online longer than necessary.
- Teacher Supervision: Transcripts are visible to the teacher/administrator who assigned the roleplay. Students are clearly informed of this visibility before they begin.
- Uploaded recordings involving under-18s: if a person heard in an uploaded recording is a child, the uploader is responsible for obtaining consent from someone with the authority to give it (for example a parent or guardian) where the child cannot give it themselves, in line with their organisation’s safeguarding and consent policies. For some feedback models we ask whether the client is under 18; we use that answer only to set the scoring target.
9. Data Retention
- User Accounts: Retained until you delete your account or ask us to delete it.
- Audio Recordings: Automatically deleted 90 days after the session ends. A countdown is shown on the review page; after expiry the recording can no longer be replayed by anyone, including us.
- Transcripts, Feedback and Session Telemetry: Retained for as long as your account exists, so that your practice history and progress remain available to you, or until you ask us to delete them.
- CPD Records: Retained as an immutable record for as long as your account exists, so that the verification page continues to confirm what your printed copy says.
- Uploaded Recordings:
- Original file: deleted as soon as its audio has been extracted (at most 2 days after upload).
- Full extracted audio and full transcript (including the speech of anyone you exclude): deleted when the analysis completes, or 14 days after upload if you never complete it. An upload that fails, or is never finished, is deleted automatically.
- Audio of the scored part: kept for 90 days for playback, like a practice session. No audio is kept if you excluded anyone.
- Scored transcript and report: kept until you delete the analysis, which you can do at any time from the “Analyse a recording” page, or until your account is deleted.
- Consent confirmation and upload details (Section 3E, without the recording, transcript or report): kept after the analysis is deleted, as evidence that consent was confirmed, for up to six years.
- Email Send Log: The log of automated emails we sent you is deleted after 90 days.
- Abuse Logs (Azure): Retained for up to 30 days, then deleted.
- Billing Records: Invoices and payment records are retained for as long as UK tax law requires (currently six years).
- Backups: Our database provider (Azure SQL) keeps encrypted, automated point-in-time backups for a short rolling window (no more than 35 days) for disaster recovery. Deleted data may persist in those backups until the window rolls over, after which it is gone.
10. Your Rights
Under the UK GDPR and EU GDPR, you have the following rights:
- Right to Access: Request a copy of the data we hold about you. You can download your own session history at any time from the MI Practice Lab history page.
- Right to Rectification: Correct inaccurate data.
- Right to Erasure (“Right to be Forgotten”): Ask us to delete your data.
- Right to Restrict Processing: Pause how we use your data.
- Right to Data Portability: Get your data in a usable format.
- Right to Withdraw Consent: Change your analytics or session-replay choice at any time from the in-app banner or by clearing your browser’s site data.
If you were heard in an uploaded recording: the person who uploaded it (or their organisation) is the Data Controller for your data, so please contact them first to exercise your rights. If you contact us, we will pass your request to them and help them respond.
For International Users:
- California Residents (CCPA): We do not “sell” or “share” your personal data as defined by the CCPA. You have the right to know what information we collect and to request deletion.
11. Security
We use industry-standard security measures:
- Encryption: Data is encrypted in transit (TLS 1.2+, DTLS-SRTP for voice) and at rest (AES-256).
- Access Control: Strict role-based access to our production environment. Trainer access to learner sessions is enforced on the server, not just hidden in the interface.
- Short-lived credentials: Your browser only ever receives short-lived, single-use credentials for the AI voice connection and the voice relay; our provider API keys never leave our servers.
- Bot Protection: Login and sign-up pages may use Google reCAPTCHA to prevent automated abuse. reCAPTCHA is subject to Google’s Privacy Policy and Terms of Service.
- Vendor Vetting: We only use compliant, tier-1 cloud providers.
12. Subprocessors
We use the following third-party service providers to help us provide the Service:
| Subprocessor | Role | Location |
|---|---|---|
| Microsoft Corporation (Azure) | Database, audio and uploaded-recording storage, AI inference (Azure OpenAI Realtime), transcription of uploaded recordings (Azure AI Speech), and access to Anthropic Claude models on Azure AI Foundry | Storage and transcription in Sweden (EU), with a voice-AI overflow resource in France (EU); AI inference on Global Standard deployments may run in any Microsoft region |
| Anthropic, PBC | Claude models used for coaching, evaluation and the analysis of uploaded recordings (receives transcript text, never audio), provided through Microsoft Azure AI Foundry | United States / may process outside the EU and UK |
| ElevenLabs, Inc. | Optional synthesised character voices, only on scenarios where the author has chosen one (receives AI reply text only; standard terms, see Section 5) | United States |
| Render Services, Inc. | Application Hosting | Germany (EU) |
| Cloudflare, Inc. | Encrypted voice relay (TURN) for restricted networks | Global (US HQ) |
| Resend, Inc. | Transactional email delivery (verification, password reset, feedback links, notices) | United States |
| Stripe, Inc. / Stripe Payments Europe Ltd | Payments, invoices and subscription management | Ireland / United States |
| PostHog, Inc. | Product analytics and masked session replay (consent-based) | EU Cloud (Germany) |
| SurveyMonkey (Momentive) | Post-session evaluation surveys for partner training programmes you have joined. The survey link carries a pseudonymous participant code, not your email | United States |
| Google LLC | Google Workspace (email and customer support), Google Analytics on our website (consent-based), reCAPTCHA (bot protection), Google Fonts and enquiry-form delivery | Global (US HQ) |
We will update this list when we add or replace a subprocessor.
13. Contact Us
If you have any questions about this policy, or if you wish to exercise your rights, please contact our Privacy Lead:
- Email: info@zenobits.co.uk
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) in the UK (www.ico.org.uk).