Privacy Policy

1. What we collect

We collect four narrow categories of information.

• Information you give us. When you request a demo or email us, we receive your name, work email, company, role, employee-count range, a phone number if you choose to give one, and anything you write in the message field. The demo form does not store submissions in a database — it forwards them to our email. If you become a customer, we also hold the business contact details we need to invoice you.
• Training records. What we receive depends on how the training reaches you.
  • Delivered as a SCORM package into your employer’s own learning system, we typically receive nothing at all. Their system holds the roster and records who completed what. We see it only if your employer chooses to send us a report.
  • Delivered on a learning platform we provide, we process the roster fields needed to assign and track training — name, work email, department, and location, plus employee ID where a customer asks us to carry it — along with which videos each learner started and completed, and how far they got.
• Business contact information we obtain from a vendor. We use a third-party business contact database — currently Apollo.io — to identify people in HR, benefits, and advisory roles who may want to hear from us. From it we obtain workplace contact details: name, job title, employer, work email address, and sometimes a work phone number or a LinkedIn profile URL. You did not give us any of this, and you may never have heard of us before we wrote to you. Apollo compiles it from public and commercial sources; their own privacy notice describes how.
• Technical information. Our website host keeps standard server logs: IP address, browser type, pages requested, and timestamps. We also use our host’s own privacy-preserving analytics to count visits to this site. It sets no cookies and cannot follow you to any other website. What it records is the page you viewed, the site you arrived from, your approximate location, your browser, operating system, and device type — never your name, your email address, or anything that identifies you personally. We also use two Google tools. Google Analytics measures how people use the site — which pages they read, how far they scroll, and whether they start or submit the demo form. Google’s advertising tag measures whether a visit from one of our ad campaigns leads to a demo request. Unlike our host’s analytics, both set cookies, and Google Analytics can recognize your browser on a return visit. Section 5 explains all three in full.

Not all of this comes from you directly. If you are a learner, your employer supplies your details; you never hand them to us. We may also receive an employer’s contact information from a benefits advisor introducing us, or from a colleague at your organization.

Business contact information is the only personal information we obtain from a data vendor. We do not buy consumer or household data, information about anyone’s health, finances, or family, or anything about you outside your professional role. We do not enrich learner or customer records with purchased data, and we do not build behavioral profiles.

If you would rather we did not hold your contact details, say so and we will delete them and stop writing. Section 8 explains how.

2. What we don't collect

3. How we use it

We use the information above to deliver and support the training, report completion to the employer that purchased it, respond to your inquiries, keep the service secure, meet our legal obligations, measure how our advertising performs, and improve the courses — for example, by seeing in aggregate where learners stop watching.

We use Google Ads to see, in aggregate, when a demo request follows a visit from one of our ad campaigns. We do not use it to build advertising audiences from our site visitors.

We use business contact details to introduce Simba to people whose work involves employee benefits — including people who have not contacted us first. Every message we send identifies us, and every message includes a way to unsubscribe. Unsubscribing has no effect on training you have been assigned.

We do not use purchased contact data for anything other than contacting that person about Simba.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

We do not use learner or customer information to train artificial intelligence models.

4. Who we share it with

We share information with the employer or benefits advisor that purchased the training, with the service providers that process data on our behalf under contract, and where required by law or to protect our rights. If we are ever involved in a merger or acquisition, information may transfer as part of that transaction.

Today those service providers are our website host, our business email provider, our accounting and invoicing provider (currently Intuit QuickBooks, which handles customer billing and card payments), and the sales outreach platform we use to manage contacts and send those emails (currently Apollo.io, which is both the source of the contact data described in Section 1 and the tool we send from). Where we supply a learning platform to a customer who does not have their own, that platform vendor processes learner data on our behalf under contract. Our website analytics are partly provided by that same host as a built-in feature. We also use Google Analytics, so Google receives technical information about your visit. We do not use a third-party video host. We use Google Ads to measure the performance of our ad campaigns, as described in Sections 1 and 5; Google receives the technical information in that cookie when you visit from one of our campaigns or submit the demo form afterward.

With the exception of Google, the service providers above process and store your information in the United States. Google operates globally, and its own policies govern where it processes the analytics and advertising data described here. We require United States data residency of any learning platform vendor we engage.

A current list of our subprocessors is published at simbahealth.com/subprocessors. That page covers the providers that handle training records on our behalf. The vendors described above that we use only for our own outreach and site analytics are not subprocessors of training data, and that page explains the distinction.

5. Cookies, tracking, and other sites

We use the cookies necessary for this site to function, plus three more: two set by Google Analytics and one set by Google Ads, both described below. We do not embed third-party media players.

Analytics cookies. Google Analytics sets cookies — “_ga” and a second one tied to our property — holding a pseudonymous identifier. It uses them to tell one browser from another, so it can count people rather than page loads and recognize a return visit. It records the pages you view, how far you scroll, and whether you start or submit the demo form. We use it to understand how the site is used. We do not use it to build advertising audiences, and we do not combine it with learner or customer records.

Advertising cookie. When you arrive from one of our Google Ads campaigns, Google sets a cookie (“_gcl_au” and related identifiers) so that, if you later submit our demo form, we can measure that the campaign led to a lead. We use this only to measure conversions — we do not use it to build advertising audiences from our site visitors, and we do not combine it with learner or customer records. Google’s own privacy policy governs its handling of this data.

We also count visits using the analytics built into our website host, which works differently. It is designed to work without identifying anyone. It sets no cookies and stores nothing on your device. Instead of a lasting identifier, it derives a value from your request that is discarded after 24 hours, which is why it can tell us roughly how many people visited without ever knowing who they were, and why it cannot recognize you on a return visit or follow you to another website.

Each recorded visit holds the page you viewed, any campaign or tracking parameters attached to the link you followed, the site you came from, an approximate location derived from your network connection — country, region, and city, never a precise position — your browser, operating system, and device type, and the time. We look at it in aggregate — which pages people read, what brought them here — not to build a picture of any individual. We do not use our host analytics for advertising, and we do not combine it with learner or customer records.

Because we do not sell personal information and do not “share” it for cross-context behavioral advertising, there is nothing today a Global Privacy Control or similar signal would opt you out of. If that changes — for example, if we begin building advertising audiences from site visitors — we will add an opt-out here and honor Global Privacy Control. Some browsers also send a Do Not Track signal. That signal was built to stop the kind of tracking that follows a person from site to site to build a behavioral profile. Our advertising cookie measures whether a campaign led to a demo request, not that — so there is nothing further for us to change in response to it.

Where we supply a learning platform, that platform sets its own cookies to keep learners signed in and to record progress. Those are necessary for it to work.

This site may link to pages we do not operate. Those sites have their own privacy practices and we are not responsible for them.

6. How long we keep it

• Completion records. We keep them for the term of the customer’s agreement. Where training runs inside a customer’s own learning system, retention is governed by that system and their policy rather than ours.
• Demo and inquiry correspondence. We keep it while we are in contact with you about your inquiry and for a reasonable period afterward. We delete it sooner if you ask.
• Website analytics. Our host retains aggregate visit data for a rolling window — currently twelve months — and it holds no identifier, so there is nothing in it to associate with anyone. Google Analytics retains event-level data for two months, after which only aggregated reporting remains. Neither is linked to a name, an email address, or any account.
• End of an agreement. When a customer’s agreement ends, we delete learner data from our production systems on request, and in any event within 60 days. Before that deadline a customer can ask us to export its completion records, so it keeps its own copy of who completed what. Anything held in routine backups is deleted on the ordinary backup cycle, and we keep only what the law requires us to keep.

7. Security

We serve this site over HTTPS, and the data we hold is encrypted at rest by our hosting provider. Access to personal information is limited to the people who need it for their work.

We do not maintain a learner database of our own. Training records live either in the customer’s own learning system or, where we supply the platform, with that platform vendor under contract.

No system is perfectly secure, and we cannot guarantee absolute security.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of the personal information we hold about you, to opt out of certain processing, and to appeal a decision we make about your request. The exact rights vary by state. We will not discriminate against you for exercising them.

Some state laws also give you the right to limit how a business uses sensitive personal information. We do not collect any, as Section 2 explains, so there is nothing here to limit.

Analytics and advertising data are harder to reach, and we would rather be precise than reassuring about why.

Our analytics generally do not identify you to us by name or email address. Our host’s analytics hold no identifier at all, so there is nothing in them that could be matched to you. Google Analytics works differently: it uses cookies holding a pseudonymous identifier to tell browsers apart and measure how people move through the site. We generally cannot connect that identifier to a person, so if you write to us with your name or email address, we may not be able to find the analytics records that came from your browser. Where applicable law requires us to honor a request about information we can reasonably identify as yours, we will do so. Section 5 explains what each of them records.

The advertising cookie is similar. We do not receive anything from Google Ads that identifies you personally merely because you visited this site. Google provides its own controls — My Ad Center — where you can manage advertising preferences directly with them.

This section covers information we hold in our own right — chiefly site visitors and people who contact us. If you are a learner taking Simba training, Section 9 applies to you instead.

To make a request, email legal@simbahealth.com. We may need to verify your identity before acting, and we will respond within the time the law allows. You may use an authorized agent, and we may ask that agent for proof of authority. We may decline a request that is excessive, repetitive, or manifestly unfounded, and if we do we will tell you why.

You can unsubscribe from our email using the link in any message, or by replying and asking. If we obtained your details from a business contact database rather than from you, the same request works: tell us and we will delete your record.

One honest caveat. To make sure a deleted contact is not re-imported the next time we pull a list, we keep the minimum needed to suppress you — normally your email address alone, on a do-not-contact list used for nothing else. If you would rather we kept nothing at all, tell us and we will remove that too, though we cannot then guarantee you will not reappear in a future list.

9. Employees and employers

If you are taking Simba training through your employer, your employer decides what training to assign and who may see your completion records. Where we hold that data at all, we process it on their instructions — in the language of California’s privacy law, as their service provider, rather than as a business acting for our own purposes.

In many cases we hold nothing about you. When training runs inside your employer’s own learning system, your records stay there and never reach us.

Requests about your training records are best directed to your HR or benefits team. If you come to us first, tell us which organization you took the training through so we can route your request, and we will let them know you asked.

Your employer’s own privacy and security practices are their own, and may differ from what this policy describes. We are not responsible for them.

10. Minors

Our training is made for people at work, and the only learner records we hold are the ones an employer gives us about its own workforce. We do not market to children, and we do not knowingly collect personal information from members of the public who are minors.

Employers do sometimes employ people under 18. Where a customer’s roster includes them, we process those records on the employer’s instruction on exactly the same terms as any other employee record, and we collect nothing additional because of a learner’s age. We do not ask anyone for a date of birth.

11. Changes to this policy

If we make a material change, we will update the date at the top of this page.

Where a customer has signed an agreement with us, the data protection terms in that agreement continue to govern for the rest of its subscription term, and changes to this page apply to that customer from the start of its next renewal term. Our Terms of Service describe how that works.

12. Contact us

Email legal@simbahealth.com.