Privacy notice
Last updated: 30 October 2026
With this notice, Bielefeld University fulfils its duties under Articles 13 and 14 of the General Data Protection Regulation (GDPR) for the website virtualsp.de: which personal data is processed when you visit the pages and use the live demo, for what purpose, on which legal basis, for how long, and which rights you have. The terms “personal data”, “processing”, “controller” and “processor” are used as defined in Article 4 GDPR.
It applies to the public website at virtualsp.de in both languages and to its preview at stage.virtualsp.de. It does not apply to the VirtualSP application that teachers and students use after signing in; that application has its own privacy policy, which you will find on your institution’s sign-in page and inside the application.
1. Controller
The controller within the meaning of the GDPR is Bielefeld University, a public-law corporation with legal capacity maintained by the State of North Rhine-Westphalia, represented by its Rector.
Universität Bielefeld
Universitätsstraße 25
33615 Bielefeld, Germany
Phone: +49 521 106-00
E-mail: post@uni-bielefeld.de
Responsible unit
Medizinische Fakultät OWL, Simulation and Communication Lab (SCoLa)
Dr. med. Anja Bittner
E-mail: anja.bittner@uni-bielefeld.de
Phone: +49 521 106-67420
Data protection officer
Data Protection Officer of Bielefeld University
By post via the university address
Phone: +49 521 106-5225
E-mail: datenschutzbeauftragte@uni-bielefeld.de
2. Principles
This website presents VirtualSP, a practice environment of the Medical School OWL for clinical communication, and lets you try a conversation with a virtual simulated person yourself in a short demo. For providing the pages, the legal basis is Article 6 (1) (e) GDPR in conjunction with Section 3 (1) of the North Rhine-Westphalia Data Protection Act (DSG NRW) and Section 3 of the North Rhine-Westphalia Higher Education Act (HG NRW): informing the public about the university’s research and teaching. You use the live demo only with your consent.
The website uses no analytics, tracking or advertising services and loads no third-party content: no fonts, scripts, maps or videos from other servers. The pages are generated when the website is built and can be read without JavaScript. There is no registration and no mailing list. No profiling takes place, and no automated decisions within the meaning of Article 22 GDPR are made. Data is passed on only to the service providers named below, and only as described there.
3. Visiting the website
Access data
Each time a page is requested, the server necessarily processes connection data: the IP address of your device, date and time, the address requested, the address of the page you came from if your browser sends it (referrer), your browser identifier (user agent), the status code of the response, the amount of data transferred and the processing time. This information is kept in the server’s system log and serves operational security, troubleshooting and the defence against attacks. It is not evaluated to trace your behaviour and is deleted after 14 days at the latest. The legal basis is Article 6 (1) (e) GDPR in conjunction with Section 3 DSG NRW and the duty to ensure the security of processing under Article 32 GDPR.
To protect against overload, the server counts requests per IP address in memory for a short time; for the live demo, this means at most 20 confirmations and three conversation starts per hour. Nothing of this count is stored.
Cookie and local storage
The website sets no cookie for reading its pages. If you choose a colour scheme in the footer (light, dark, as the system), your browser remembers this choice in local storage under the name “vsp-theme”; the entry never leaves your device. The language is part of the page address and is not stored.
For the live demo there is one cookie: “__Host-vsp_demo”. It is set only when you confirm the notice before the conversation, not when you open the home page. It contains a random identifier signed by the server, without any reference to you as a person, is protected against access by scripts, is only transmitted encrypted and expires two hours after it is set. The server needs it to link your confirmation to the conversation you start right afterwards and to make sure that only one conversation per guest runs at a time.
A second cookie exists for the presentation for universities at “/en/presentation”, which can only be opened with a PIN: “__Host-vsp_praesentation”. It is set only when you enter the correct PIN. It contains the time at which it expires and a signature by the server, but no identifier and no reference to you as a person; it is protected against access by scripts, is only transmitted encrypted and expires twelve hours after it is set. It lets the server recognise that the PIN was entered in your browser. To prevent guessing, the server counts entries per IP address in memory for a quarter of an hour; nothing of this count is stored. If you deselect slides in the presentation’s overview, your browser remembers their names in local storage under “vsp-praesentation-folien” until you choose “Show all”; this entry does not leave your device either.
The colour scheme, the slide selection and both cookies are strictly necessary for the function you explicitly requested (Section 25 (2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG); no consent is required, which is why there is no cookie banner.
4. What happens in the live demo
On the home page you can have a short conversation with a virtual simulated person, provided the demo is enabled. You take the role of the physician; the simulated person is played by an AI language model that listens in real time and answers with a synthetic voice. The case is fictional and contains no data of real persons. A conversation lasts at most two minutes and also ends by itself when nobody speaks for 20 seconds; the server enforces both. You are talking to an artificial intelligence, not to a human; the website says so before every conversation (Article 50 of the AI Act, Regulation (EU) 2024/1689).
How it works
Whoever taps “Try an AI conversation” or “Call” first sees the notice “Before you start”. Processing begins only with “I agree”: the server sets the cookie mentioned above, your browser asks you to allow microphone access, and then it establishes the connection. With “Cancel” you return to the page without anything having been transmitted.
Your voice and the transcript
Your voice is transmitted from your browser to OpenAI over a direct, encrypted connection (WebRTC), where the language model listens, generates a transcript and answers. Because the connection is direct, OpenAI receives the IP address of your device and technical connection data. Our server sends OpenAI the role script of the simulated person and instructions for conducting the conversation; it knows nothing about you and sends nothing about you. Whatever you say during the conversation is transmitted, however. Therefore do not mention real names, details about yourself or your own health data; the conversation needs none of it. Your voice is not used to identify or recognise you.
Over a second connection, our server receives the transcript and events about the course of the conversation from OpenAI. It needs them to direct the simulated person and to show you the conversation as text. It keeps transcript and events in memory only while the conversation is running and discards them one minute after it ends. They are not stored in the database; whoever leaves the page no longer has the transcript. The server log records the start, end and errors of a conversation, but no spoken content. The audio is not recorded, neither by us nor by OpenAI (see “Service providers and recipients”).
What remains of a conversation
For each conversation the server stores a record: the scenario shown, with title and version, the session identifier at the provider, the version of the notice you confirmed with the time of confirmation, start and end, the seconds charged and the reason the conversation ended; plus the random identifier from the cookie, so that only one conversation per guest runs at a time. At the end, an entry is also made in the internal log with reason and duration, without reference to any person. No IP address, no name, no transcript, no audio. From this record the server counts the demo’s daily budget and the usage at the provider; it is accessible only to the university’s platform administration. The legal basis is Article 6 (1) (e) GDPR in conjunction with Section 3 DSG NRW (cost control and security of the service). Once the cookie has expired, an entry can no longer be attributed to any person. The record is deleted at the latest under the deletion policy that becomes binding when regular operation begins.
5. Your consent to the live demo
The processing of your voice and the transcript in the live demo, including the transfer to OpenAI in the United States (see “Service providers and recipients”), is based on your consent (Article 6 (1) (a) GDPR). You give it by confirming the notice “Before you start” with “I agree”. The notice states in three sentences what happens; everything else is set out here. The server records the version and time of your confirmation with the conversation’s record (Article 7 (1) GDPR).
Consent is voluntary. Without it you cannot use the demo; otherwise saying no has no consequences, and the rest of the website remains open to you just the same. You can withdraw your consent at any time with effect for the future (Article 7 (3) GDPR), most simply by hanging up or leaving the page: processing then ends, and because nothing of the conversation is kept, there is nothing left to delete afterwards. You can also revoke microphone access in your browser. The demo is intended for adults and not for children.
6. Contact via the forms
On the “Teaching” page you can request trial access; on the “Research” page, a collaboration. Both forms collect the same details: your name, e-mail address, university or institution, subject or field, and your description of what you are asking about. Nobody has to make a request; anyone who does has to provide these details, because otherwise we can neither reply nor set up anything suitable. The legal basis is Article 6 (1) (e) GDPR in conjunction with Section 3 DSG NRW and Section 3 HG NRW: initiating cooperation in teaching and research is among the tasks of a university. Unlike the live demo, we do not ask for your consent here — by sending the form you decide for yourself whether to write to us.
Your details go into two e-mails: a notification to our contact address and a confirmation to you. No account is created, and the request is not stored in a database. It remains in our outbox as a sent message until that discards it after delivery, and after that in the mailboxes of those involved — that is, for as long as e-mails are usually kept there.
The forms contain a field that is invisible to you and that people cannot fill in. If it is filled in nonetheless, we discard the request without sending any mail; this detects automated submissions without our passing data to a third-party service. We also limit the number of requests per IP address; the count is kept in memory, and nothing is stored.
7. Contact by e-mail
The website lists the e-mail addresses of its contact persons. If you write to us directly, your address, the content of your message and the time are processed in Bielefeld University’s e-mail system in order to answer your enquiry. The legal basis is Article 6 (1) (e) GDPR in conjunction with Section 3 DSG NRW and Section 3 HG NRW. Messages are kept for as long as necessary to deal with your enquiry and are deleted in accordance with the university’s retention rules.
8. Links to other websites and information about persons
The pages link to third-party services, such as the university’s directory of persons and publications via doi.org. Nothing is loaded from them while you read. If you follow a link, the destination learns at most that you came from virtualsp.de, not from which page; the privacy notice of the respective provider then applies.
The “Team” page and the footer show the name, function, work e-mail address and phone number of staff members, with a portrait where available. This information comes from the university’s directory of persons, is maintained there by the persons themselves and is copied when the website is built; a portrait appears only if the person has released it in the directory. The legal basis is Article 6 (1) (e) GDPR in conjunction with Section 3 DSG NRW and Section 18 DSG NRW.
9. Service providers and recipients
Hosting
The website and the demo server run on a virtual machine of IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, in the Berlin data centre. The database is reachable only from the machine itself; all external connections are encrypted. A backup of the database, and thus of the demo records, is made daily and kept for seven days. A data processing agreement under Article 28 GDPR is in place with IONOS.
Mail delivery
We send the mail of this website through AhaSend, a service of Aha Labs Inc. with servers in the European Union. Transmitted are the recipient address, the subject and the content of the message as well as technical delivery reports; AhaSend processes them solely in order to deliver the mail. A data processing agreement under Article 28 GDPR is in place with the provider. We delete the content of a sent message from our outbox after delivery; what remains is the note that and when it was delivered.
Language model (live demo only)
For the live demo we use the OpenAI API; the contracting party for customers in the European Economic Area is OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. Processing takes place on servers in the United States, i.e. in a third country for which no adequacy decision of the European Commission covers this provider. The transfer is based on OpenAI’s data processing addendum including the European Commission’s standard contractual clauses (Article 46 (2) (c) GDPR); you can obtain a copy from the responsible unit named above. Please note that access to the data by public authorities in the United States cannot be ruled out and that you do not have the same legal remedies there as in the European Union.
OpenAI receives your voice, the transcript generated from it, the IP address of your device, the role script of the simulated person and the instructions for conducting the conversation; no names or contact details reach OpenAI, because we know none. Demo conversations are not stored at OpenAI (setting “store: false”); there is no recording and no retrievable session there. According to OpenAI, API inputs and outputs are retained for up to 30 days for abuse monitoring and are not used to train models.
Other recipients
Data is not disclosed to any other third parties unless we are legally obliged to do so.
10. Your rights
Towards Bielefeld University you have the right of access to the data stored about you (Article 15 GDPR), to rectification (Article 16), to erasure (Article 17), to restriction of processing (Article 18) and to data portability (Article 20). Where processing is based on Article 6 (1) (e) GDPR, you may object to it at any time on grounds relating to your particular situation (Article 21 GDPR). You may withdraw any consent given at any time with effect for the future (Article 7 (3) GDPR). To do so, contact the responsible unit or the data protection officer, both named above.
When you visit the website and use the demo, we store nothing that identifies you as a person: the access data carries only an IP address and is deleted after 14 days, the demo record only a random identifier. We cannot identify you in it (Article 11 GDPR). If you nevertheless wish to exercise your rights, tell us what allows an attribution, for example your IP address and the time of your visit.
You also have the right to lodge a complaint with a supervisory authority (Article 77 GDPR). The authority responsible for Bielefeld University is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
(State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia)
Kavalleriestraße 2–4
40213 Düsseldorf, Germany
Phone: +49 211 38424-0
E-mail: poststelle@ldi.nrw.de
Web: www.ldi.nrw.de
11. Changes to this notice
This notice describes the state of the website as of the date given above. When functions that process personal data are added, it will be updated before they are enabled. The current version is always available at this place.