Privacy Policy

Precision Nursing ("we," "us," "our") provides online exam preparation for nursing and allied-health certifications. This Privacy Policy explains what personal information we collect, how we use it, and the choices you have. Precision Nursing is the data controller for the personal data described here; you can reach us at [email protected]. How we use cookies is covered in our Cookie Policy.

1. Information we collect

We collect four categories of information:

• Account data: your name, email address, and the exam track you select during onboarding. Passwords are managed by our auth provider (Better Auth) and are never stored by us in plain text.
• Profile data: optional info you provide during onboarding, including your study stage, target exam date, weekly study goal, and timezone.
• Study activity: answers you submit, time spent per question, scores, notes, bookmarks, and your study streak. This drives your analytics and personalised recommendations.
• Approximate location: see "Location data" below.

2. Location data

We use your IP address to estimate your approximate location (country, state/province, and city) for analytics and service improvement. We do not store your raw IP address, only a daily-rotating hash that cannot be reversed to identify the IP itself.

Location is captured on a passive, best-effort basis:

• Lookup happens at most once per 24 hours per account, not on every request.
• Lookup only runs when you sign in, never when you are signed out.
• Accuracy is approximate (the "general area", often a regional centre); it is not precise enough to identify a street or neighbourhood.
• If lookup fails for any reason, we silently skip it: no fields are written and your visit is unaffected.
• You can wipe these fields at any time by deleting your account (Section 6).

3. How we use it, and our legal basis

Under the GDPR and UK GDPR we must have a legal basis for each use of your data:

• Performing our contract with you: creating and running your account, the practice, analytics, and study-plan features, taking payment, and sending transactional emails (verification, password reset, receipts, security alerts).
• Our legitimate interests: keeping the service secure and preventing abuse and fraud; debugging and monitoring errors; and using approximate location to understand where our users are (for example, California vs. Ontario) so we can prioritise region-specific content. We have balanced these interests against your rights; you can object at any time (Section 6).
• Consent: optional cookies and device storage, according to the choice you make in our cookie banner. You can withdraw it at any time through "Cookie settings" (see our Cookie Policy).
• Legal obligation: keeping tax and accounting records, and responding to lawful requests from authorities.

Your email address is required to create an account; without it we can't provide the service. Everything else in your profile is optional.

We do not sell your personal data, we do not use it for advertising, and we do not use your practice content to train third-party AI models. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects; study recommendations are automated but only suggest what to practise next.

4. Third-party processors

We share data only with vendors that help us operate the service. Each is bound by a data-processing agreement and may only use your data on our instructions:

• ipinfo.io: receives your IP address at request time to return an approximate country / region / city. We do not send your name, email, or account ID.
• Stripe: payment processing, billing, and invoices. Card details are entered directly with Stripe and never touch our servers.
• Resend: delivery of transactional email (receipts, password resets, support replies).
• Sentry: error and performance monitoring. Error reports contain technical details (browser, page, stack trace) and are configured not to include your name, email, or cookies.
• Our cloud hosting provider, for running the application servers and database.

If you choose Sign in with Google, Google shares your name, email, and profile picture with us, and Google's own privacy policy applies to its side of that sign-in.

We may also disclose information if compelled by law (subpoena, court order) or to protect the rights, property, or safety of Precision Nursing, our users, or the public.

5. International transfers

Some of the processors above are based in, or store data in, the United States and other countries outside the EEA and UK. Where that happens we rely on the EU–US Data Privacy Framework (and its UK extension) where the provider is certified, or on the European Commission's Standard Contractual Clauses (with the UK Addendum) otherwise. You can ask us for a copy of the relevant safeguards at the address below.

6. Your rights

If you are in the EEA or UK (and in many other places), you have the right to:

• Access your data and get a copy of it.
• Portability: receive your data in a machine-readable format. You can download it yourself at any time from Account Settings → Download my data.
• Rectification: correct inaccurate data (most of it is editable in Account Settings).
• Erasure: delete your account and data (see below).
• Restriction: ask us to pause using your data while a concern is resolved.
• Objection: object to any use based on our legitimate interests, including location analytics.
• Complaint: lodge a complaint with your local data-protection authority (in the UK, the ICO).

You can delete your account at any time from Account Settings → Delete Account. Deletion runs on a 30-day grace period: your account is immediately marked for deletion and you may cancel any time before the 30 days elapse simply by signing back in and choosing "Keep my account". After 30 days, your account, sign-in details, profile, study activity, and location fields are permanently erased.

For any other request, email us at [email protected]. We respond within one month and may ask you to confirm your identity first.

7. Retention

We keep your account, profile, and study activity for as long as your account exists. When you delete your account, it is permanently erased once the 30-day grace period ends. Payment and invoice records held by Stripe are kept for as long as tax and accounting law requires (typically seven years). Error reports in Sentry expire automatically under Sentry's retention limits.

8. Security

Data is encrypted in transit (TLS 1.2+) and at rest. Sign-in passwords are hashed by Better Auth using industry-standard algorithms. Access to production data is limited to engineers who need it for support or operations and is logged. We never log raw email addresses, passwords, JWTs, or IP addresses, only masked or hashed values.

9. Children

Precision Nursing is intended for users 16 and older. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Changes

We may update this Policy from time to time. Material changes, including any expansion of the data we collect, will be announced by email or an in-app notice at least 14 days before they take effect.

11. Contact

Questions about this Policy or your data: [email protected].