Privacy policy

RN PocketPal is operated by Charles Enterprises, LLC, a Maryland limited liability company (“RN PocketPal,” “we,” “us”), which is the data controller for the Website (rnpocketpal.com) and the iOS app. The Android app on Google Play is published by Tech Genius Solutions Ltd, a separate legal entity, which is the data controller for personal data collected through that app; the two act as joint controllers for the shared cloud-backed features described below, apply this single policy, and answer privacy requests through the same contact points. Our mailing address is 9230 Wainwright Lane, Waldorf, MD 20603, USA. Controlled data includes what you provide through the Website and the App (together, the “Service”), plus cloud-backed features such as Marketplace, support, AI requests, product analytics, and optional rhythm-strip contribution.

The NCLEX-RN course is sold by NurseSuite LLC, a Maryland limited liability company, which is the controller for course subscription data (section 2). It applies this policy and answers privacy requests through the same contact points.

If you are in the European Economic Area or the United Kingdom, you can contact us at the email address in section 14.

We collect only the data we actually need to operate the service. There is no analytics SDK, no advertising network, no tracking pixel. The full list:

From the Website

• Beta signup form — email address, role (e.g., RN, LPN, Student), specialty (e.g., Telemetry, ICU), optional biggest-pain and launch-platform preferences, first-party campaign/UTM fields from the link you clicked, and an SHA-256 hash of your IP for rate-limiting only. We never store the raw IP.
• First-party website analytics — page views, CTA clicks, App Store / Google Play outbound clicks, and signup-state events tied to a random browser install ID and campaign fields. This is opt-in: nothing is stored in your browser or sent to us until you choose “Allow analytics” on the consent banner, and you can withdraw at any time from the Cookie Policy. No third-party analytics SDK, ad pixel, cookie sync, or user-entered clinical text is ever collected.
• Support form — email address, the subject and description of your support request, and the same IP-hash rate-limit. Do not include PHI. We auto-redact patterns that look like SSNs, MRNs, dates, and phone numbers before storing or emailing, but redaction is not a substitute for removing identifiers before submission.
• Server logs — your IP address may appear in standard webserver access logs (LiteSpeed access logs at our hosting provider) for security and abuse-prevention purposes. These logs are not used for tracking.
• NCLEX-RN course subscription — if you subscribe to the course, you pay on Stripe’s checkout page, which collects your card or other payment details, your email address and the billing details it needs (see section 5). We never see your full card number. We receive and keep a record of your subscription: your RN PocketPal account ID, Stripe’s customer and subscription reference numbers, its status (for example on trial, active or cancelled), the trial-end and renewal dates, and the price and currency. Stripe also passes us the email address you enter at checkout, which we use to send your subscription confirmation and, for the monthly plan, your renewal reminders. We use the record to give you access, to let you cancel, to handle disputes, and to meet tax rules.
• Renewal reminders, pauses and refund requests — For the monthly plan, we email you 3 days before each charge, at the email address on your subscription. If you pause, we keep the pause dates. If you ask for a refund, we keep the request (your account ID, the date, the payment it covers, and whether we approved it) and Stripe's refund record. We use these to process the request, to apply the once-per-account limit, and to meet tax and accounting rules.
• Course access and progress — the course uses the same Apple or Google sign-in as the App. When you open a lesson, our server checks your enrollment and gives your browser a video link that is tied to your account ID and expires after two hours. To stop abuse it records each lesson request with your account ID and a one-way hash of your IP address, never the raw IP. Which lessons you have marked complete is saved in your browser, on that device, and is not sent to us. So is your flashcard schedule: which cards you have studied, how you rated them and when each one comes back. So are the NCLEX-RN practice cards you save: the question prompt, its takeaway or rationale or Penny’s answer, any note you add, and when each card comes back.
• Penny in course lessons (formerly the lesson assistant) — if you ask Penny about a lesson, our server sends your question, your last few questions and answers on that lesson, and the lesson’s text to Anthropic to write the answer (see section 5). The first time, Penny asks your permission, naming Anthropic, and remembers your answer in your browser. We don’t store your questions or the answers. To enforce Penny’s limits we keep only a record that you asked, with your account ID, the time and a one-way hash of your IP address. Don’t type patient information. If a message looks like it has patient details, Penny doesn’t send it.
• Penny, the AI nursing tutor, on practice questions — you can ask Penny about a question on the free practice questions page or in your NCLEX practice exam review. You need to be signed in with Apple or Google.
  • What we send to Anthropic. To write each answer, our server sends Anthropic (see section 5) your message; your last few messages and Penny’s replies about that question; the practice question, with its answer choices, the correct answer and its rationales (for a case study, the case details and chart too); and the answer you chose. We don’t send your name, your email, your account ID or your IP address.
  • Permission. The first time, Penny asks your permission and names Anthropic. Your browser remembers your answer.
  • What we store. We don’t store your messages or Penny’s replies. For each turn we keep one record: your account ID, the question’s ID, which kind of help you asked for (for example “explain”), whether it worked, and the time. We use these records to count your free turns and to see how Penny is used.
  • Free limit. Without course access you get 3 turns with Penny in any 24 hours, in total, on practice questions and free preview lessons. Course students get Penny’s course limits instead.
  • Patient details. Don’t type patient information. If a message looks like it has some, such as a room number or a date of birth, Penny doesn’t send it. She asks you to rephrase.
  • Not clinical advice. Penny is an AI tutor for exam study. Her answers aren’t checked by a nurse, and they aren’t clinical advice.
• Question of the Day email — if you sign up, we keep your email address, when you confirmed it, and which emails you’ve chosen to get. We send a confirmation email first, and nothing else until you confirm. Every email has a one-click unsubscribe link. We send through Resend (resend.com, United States), which receives your address and the email to deliver it (see section 5).

From the App

• Account data — email address or Apple/Google sign-in identifier, nursing role + specialty, subscription state, and Marketplace identity needed to operate account-only features.
• NCLEX practice results and study plan (App and Website) — when you’re signed in, your NCLEX practice exam attempts (the answers you chose, your scores and timing, and where you stopped) are saved to our server under your account ID, so you can pick up on another device. We also use the score from each signed-in learner’s first full attempt at a practice exam to show learners how they compare, for example “higher than 65% of RN PocketPal learners who took Exam 3”. Other learners see only that rounded percentage and how many learners it counts, never your score, your answers or your account. If you set up a study plan, its settings (exam date, days off, minutes a day) and which tasks you’ve ticked off are saved the same way. If you use Smart Drill, or take a practice exam while signed in, each answer is also stored with the question’s ID under a one-way keyed hash of your account ID, never the ID itself. We use those answers only to measure how hard each question is and to find questions that may be wrong. When you answer practice questions without signing in, we record your answers with a random ID created on your device. It isn’t linked to your name, email, account or device identifiers. We use these answers only to measure how hard each question is.
• Local clinical content — your brain sheet, notes, calculator inputs, saved templates, and the NCLEX-RN practice cards you save (with any note you add) live on your device in iOS Keychain / encrypted Core Data or Android encrypted storage/Room. We do not have access to local-only content unless you intentionally use a cloud-backed feature.
• Marketplace, Connect, and community content — listings, messages, profile fields, photos, reports, and similar submissions you choose to send to the live service. These surfaces prohibit PHI and are not for clinical care, handoff, charting, or urgent communication.
• Rhythm strip images — rhythm review runs on-device where available. If you separately opt in to contribute a strip for model improvement, the App asks you to confirm de-identification and authorization, strips metadata where possible, and sends the image to a private review queue. Do not contribute strips containing patient or facility identifiers.
• AI feature inputs — when you use the Ask AI assistant or the other AI-assisted features (Legal Reference, lab and medication questions, etc.), the input text is scrubbed for PHI patterns on-device before transmission, then sent over TLS to our server and on to the AI provider for that feature. For the assistant, the current conversation is sent as well so the answer has context; nothing else stored in the App — your brain sheets, shift log, CEU records or account details — is included. Scrubbing is best-effort and you remain responsible for not entering PHI. See section 5 for which provider receives which feature.
• App usage metrics (both apps) — our own usage counts, not a third-party SDK: when the App opens and goes to the background, which tabs and tools you open and for how long, when you start and finish a practice exam, and which home-screen widget or reminder opened it, plus the app version, your country, and a random install ID (stored on our servers only in hashed form). The Android app also sends the type of error when it crashes. No names, account details, typed text, or clinical content are included. In current app versions this is off by default and nothing is sent unless you turn on Profile → Privacy → “Help improve the app”; turning it off discards anything not yet sent. Maximum privacy turns it off regardless of the switch. Earlier app versions sent these counts without asking; updating the App gives you the switch.
• Product analytics and session replay (Android app only) — to understand how features are actually used and to reproduce bugs, the Android app can send usage events and screen recordings of your session to PostHog, a third-party analytics provider (see section 5). This is off by default and nothing is collected unless you turn it on in Profile → Privacy → “Help improve the app.” If you turn it on and later turn it off, recording stops immediately and anything captured but not yet sent is discarded. Recording is limited by a fail-closed allowlist: a screen is recorded only if it has been explicitly approved as containing no clinical or patient-related content, and every screen that is not on that list is excluded automatically. Text you type into input fields is masked. Brain sheets, notes, shift logs, AI inputs, Marketplace messages, and any screen carrying clinical content are never recorded. This feature is not present in the iOS app or on the Website. Setting Privacy mode to Maximum privacy disables it outright, regardless of the toggle.
• Workplace search — when you add an employer and type the name of a hospital, clinic or agency, the App sends that text to our server to look up matching workplaces (see section 5). Suggestions begin after three letters. Nothing else is sent with it — no account, no device identifier, no precise location — and the App never asks for location permission. Adding an employer is optional, and you can always add one exactly as you typed it.
• Crash reports — anonymized crash traces with no user-entered clinical content, used solely to fix bugs if crash reporting is enabled.
• Uploaded photos — for Pill Imprint, Rhythm capture, Marketplace listings, and any other photo-bearing feature, we strip EXIF metadata (geolocation coordinates, device identifier, original timestamp, lens / serial information) on-device before the photo is stored on our servers or transmitted to any third-party processor. The visible image content is preserved; embedded metadata is not. Do not photograph anything that visually shows a patient identifier — that content is not in EXIF and cannot be stripped automatically.

What we explicitly do NOT collect

• We do not intentionally collect patient names, medical record numbers, dates of birth, room numbers tied to a real person, or Protected Health Information.
• Your precise location, contacts, photos, or biometric data. Workplace search uses only a rough, city-level area worked out from your internet connection, never your device’s location (see section 5).
• Your calendar. On Android, the Planner can add your shifts to your phone’s calendar if you ask it to; it reads back only the events it wrote, so it can update them instead of adding duplicates, and none of your calendar leaves the phone.
• Third-party tracking identifiers (Apple Tracking Transparency: we do not request the IDFA).

For visitors and users in the EU/EEA/UK, our lawful bases under Article 6 of the GDPR are:

• Consent (Art. 6(1)(a), and Art. 5(3) ePrivacy / UK PECR) — for the beta signup form, and for first-party website analytics, which stays off unless you opt in on the consent banner and which you can withdraw at any time.
• Legitimate interests (Art. 6(1)(f)) — for responding to support requests, fixing bugs via anonymized crash reports, rate-limiting / abuse prevention, and measuring how hard each practice question is, and finding questions that may be wrong, from stored answers. We also use practice exam scores to show learners how their score compares with other learners’ (a rounded percentage only). We also count Penny’s free turns and prevent abuse from usage records that hold no message text. We balance these against your rights and you can object at any time (section 7).
• Contract (Art. 6(1)(b)) — for delivering app features, processing any Pocketpal Pro subscription still running from before it was retired, and for providing the NCLEX-RN course subscription: access, billing, cancellation and its confirmation email, and for saving your NCLEX practice results and study plan so they follow you between devices, and for answering your questions with Penny, the AI tutor, when you ask.
• Legal obligation (Art. 6(1)(c)) — for retaining transaction records required by tax law.

Health data we incidentally see (none, by design — see section 9) is not used as “special category data” under Article 9.

• Beta signup data — until 90 days after public launch, or until you ask us to delete it, whichever is sooner.
• Prelaunch analytics — aggregate dashboard data may be retained for product planning; event-level browser identifiers are retained for up to 13 months, then deleted or aggregated.
• Support tickets — 2 years after the ticket is closed, then deleted. Anonymized aggregate metrics (e.g., total tickets per month) may be retained longer.
• Subscription / billing records, including NCLEX-RN course subscriptions — 7 years to comply with US tax-records requirements (IRS recommends 7).
• Course enrollment — kept while your account is open, so your access keeps working. The purchase record itself is kept as a billing record (above).
• NCLEX practice results, study plans and stored answers — kept while your account is open, and deleted when you delete your account.
• Penny usage records (account ID, question ID, the kind of help asked for, whether it worked, the time; never what you typed or what Penny wrote) — deleted after 90 days, or sooner when you delete your account.
• Course purchase consent records — when you start a course subscription or buy a pass on the Website, we record the purchase terms you were shown and agreed to (by ticking the box before checkout), which plan, the checkout session, a hashed IP address and the time. We keep this for at least 3 years as proof of your consent, including after you delete your account.
• Question of the Day subscribers — until you unsubscribe. Then we keep only a record that the address unsubscribed, so we never email it again. Sign-ups that were never confirmed are deleted after 30 days.
• Server access logs — 90 days, then rotated and discarded.
• Crash reports — 1 year, then deleted.
• Account data — for as long as your account is open, then deleted or de-identified within 30 days of account deletion, except records we must keep for tax, legal, safety, or dispute-resolution reasons.
• Marketplace, Connect, ratings, and other content you post — until you delete it or your account, then removed from public surfaces promptly and purged from routine backups within 90 days. Copies other users saved or that we must preserve for a legal, safety, or dispute reason persist as described in Terms § 11.3.
• App usage metrics — 90 days, then deleted.
• Product analytics and session recordings (Android) — event-level data and recordings are retained for up to 12 months, then deleted or aggregated. Recordings tied to a deleted account are deleted with it.
• Rhythm-strip contributions — retained while they remain in the reviewed teaching set; rejected or withdrawn contributions are deleted within 30 days.

We do not sell, rent, or trade personal data. Period. We share only with the following categories of processor, under data-processing agreements:

• Hosting — our cPanel host stores the form-submission data and serves the Website. They are bound by their own data-processing terms.
• Email — when we email you a beta-signup confirmation, a course subscription confirmation or a support reply, those emails transit standard mail servers. The Question of the Day list and account emails are delivered by Resend (resend.com, United States), which receives the recipient’s address and the email.
• Product analytics — the Android app sends usage events and allowlisted session recordings to PostHog (posthog.com). Data is sent to PostHog’s US cloud region. PostHog processes this data only on our instructions as our processor, does not sell it, and does not use it to build profiles for advertising. We do not send PostHog clinical content, AI inputs, Marketplace message bodies, or any screen outside the allowlist. This applies to the Android app only.
• AI providers — the App’s AI features use OpenAI. The Ask AI assistant sends your typed question and the current conversation to our own server, which forwards it to OpenAI (openai.com, United States) to generate the answer; your messages are not used to train their models. The other AI-assisted reference tools (Legal Reference, lab and medication questions and similar) also route to OpenAI through our server. On October 29, 2026 we retired the AI in the tools that worked with patient details (Note Writer, Care Plan, shift handoff and SBAR, MAR import and similar); our server now refuses those requests, so they no longer reach any AI provider. Until October 28, 2026 they used DeepSeek (deepseek.com), which is based in China; we no longer send any text to DeepSeek. All of these receive PHI-prohibited, best-effort-redacted prompts only. The assistant asks for your explicit permission, naming OpenAI, before it sends anything for the first time, and you can withdraw that at any time in the App’s AI Settings. We may change providers as privacy, compliance, or product requirements evolve, and will re-ask for permission if the recipient changes. On the Website, Penny, the AI nursing tutor (in NCLEX-RN course lessons and on practice questions), uses Anthropic (anthropic.com, United States). Our server sends Anthropic your message and your recent messages in that conversation, and either the lesson’s text or the practice question with its answer, its rationales and the answer you chose. Anthropic returns the answer. Under its commercial terms Anthropic doesn’t use them to train its models. Penny asks your permission, naming Anthropic, before she sends anything for the first time, and asks again if the provider changes.
• AI backend and app infrastructure — the AI features, in-app support, and account services run on Cloudflare (Workers, D1, KV; cloudflare.com). Cloudflare carries AI requests in transit on their way to the provider named above, and stores the operational data those features need — a random device identifier, per-device daily usage counters, and the app data described in section 2. Cloudflare is not an AI provider and does not train on your data.
• Workplace search — when you search for an employer, our server (on Cloudflare, above) forwards the text you typed to Google Places (Google Maps Platform, United States) and returns matching hospitals, clinics and businesses. To show nearby places first, our server adds a rough, city-level area worked out from your internet connection; it does not send your account, a device identifier, or your device’s location. Results are cached on our server for up to 7 days, keyed to the search text and that rough area, not to you. Google processes these requests under its Google Maps Platform terms. If our server can’t answer, the iPhone app looks the name up with Apple Maps instead, under Apple’s privacy terms.
• Support desk — when you open a support ticket from inside the App or send the support form on the Website, the ticket text, your email address, and a random device identifier (on the Website, also your role, specialty, the page you were on and your browser version, if you share them) go to Zoho Desk (zoho.com, United States data center) so we can track and answer it. Please do not include patient identifiers in a ticket; section 9 describes how we handle PHI that reaches us unintentionally.
• Marketplace and contribution hosting — our backend stores live marketplace/community submissions and optional rhythm-contribution review-queue files needed to provide those features.
• Payments — Google Play Billing on Android and Apple App Store billing on iOS when available. In the App, RevenueCat (revenuecat.com, United States) keeps track of store purchases for us: it receives your account ID, the purchase record from Apple or Google, and basic device details (such as the device platform, app version and store country, and the network address the request comes from) so the App knows whether a subscription is active. RevenueCat does not receive your name, your email or anything you type in the App. Purchases made on the Website — the NCLEX-RN course subscription and business-account plans — are processed by Stripe (stripe.com, United States). Stripe receives the payment details you enter on its checkout page and the purchase details needed to process them, and it also acts as an independent controller for fraud prevention and financial-regulation compliance, under Stripe’s privacy policy. We never see your card number.
• Course video delivery — course videos are streamed either from our hosting provider or from Cloudflare (R2 storage and Workers). Either way, the server that streams a video sees your IP address and the expiring video link, which carries your account ID so that the link works only for you.
• Authorities — when we are legally compelled (court order, subpoena, etc.). We will tell you unless we’re prohibited from doing so.

Our hosting is in the United States. If you are in the EU/EEA/UK, your data will be transferred to the US. The transfer is covered by Standard Contractual Clauses (Module 1: Controller-to-Processor) under Commission Implementing Decision (EU) 2021/914, plus supplementary technical and organizational measures (encryption in transit and at rest, the on-device-first architecture described in section 2).

Our AI backend runs on Cloudflare’s network, which executes each request at the edge location nearest you before forwarding it to the AI provider named in section 5. The stored data behind those features — device identifiers, usage counters, and app data — sits in the United States.

The AI providers disclosed in section 5 (OpenAI and Anthropic) are in the United States. Until October 28, 2026 the App’s older AI-assisted tools used DeepSeek, which is hosted in China; we stopped sending text to DeepSeek on that date. AI features are optional. Before any text is sent, it is scrubbed for PHI patterns on your device and we transmit only the minimum needed for the feature.

You have the following rights, depending on where you live:

Everyone

• Right to know — what data we have about you.
• Right of access — a copy of that data.
• Right to correction — fix anything that’s wrong.
• Right to deletion — remove your data (subject to retention obligations).
• Right to withdraw consent — for anything we process on a consent basis.

If you’re in the EU/EEA/UK (GDPR)

• Right to portability — receive your data in a machine-readable format.
• Right to object — to processing based on legitimate interests.
• Right to restrict — limit how we process your data in specific cases.
• Right not to be subject to automated decisions — including profiling. We don’t do this anyway.
• Right to lodge a complaint — with your local Data Protection Authority. For UK, that’s the ICO (ico.org.uk).

If you’re in California (CCPA / CPRA)

• Right to know + access — described above.
• Right to delete — described above.
• Right to correct — described above.
• Right to opt out of “sale” or “sharing” — we do not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of. We disclose this explicitly here.
• Right to limit use of sensitive personal information — we do not use sensitive personal information for purposes beyond what is necessary to provide the service.
• Right to non-discrimination — exercising your rights will never affect your access to the service or the price you pay.

If you’re elsewhere in the US

Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Maryland (MODPA), and other state laws grant overlapping rights. We honor them the same way we honor CCPA rights, and you can appeal a decision on your request by replying to it. For Maryland residents in particular: we collect only the personal data reasonably necessary to provide the service you asked for, we don’t sell personal data or use it for targeted advertising, and we don’t sell or share consumer health data. If your state isn’t named here and you have a right under your state’s law that we missed, contact us and we’ll handle it.

Consumer health data — Washington, Connecticut, and similar states

RN PocketPal is not a HIPAA-covered entity, which means certain state consumer-health-data laws apply to us in addition to general privacy laws. If you are a resident of Washington State, the Washington My Health My Data Act (effective March 2024) gives you specific rights with respect to “consumer health data” as that act defines it, including:

• Consent before collection or sharing of consumer health data. We obtain consent at signup for any health-adjacent data we collect (role, specialty), and we do not share consumer health data with third parties for advertising or behavioral analytics under any circumstance.
• The right to know what consumer health data we hold about you.
• The right to delete your consumer health data.
• The right to withdraw consent at any time, with deletion of any data we collected on the basis of that consent.
• No sale of consumer health data. We do not sell consumer health data under WA MHMD’s definition of sale, and we do not sell consumer health data under any other state’s definition either.

Similar consumer-health-data rights exist under the Connecticut Data Privacy Act’s health-data provisions, the Colorado Privacy Act, the Virginia Consumer Data Protection Act, the Oregon Consumer Privacy Act, and other emerging state laws. We honor all of these rights through the same data-request channel described below.

We will continue updating this section as state consumer-health-data laws and healthcare privacy requirements evolve.

How to exercise these rights

Email support@rnpocketpal.com with the subject line [DATA REQUEST], or use the form at /data-requests. We respond within 30 days (45 in complex cases, with a heads-up). We never charge you to exercise these rights, and exercising them never affects your access to the service.

Deleting your account

You can request deletion of your account and the data tied to it at /delete-account or /data-requests. Deleting your account removes your profile, Marketplace and Connect content, ratings, and account-linked analytics. Content other users already saved or reshared, and records we are required to keep for tax, legal, safety, or dispute-resolution reasons, persist as described in section 4 and in Terms § 11.3. Deletion is permanent and cannot be undone.

RN PocketPal is a professional tool for licensed nurses, nursing assistive personnel, and nursing students. The Website and App are not directed to children, are not intended for anyone under 16, and are not “directed to children” within the meaning of the Children’s Online Privacy Protection Act (COPPA, 15 U.S.C. § 6501 et seq.). We do not knowingly collect personal data from anyone under 16. Nursing students should be adults enrolled in a nursing program; we do not request school-records data and are not a school service provider under state student-privacy laws.

Creating an account requires you to confirm you are 16 or older. If we learn that we have collected personal data from someone under 16, we delete it promptly. A parent or guardian who believes we hold data about their child can write to privacy@rnpocketpal.com with the subject [UNDER-16], and we will delete the account and its data and confirm back. Where local law sets a higher age of digital consent (for example 16 in parts of the EU/EEA), that higher age applies.

RN PocketPal is not a HIPAA-covered entity in its consumer-app capacity, and we do not intentionally collect or process Protected Health Information. The App is designed so bedside identifiers in brain sheets stay in encrypted local storage by default, and cloud-backed features prohibit PHI.

If RN PocketPal ever enters a hospital/system arrangement that would make us a Business Associate, or if we provide services on behalf of a covered entity or business associate, we will execute a Business Associate Agreement before that engagement starts and will update this policy. That is not the case for the consumer App.

Health-related or professional preferences you tell us about yourself (your nursing role, your unit specialty) are professional descriptors rather than “special category data” under GDPR Article 9. We do not infer health conditions from this data.

Do not send RN PocketPal protected health information, patient identifiers, medical-record numbers, dates of birth, room numbers tied to a real person, facility screenshots with patient banners, or any information you are not authorized to disclose.

If PHI or patient-identifying information is submitted to us by mistake — in a support ticket, a marketplace listing photo, a feedback form, an email, an AI prompt our on-device scrubber did not catch, a Connect post, a rhythm contribution, a crash report, or any other channel — you authorize us to process that information only as needed to secure it, identify the affected submission, delete it, redact it, return it to you, comply with law, investigate abuse or security incidents, and maintain a minimal audit record. We do not use unintended PHI for model training, marketing, analytics, product improvement, marketplace features, or social features.

Specifically, our inbound-PHI handling protocol is:

1. We do not retain it. The message, attachment, or record is purged from our active systems within 72 hours of detection. We make best-effort attempts to remove it from short-term backups within 30 days. We do not export it. We do not analyze it. We do not train any model on it.
2. We do not republish it. We do not quote inbound PHI back to you in our reply. We do not forward it to a third party. We do not share it with a vendor, contractor, or affiliate. If we need to ask a clarifying question, we do so without referencing the patient information you sent.
3. We notify you to delete it on your end. Within one business day of detecting inbound PHI, we ask you to delete the message from your sent folder and any other place you kept a copy, and we provide instructions for your platform where we can.
4. We log the incident without the content. We retain a redacted record of date, channel, and PHI category (not the PHI itself) for our own audit purposes for one year, then delete that record too.
5. The disclosure burden stays with the sender. Because we are not a HIPAA-covered entity and have no Business Associate Agreement with your facility, sending us PHI does not create an authorized disclosure under HIPAA. If you sent PHI without your facility’s authorization, the unauthorized disclosure is yours to report to your facility’s privacy officer. Our handling above limits downstream harm; it does not retroactively make the disclosure compliant.

If you are a facility or hospital privacy officer: contact us at security@rnpocketpal.com and we will work with you in good faith on incident scope, retention timelines, and documentation you need for OCR notification calculations.

RN PocketPal is not a HIPAA secure-messaging system, electronic health record, designated record set, or substitute for your facility’s approved documentation systems. You remain responsible for complying with your employer’s policies, HIPAA obligations, state nursing rules, and minimum-necessary requirements.

These timelines are designed to reduce retention of unintended PHI while preserving a minimal security and abuse-prevention record.

We protect personal data with technical and organizational measures appropriate to its sensitivity. Specifically:

• TLS 1.2+ for all data in transit, HSTS enforced.
• On-device encryption for any clinical content (iOS Data Protection “complete when locked”).
• IP addresses hashed (SHA-256 with a non-public salt) before storage. Raw IPs are not retained beyond standard webserver logs.
• Server-side input validation, parameterized queries, and PHI-shaped-pattern auto-redaction on submitted free-text.
• Content Security Policy, X-Frame-Options DENY, Referrer-Policy strict-origin-when-cross-origin, and Permissions-Policy that denies camera/mic/geolocation by default.
• No third-party advertising SDKs, ad pixels, or cookie syncing in either the Website or the App, and no third-party analytics SDK on the Website or in the iOS app. The Android app uses one third-party product-analytics SDK (PostHog), scoped by the fail-closed allowlist described in section 2 and disclosed in section 5.

No system is perfectly secure. If we discover a personal-data breach, consumer-health-data breach, or breach of unsecured individually identifiable health information that we maintain, we will evaluate and provide notices required by applicable federal, state, and international laws, including consumer health breach-notification rules where they apply.

We run RN PocketPal accounts on social platforms, including Instagram. On our own posts we sometimes invite followers to comment a keyword (for example, “SHEET”) if they want a free resource shown in the post, such as a nursing brain-sheet template. This section explains what happens with your data if you take us up on that.

When you comment that keyword on one of our posts, we use Meta’s Instagram API to send you one private reply (a direct message) with the resource you asked for. This is opt-in and user-initiated: you choose to comment, and we reply once.

What we process, and why

• Your Instagram username / account ID and the text of your comment — used only to detect the keyword, send the single reply you requested, and keep a record of the interaction (a “lead”) so we can measure and improve our content.
• Our own posts only. We only read and reply to comments on media we own. We do not monitor your profile, your direct messages, your other activity, or comments on posts that are not ours.
• One reply per comment. We do not send bulk messages, promotional broadcasts, or follow-ups, and we never message people who have not commented.

Our lawful basis is your consent and our legitimate interest in responding to a request you initiated (GDPR Art. 6(1)(a)/(f)). Instagram and Meta process this data as the messaging platform under Meta’s Privacy Policy; the direct message is delivered through Meta’s systems. We do not sell this data, and we do not use it for advertising, profiling, or any unrelated messaging.

Retention & your choices

We keep the interaction record (your username, the comment, and the keyword matched) for up to 24 months for content analytics, then delete or aggregate it. You can ask us to delete it sooner at any time by emailing support@rnpocketpal.com with the subject [DATA REQUEST], or through /data-requests. You can also revoke our access to your Instagram interactions at any time from Instagram → Settings → Apps and websites.

We will update this policy as the product evolves. When we make a material change (e.g., a new processor, a new data category, a new lawful basis), we will:

• Update the “Last updated” date at the top of this page.
• Post a notice in the App and on the Website 30 days before the change takes effect, where the change is significant.
• If we’re relying on consent for a new purpose, ask you for that consent before processing.

Effective date of this version: May 28, 2026.

For privacy questions, data-access requests, or to exercise any of the rights above:

• Email: support@rnpocketpal.com (subject line [DATA REQUEST])
• Web form: /data-requests
• Mail: 9230 Wainwright Lane, Waldorf, MD 20603, USA
• EU/UK representative: Not currently appointed. We are reviewing, with counsel, whether a GDPR Article 27 representative is required for our processing; until then, direct EU/UK privacy requests to support@rnpocketpal.com.
• Data Protection Officer: We have not designated a DPO. We are reviewing, with counsel, whether Article 37 requires one; in the meantime, send any data-protection question to support@rnpocketpal.com.