How does RN PocketPal handle HIPAA and PHI?

RN PocketPal is designed to stay outside HIPAA’s scope in its consumer-app capacity by not intentionally receiving PHI or acting on behalf of a hospital, health plan, or EHR. HIPAA obligations change if RN PocketPal enters a hospital/system arrangement to create, receive, maintain, or transmit PHI on that organization’s behalf; that would require counsel review and a BAA before launch.

What data does RN PocketPal collect?

Account-level data, marketplace/account data if you use those features, PHI-free product analytics, support requests, optional AI prompts after redaction, and crash reports with user-entered text scrubbed. Patient-bearing brain-sheet content is local-only by default. The full list lives in the privacy policy.

What about a strip photo I take in the app?

It stays on your iPhone. RN PocketPal does not interpret strip photos — the photo-based Rhythm Reader was withdrawn in August 2026 — and the Compare view only sets your photo beside a reference strip for you to read yourself. Images are never transmitted to RN PocketPal servers unless you explicitly opt in to the educational corpus contribution feature, in which case the image is stripped of metadata and de-identified before transmission.

Can my hospital see what I do in the app?

No. RN PocketPal has no enterprise admin console in v1.0. Your usage is private to you.

Will this change in future versions?

If we add features that require cloud sync (e.g. multi-device brain-sheet sync in v1.5), they will be opt-in and clearly described. We will not silently change the privacy posture in a future update.

A privacy-first nursing app, by design.

Bedside identifiers and brain-sheet contents are designed to stay local by default. Cloud-backed features prohibit PHI, use redaction where available, and stay opt-in.

Most nursing apps treat your phone as a thin client. Your brain sheet syncs to a server you didn’t choose, your habits feed an analytics dashboard you can’t see, and your patient identifiers travel further than they need to. The privacy policy is 4,000 words long for a reason.

RN PocketPal flips this. The default is local. Cloud features are opt-in, PHI-prohibited, and covered by an unintended-PHI deletion policy.

What RN PocketPal does

No intentional PHI storage. Brain-sheet contents and bedside identifiers live in encrypted local storage by default. RN PocketPal is not a charting system, secure-messaging system, or medical record.
No third-party trackers. No Google Analytics. No Meta Pixel. No Mixpanel. No Segment. First-party analytics only, and only for things like “how many people viewed the homepage” — never patient content.
Crash reports are scrubbed. If the app crashes, the crash report scrubs every user-entered text field before transmission. Allowlist approach, not denylist.
Rhythm Practice never leaves your phone. The drills, atlas, and mega-code scenarios are bundled in the app, and a strip photo you open in the Compare view is handled on-device — nothing is sent off for interpretation, because nothing interprets it. Optional strip contributions are separate, opt-in, de-identified submissions to a private review queue.
You control the educational corpus. If you want to contribute strips to RN PocketPal’s educational corpus, that’s an explicit opt-in with metadata stripping and de-identification. Off by default.

Who it’s for

Built for nurses who’ve read enough HIPAA training modules to know what’s worth asking about, and for hospital privacy officers evaluating which apps their clinical staff can install on personal devices.

Educational reference only. Not a medical device. Verify with clinical judgment, facility policy, and primary sources. Read the full disclaimer.

Frequently asked questions

How does RN PocketPal handle HIPAA and PHI?: RN PocketPal is designed to stay outside HIPAA’s scope in its consumer-app capacity by not intentionally receiving PHI or acting on behalf of a hospital, health plan, or EHR. HIPAA obligations change if RN PocketPal enters a hospital/system arrangement to create, receive, maintain, or transmit PHI on that organization’s behalf; that would require counsel review and a BAA before launch.
What data does RN PocketPal collect?: Account-level data, marketplace/account data if you use those features, PHI-free product analytics, support requests, optional AI prompts after redaction, and crash reports with user-entered text scrubbed. Patient-bearing brain-sheet content is local-only by default. The full list lives in the privacy policy.
What about a strip photo I take in the app?: It stays on your iPhone. RN PocketPal does not interpret strip photos — the photo-based Rhythm Reader was withdrawn in August 2026 — and the Compare view only sets your photo beside a reference strip for you to read yourself. Images are never transmitted to RN PocketPal servers unless you explicitly opt in to the educational corpus contribution feature, in which case the image is stripped of metadata and de-identified before transmission.
Can my hospital see what I do in the app?: No. RN PocketPal has no enterprise admin console in v1.0. Your usage is private to you.
Will this change in future versions?: If we add features that require cloud sync (e.g. multi-device brain-sheet sync in v1.5), they will be opt-in and clearly described. We will not silently change the privacy posture in a future update.

Download RN PocketPal

Download on theApp Store Get it onGoogle Play

Want early-access updates?

RN PocketPal is live on the App Store and Google Play. Join the list for beta builds and upcoming tools.

RoleSpecialtyBiggest pain right nowLaunch platformEmail address

By joining, you agree to our privacy policy and terms. We email occasional updates — unsubscribe anytime.

Reviewed by RN PocketPal Clinical Team, RN. Last reviewed May 7, 2026.

What RN PocketPal does

Who it’s for

Frequently asked questions

Related RN PocketPal tools

Want early-access updates?