Privacy Notice

1. Controller and contact

NurseNote is operated by Ian Mayor, trading as NurseNote in the United Kingdom. For privacy questions, rights requests or suspected privacy incidents, email nursenotesupport@gmail.com.

3. The note-improvement request

• Your browser checks for common structured identifiers before submission.
• The source text, selected format and detail level are sent securely to a Base44 backend function.
• The server requires the current de-identification confirmation, repeats identifier checks, then sends the source through Base44’s Core language-model integration to generate the requested structured response.
• The source and draft are then compared using deterministic markers and a separate Core model verification request. A failed check withholds the draft.
• NurseNote does not write the source note or generated draft to its application database, note history, product analytics or performance logs.
• The draft is returned to the current browser session. NurseNote does not provide a saved-notes feature in this product.

Technical processing by Base44 and its configured model provider may occur to deliver and secure the generation service. Their contractual and operational processing is a further reason not to submit identifiable or confidential patient information.

4. Other data we may process

• Account data: name, email, role and authentication information managed through Base44.
• Access data: plan status, access expiry, daily counters and keyed one-way account, browser or fallback network identifiers used for fair-use and abuse prevention.
• Payment data: Stripe customer, checkout and payment references, purchase status, amount and access period. NurseNote does not receive full card details.
• Support data: contact details and the message you choose to send. Do not include patient information in support messages.
• Request recovery: a random request reference, keyed one-way identity and input fingerprints, the usage date, attempt count and allowance-update state let us recognise the same interrupted request. No source text, draft or prompt is stored in the receipt. A recovery generates a fresh checked draft and is available only on the original UTC day.
• Technical data: request duration, function name, success state and controlled error labels—not note text.
• Privacy-safe product evidence: after a successful verified result, a keyed one-way account, device or fallback network hash, date, chosen format, access tier, word counts, verification status and duration are recorded. These are pseudonymous identities, not verified individual people. Source text and generated drafts are excluded.
• Optional analytics: page and funnel events only after consent. Event properties are allowlisted and exclude source notes and drafts. An opaque improvement identifier links a successful result with consented review-confirmation and clipboard-success events so repeated actions are not counted twice.

5. Purposes and lawful bases

• Contract: to provide an account, process a requested note improvement, fulfil a 30-day access purchase and respond to support.
• Legitimate interests: to secure the service, prevent abuse, diagnose failures, keep minimal business records and understand privacy-safe product performance.
• Consent: for non-essential analytics or marketing where consent is required. You can withdraw consent.
• Legal obligation: for tax, accounting, fraud, dispute and other records that must be kept.

NurseNote is not designed to collect special-category patient data. If such information is entered contrary to these instructions, stop using the service and contact us promptly.

6. Service providers and international processing

NurseNote relies on Base44 for application hosting, authentication, database services, backend functions and the Core model integration; Stripe for checkout and payment processing; and, only after consent, analytics services that may include Google Analytics and Microsoft Clarity.

Providers may process data outside the United Kingdom using the safeguards applicable to their service and contract. The Trust Centre lists the current operational providers and purposes so you can review them before creating an account or purchasing access.

7. Retention

• Source note text and generated drafts are not intentionally retained in NurseNote application records.
• Recovery receipts are operational metadata retained only as needed to diagnose delivery and allowance failures. Recovery access expires at midnight UTC; expiry does not itself delete the receipt. Account-linked receipts are included in a confirmed removable-data deletion request.
• Short-term daily-use records are kept only as needed to operate allowances and prevent abuse.
• Privacy-safe success and purchase evidence is retained long enough to measure whether the product is useful and commercially viable, then reviewed for deletion or aggregation.
• Account and access-status data is kept while the account remains active and until deletion is requested, subject to required records.
• Payment and transaction records may be kept for the period required for tax, accounting, fraud prevention, refunds and disputes.
• Support records are kept while an enquiry is active and for a limited follow-up and dispute period.
• Consent-based analytics retention follows the configured provider settings.

8. Automated decisions

NurseNote does not use the generated draft to make employment, education, care or other decisions with legal or similarly significant effects about a person. The service must not be used to make such decisions.

9. Security

NurseNote uses HTTPS, restricted service-only records, keyed one-way identifiers, request-size and rate limits, versioned confirmations, source-fidelity checks, minimal logging and restricted analytics fields. No internet service can guarantee absolute security, and these controls do not make the service suitable for identifiable patient information.

10. Your rights

Depending on the processing and lawful basis, UK data-protection rights may include access, correction, deletion, restriction, objection and portability. You can also withdraw analytics or marketing consent.

To exercise a right or request account closure, email nursenotesupport@gmail.com. NurseNote cannot export source notes or drafts that it did not retain.

You may complain to the Information Commissioner’s Office if you are unhappy with the handling of personal data.

11. Cookies and changes

Optional analytics are denied unless accepted. Change your choice through Cookie settings in the footer. This notice will be updated when the product, providers or purposes materially change.