Privacy Policy

Last Updated: October 6, 2026

INTRODUCTION

NurseKind AI, LLC ("NurseKind," "we," "us," or "our") provides an artificial intelligence-powered educational assessment platform (the "Platform") designed to evaluate humanistic nursing behaviors in student-patient interactions. This Privacy Policy describes how we collect, use, disclose, and protect information when educational institutions ("Institution," "Customer," or "School") and their students ("Students" or "Users") use our Platform.

This Privacy Policy applies to information collected through:

The NurseKind AI mobile application (iOS and Android)
The NurseKind AI web-based faculty dashboard
Canvas Learning Management System (LMS) integration
Any related services, features, or content we offer

IMPORTANT EXCLUSIONS AND SCOPE LIMITATIONS

HIPAA Applicability: Depends on Platform Mode

NURSEKIND AI IS HIPAA-COMPLIANT FOR ITS CLINICAL RECORDING & ASSESSMENT FEATURE, WHICH MAY PROCESS REAL PATIENT PROTECTED HEALTH INFORMATION (PHI). ITS AI PATIENT PRACTICE SESSIONS FEATURE IS FICTIONAL-ONLY AND NOT SUBJECT TO HIPAA.

The Platform has two distinct modes with different data-handling and legal treatment:

Clinical Recording & Assessment: students may record real clinical interactions (with proper patient authorization) for AI-assisted assessment. Audio is transcribed and analyzed only by processors under a signed Business Associate Agreement (AssemblyAI for transcription; Google Cloud, including Vertex AI, for storage, encryption, and AI-assisted scoring). This mode IS subject to HIPAA, and NurseKind AI maintains the administrative, physical, and technical safeguards required by the HIPAA Security Rule for it. Faculty may also upload a video recording and choose to have it analyzed for observable behaviors; see Video Analysis Data below.
AI Patient Practice Sessions: voice-based simulation with fictional, institution-authored patients only. NO actual patient Protected Health Information is processed or stored in this mode; the Platform technically blocks any non-fictional scenario from reaching it. This mode is governed by FERPA (educational records), not HIPAA.

Student Responsibilities (AI Patient Practice Sessions mode):

Students MUST NOT submit recordings of actual patient interactions to the AI Patient Practice Sessions feature
Students MUST NOT include real patient names, medical record numbers, dates of birth, or other identifiable patient information in that feature
Students MUST use only simulated, hypothetical, or role-play scenarios as instructed by their educational program when using AI Patient Practice Sessions

Real patient interactions belong in the Clinical Recording & Assessment feature, subject to your institution's patient-authorization requirements. Violations of this policy may result in immediate account termination and notification to the student's institution.

NOT a Clinical Decision Support Tool

THE PLATFORM IS AN EDUCATIONAL ASSESSMENT TOOL ONLY, NOT A CLINICAL DECISION SUPPORT SYSTEM.

Platform Purpose:

Evaluate communication skills and humanistic behaviors in educational contexts
Provide formative feedback for student learning and professional development
Support nursing education program assessment and improvement
Supplement faculty evaluation with AI-powered insights

The Platform is NOT Used For:

Clinical diagnosis or patient treatment decisions
Patient care recommendations or protocols
Determination of clinical competency for licensure or certification
Replacement of clinical preceptor evaluation
Direct patient care or treatment planning
Medical decision-making of any kind

Educational Context Only: All assessments and feedback are provided in the context of nursing education and student development, not clinical practice.

Supplemental Assessment Tool - Faculty Oversight Required

AI-GENERATED ASSESSMENTS REQUIRE FACULTY REVIEW AND PROFESSIONAL JUDGMENT.

Faculty Authority and Responsibility:

Faculty retain SOLE AUTHORITY for all grading and educational decisions
AI-generated scores and feedback are ADVISORY only and inform, not replace, professional judgment
High-stakes decisions (grades, clinical progression, graduation eligibility) require human faculty review
Faculty should review the full transcript and feedback when making critical competency determinations
Educational institutions maintain full responsibility for student assessment and progression decisions

Platform Limitations:

AI assessments may contain errors, inaccuracies, or limitations
Technology cannot account for all contextual factors in human interactions
Assessment frameworks are evidence-based but not infallible
Results represent ONE data point among multiple evaluation methods

NurseKind Assumes NO Responsibility For:

Grading decisions made by faculty or institutions
Student progression or graduation determinations
Clinical competency assessments
Licensure or certification recommendations
Educational outcomes or student performance

The Platform is designed to support and enhance faculty evaluation, never to replace human professional judgment in educational decision-making.

FERPA COMPLIANCE AND SCHOOL OFFICIAL DESIGNATION

Education Records

NurseKind AI acknowledges that certain information collected through the Platform, including audio recordings of student-patient interactions, assessment scores, performance analytics, and related educational data, constitutes "education records" as defined under the Family Educational Rights and Privacy Act ("FERPA"), 20 U.S.C. § 1232g and 34 C.F.R. Part 99.

School Official Status

The Institution designates NurseKind AI as a "school official" with "legitimate educational interests" in student education records pursuant to FERPA 34 C.F.R. § 99.31(a)(1). NurseKind AI operates under the direct control of the Institution with respect to the use and maintenance of education records and uses such records only for authorized educational purposes as directed by the Institution.

Institutional Control

The Institution retains ownership and control of all student education records. NurseKind AI acts solely as a service provider and data processor on behalf of the Institution. We do not use student education records for any purpose other than providing the Platform services as authorized by the Institution.

INFORMATION WE COLLECT

Information Collected Directly from Students

When Students use the Platform, we collect:

Student Account Information:

Name
Email address
Student identification number (as provided by Institution)
Program/course enrollment information
Academic institution affiliation

Audio Recording Data:

Voice recordings of student-patient interaction simulations
Audio file metadata (duration, timestamp, file format)
Interaction context information (scenario type, clinical setting)

Audio is not kept. A recording is held temporarily only so it can be transcribed. Once the transcript has been retrieved, the audio and our transcription vendor's copy are deleted (a storage rule removes any staged audio within 24 hours as a backstop). What we keep is the transcript.

Video Analysis Data (faculty-uploaded video only):

When a faculty member uploads a video (MP4) of a recorded session and chooses video analysis, the video file is held temporarily, for at most about an hour, so it can be analyzed. It is then deleted as soon as the analysis finishes, whether or not the analysis succeeded. A storage rule removes any staged video within 24 hours as a backstop. Video is never kept for playback.
The analysis is performed by Google Vertex AI (Gemini) under our Business Associate Agreement with Google Cloud, in the United States. Unlike the transcript, a video shows faces and includes the original audio track, so the transcription redaction described below does not apply to it. We instruct the analysis not to transcribe speech or record names.
What we keep from an analyzed video is a short written set of observations (for example, whether the student sat at the patient's eye level or showed attention toward the patient), each with the time range it was observed. These are stored encrypted with the assessment record, are shown to faculty as evidence for their review, never change the assessment score, and are deleted with the record. They are not shown to students in the app. They are part of a student's own record, so they are included if the student downloads their records or an administrator exports them.
If a faculty member chooses a skills check for a video of one student performing a procedure, what we keep also includes, for each step of the chosen procedure, whether the recording shows it done correctly, not done correctly, or cannot show it, with the time ranges. It is advice for the faculty member's own check-off, not a grade or a competency decision, and it never changes the assessment score. It is stored, protected and deleted exactly like the other observations. If the skill was written by a faculty member at your institution, its title and steps (text that faculty member typed, which should describe a procedure and never a person) are sent to Google Vertex AI, under the same agreement, to build the skill and, together with the video, to say what to look for. They are kept with that faculty member's skill list, separate from student records, and your records keep their own copy of the steps used.
Before uploading a video, the faculty member must confirm that everyone who appears in or is heard in it has consented to being recorded and to AI analysis of the recording.

Assessment Response Data:

Student self-assessments
Reflection notes
Response to AI-generated feedback

Usage Information:

Platform access times and frequency
Features accessed
Device information (device type, operating system, browser type)
IP address and general location data

Information Received from Institutions

We receive the following information from educational institutions:

Student roster data (names, email addresses, student IDs)
Course enrollment information
Program affiliation and academic year
Faculty/instructor assignments
Institutional configuration preferences

Information Collected from Canvas LMS Integration

Current Canvas Integration (Read-Only):

Student roster synchronization
Course enrollment data
User authentication credentials

Future Canvas Integration (When Implemented):

Assessment score data for grade passback
Assignment completion status
Course grading configuration

Information Generated by Our Platform

The Platform generates:

Audio transcriptions of student recordings
AI-generated assessment scores and feedback
Performance analytics and trends
Progress tracking metrics

HOW WE USE INFORMATION

Educational Services

We use collected information to:

Transcribe and analyze student-patient interaction audio recordings
Generate AI-powered assessment scores evaluating humanistic nursing behaviors
Provide personalized feedback on communication skills, empathy, and therapeutic techniques
Enable faculty review of student performance
Track student progress over time
Generate performance reports and analytics for faculty and administrators
Facilitate Canvas LMS integration for roster management and (future) grade synchronization

Communication

We use contact information to:

Send Platform-related notifications and updates
Provide technical support
Respond to inquiries
Communicate important security or privacy updates

We do NOT use student information for:

Marketing or promotional purposes
Selling or renting to third parties
Behavioral advertising
Creating student profiles for non-educational purposes

ARTIFICIAL INTELLIGENCE AND THIRD-PARTY SERVICES

AI Processing Services

NurseKind AI utilizes third-party artificial intelligence services to transcribe and analyze student recordings, and to power the AI patient practice feature:

AssemblyAI (Transcription Service):

Purpose: Converts audio recordings to text transcripts with speaker diarization
Data Shared: Audio recordings, file metadata
Processing Location: United States
Data Usage: AssemblyAI processes audio strictly for transcription purposes and does not use customer data to train their models
Privacy Policy: https://www.assemblyai.com/legal/privacy-policy

Google Vertex AI (AI Analysis Service):

Purpose: Analyzes the transcript to generate clinical judgment and communication feedback, including assessment scores on humanistic nursing behaviors
Data Shared: PII-redacted transcripts and interaction context. For a faculty-uploaded video that faculty choose to have analyzed, the video file itself is also sent (see Video Analysis Data above); it is not redacted, and it is deleted as soon as the analysis finishes. Person names, phone numbers, email addresses, dates of birth, locations and Social Security numbers are removed at transcription, before analysis. Clinical terminology is deliberately preserved, because it is what the assessment grades.
Processing Location: United States (Google Cloud US multi-region; processing stays within the United States)
Data Usage: Student data is NOT used to train AI models. Vertex AI is covered by our HIPAA Business Associate Agreement with Google Cloud (reviewed and accepted September 14, 2026), under which Google does not use customer data to train, retrain or improve its models. Any use of student data for training would require explicit written agreement with the educational institution.
Privacy Policy: https://cloud.google.com/privacy

OpenAI (AI Patient Practice Sessions):

Purpose: Voices the fictional patient in AI Patient Practice Sessions, and screens the AI patient's own generated speech for unsafe content
Data Shared: Practice-session voice audio and transcript only. No real patient information is sent to OpenAI. The Platform technically blocks any scenario not flagged as fictional and educational from reaching this feature.
Processing Location: United States
Data Usage: OpenAI does not use API data to train its models. Because OpenAI never receives Protected Health Information, it falls outside HIPAA's Business Associate Agreement requirement.
Privacy Policy: https://openai.com/policies/privacy-policy

Infrastructure and Data Storage

Google Cloud SQL (Database):

Purpose: Secure data storage and database management
Data Shared: All Platform data including audio files, transcripts, assessment scores, user accounts
Processing Location: United States
Security: Encryption at rest and in transit, Row Level Security policies
Privacy Policy: https://cloud.google.com/privacy

Firebase Cloud Functions (Backend Processing):

Purpose: Secure API request handling, business logic execution
Data Shared: API requests, processing instructions
Processing Location: United States
Privacy Policy: https://firebase.google.com/support/privacy

Subprocessor Commitments

All third-party service providers (subprocessors) have agreed to:

Maintain appropriate technical and organizational security measures
Use student data only for providing contracted services
Comply with FERPA requirements and educational data protection standards
Notify NurseKind immediately of any data security incidents
Delete or return data upon termination of services

We maintain a current list of all subprocessors and will notify Institutions of any changes to our subprocessor list with at least 30 days advance notice.

MARKETING AND ANALYTICS

On our public marketing website (before you create an account or log in), we use a Meta Pixel to measure advertising effectiveness and a first-party analytics script to understand which marketing channels bring visitors to the site. Neither loads on any authenticated page (faculty dashboard, student assessments, or simulation interfaces), and neither is linked to student education records. If your browser sends a Global Privacy Control (GPC) signal, we automatically treat it as an opt-out and skip loading both. For the full list of cookies and tracking technologies we use and how to control them, see our Cookie Notice.

INFORMATION SHARING AND DISCLOSURE

Sharing with Institutions

We share student information with the educational institution that authorized the student's access:

Faculty and instructors can see transcripts, assessment scores, feedback and analytics for a student only if they added that student to the Platform or the student is enrolled in a course they teach
A faculty member who records a group assessment can see it, and so can faculty who can access any student who took part
Faculty administrators can see the records of every student at their own institution, and handle that institution's correction requests
Program and institutional administrators can access aggregated performance data, analytics and usage metrics for their programs
Everyone recorded in a group assessment can see that group's transcript and feedback, so a group recording is visible to every student who took part in it

Access by NurseKind Staff

A small number of NurseKind staff can open records to provide support and keep the Platform secure. Every such access is logged. Students see it in their record of access (shown as "NurseKind staff"), and an institution's faculty administrators can see each time NurseKind staff opened or exported a record belonging to one of their students (an individual record, a group recording, or a report naming students) under NurseKind Staff Access in the Reporting tab of their dashboard. Class-wide lists and roster views are not itemized per student. Emergency (break-glass) access is flagged there.

Sharing at Student Direction

Students may share their own assessment results and feedback as they choose. The Platform may provide features allowing students to export or share their individual performance data.

Legal Obligations

We may disclose information when required by law or legal process:

To comply with valid legal process (subpoena, court order, warrant)
To comply with FERPA-permitted disclosures
To protect the rights, property, or safety of NurseKind, our users, or the public
In connection with an investigation of fraud, intellectual property infringement, or other unlawful activity

Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of assets, student information may be transferred to a successor entity, subject to the same privacy protections and with notice to affected Institutions.

What We Do NOT Do with Student Information

We do NOT:

Sell or rent student information to third parties
Share student information with third parties for their marketing purposes
Use student information for behavioral advertising or ad targeting
Create student profiles for non-educational purposes
Disclose student information to law enforcement without valid legal process (except in emergencies involving threat of death or serious bodily harm)

DATA SECURITY

Security Measures

NurseKind AI implements industry-standard security measures to protect student information:

Technical Safeguards:

AES-256 encryption for data at rest
TLS 1.2+ encryption for data in transit
Secure API authentication using JWT tokens
Multi-factor authentication for administrative access
Regular security vulnerability scanning and penetration testing
Automated security monitoring and intrusion detection

Physical Safeguards:

Data stored in SOC 2 Type II certified data centers
Redundant backup systems with geographic distribution
Disaster recovery and business continuity plans

Administrative Safeguards:

Limited Personnel Access: Currently, only two company principals (founders) have access to student data - Dr. Stacie A. Dee (CEO) and Ilan Dee (Co-Founder/CTO). See Personnel Disclosure document for complete details.
Both principals have completed FERPA training and signed confidentiality agreements
When employees are hired in the future, background checks will be required before data access
Mandatory FERPA and data privacy training for all personnel with data access
Principle of least privilege access controls
Audit logging of all data access and modifications
Incident response plan and procedures

Data Breach Notification

In the event of a data breach involving student education records, we will:

Notify the affected Institution within 24 hours of confirming the breach
Provide detailed information about the nature and scope of the breach
Describe the measures taken to address the breach
Offer recommendations to mitigate potential harm
Cooperate fully with the Institution's breach response procedures
Notify affected individuals as required by applicable law or at Institution's direction

DATA RETENTION AND DELETION

Retention During Active Use

While a student is actively enrolled in courses using the Platform, we retain:

Transcripts of recordings (audio itself is not kept; see above)
Assessment scores and feedback
Performance analytics and progress data

One-Year Limit

Assessment records, practice-session records and group assessment records are permanently deleted one year after they were created, whether or not the student is still enrolled. Deleting a record also deletes its exports, faculty reviews and correction requests. Deletion runs daily.

A record that is the subject of an open correction request (awaiting a decision, or with a hearing requested) is kept until the request is resolved, then deleted at the next daily run
This period is fixed in the Platform. An institution that needs its own copy of a record for longer should download it before the year ends

Deletion Upon Request

A faculty administrator can delete a student's account at any time. Doing so immediately and permanently deletes the student's records and anonymizes the account (name, email, sign-in identifiers and security data), and we keep a record that the deletion took place. Written certification of deletion is available on request. Deleted data can remain in database backups, which expire on a 7-day cycle.

Contract Termination

When an Institution's agreement with NurseKind ends, we mark the institution as terminated. Its users can no longer sign in, and a 30-day countdown begins.

Thirty days after termination, all of the institution's student records are permanently deleted and every one of its accounts is anonymized and removed from our sign-in service
The 30 days allow for final data exports and transition activities; institutions may request a machine-readable export (CSV, JSON) before deletion
Deleted data can remain in database backups for up to 7 more days, until they expire
We keep our security and disclosure logs, which refer to accounts only by an internal identifier once the account is anonymized
An institution may ask us in writing to delete sooner, or to keep its records longer under a written agreement made before the 30 days end
Written certification of deletion is available on request

Individual Student Requests

Students who wish to delete their own data should contact their Institution, as the Institution is the data controller for education records. Institutions may then request deletion on behalf of the student. Students may also delete their own account directly — in the iOS or Android app (Account → Delete my account) or by request; see Delete Your Account for details on what is deleted and what your institution retains.

STUDENT AND PARENT RIGHTS

FERPA Rights

Students (and parents, if applicable) have rights under FERPA including:

Right to inspect and review education records
Right to request amendment of inaccurate records
Right to consent to disclosure of education records (except where FERPA permits disclosure without consent)
Right to file complaints with the U.S. Department of Education

Students can use these rights inside the Platform. The Institution remains responsible for decisions on corrections and hearings, and students may also contact their school's registrar or designated FERPA official.

Access to Information

Students can download a complete copy of their records, and see who has accessed or received them, from the My Records & Privacy tab of the Platform. The record of access names each person or role that opened a record (NurseKind staff are shown as "NurseKind staff"). Students may also submit a request to hi@nursekindai.com or to their Institution. We will respond within 30 days.

Correction of Information

A student who believes a record is inaccurate or misleading can file a correction request from the My Records & Privacy tab. The Institution decides the request, and the Platform tracks a 30-day due date. If the request is denied, the student can request a hearing. If the record is upheld after the hearing, the student can add a statement of disagreement. Any correction or statement is shown with the record wherever it is viewed, downloaded or exported.

Data Portability

Students can download their records in a structured, machine-readable format from the My Records & Privacy tab at any time.

CHILDREN'S PRIVACY

The Platform is designed exclusively for students aged 18 and older enrolled in post-secondary nursing education programs. We do not knowingly collect information from individuals under 18. If we become aware that we have inadvertently collected information from someone under 18, we will promptly delete such information.

STATE-SPECIFIC PRIVACY RIGHTS

California

California students have additional rights under the California Consumer Privacy Act (CCPA) and Student Online Personal Information Protection Act (SOPIPA):

SOPIPA Commitments:

We will not use student information for targeted advertising
We will not create student profiles for non-educational purposes
We will not sell student information
We will not disclose student information except as authorized

CCPA Rights:

Right to know what personal information is collected
Right to delete personal information (exercised through Institution)
Right to opt-out of sale of personal information (we do not sell information)

New York

Under New York Education Law § 2-d, we provide:

A Parents' Bill of Rights for Data Privacy and Security, available on request by emailing hi@nursekindai.com
Supplemental information about data collection and use
Commitment to data security and breach notification
Employee training on student data privacy

Parents and "eligible students" — students who have turned 18 or are attending a postsecondary institution, at which point FERPA rights transfer from parent to student — may contact their school district to exercise rights under Education Law § 2-d.

Colorado

Under Colorado's Student Data Transparency and Security Act:

We maintain a transparent list of all data elements collected
We implement comprehensive data security measures
We prohibit use of student data for targeted advertising
We provide data deletion upon authorized request

INTERNATIONAL USERS

The Platform is designed for use in the United States only. Your data is primarily stored on servers located in the United States, with the exception of transactional email processing for FERPA-scope notifications, which is handled by a subprocessor located in the European Union (Lithuania) and does not involve PHI. See our Subprocessors page for the current list of vendors and where they process data. If you access the Platform from outside the United States, you acknowledge that your information will be transferred to, stored in, and processed in the United States (or, for the limited purpose above, the European Union).

CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Platform features. We will:

Post the updated Privacy Policy on our website with a new "Last Updated" date
Notify Institutions at least 30 days before material changes take effect
Obtain Institution consent for material changes that expand data collection or use
Maintain previous versions for Institution reference

Continued use of the Platform after the effective date of changes constitutes acceptance of the updated Privacy Policy, subject to Institution's consent rights.

CONTACT INFORMATION

For questions about this Privacy Policy or our privacy practices:

Privacy Officer

NurseKind AI, LLC

418 Broadway STE R

Albany, NY, 12207, USA

Email: hi@nursekindai.com

For FERPA-related inquiries, students should contact their Institution's registrar or FERPA official.

To file a complaint regarding our privacy practices:

Student Privacy Policy Office

U.S. Department of Education

400 Maryland Avenue, SW

Washington, DC 20202-8520

Website: https://studentprivacy.ed.gov/file-a-complaint

TRANSPARENCY COMMITMENT

We are committed to transparency in our data practices. See our Subprocessors page for the current list of all third-party subprocessors, including what each processes, where, and its HIPAA BAA / GDPR DPA status. A Data Processing Agreement, security and compliance documentation, and instructions for data access, correction, and deletion requests are available on request by emailing hi@nursekindai.com.

This Privacy Policy is effective as of the "Last Updated" date above and applies to all information collected on or after that date.