Privacy Policy

Last Updated: January 22, 2026

INTRODUCTION

NurseKind AI, LLC ("NurseKind," "we," "us," or "our") provides an artificial intelligence-powered educational assessment platform (the "Platform") designed to evaluate humanistic nursing behaviors in student-patient interactions. This Privacy Policy describes how we collect, use, disclose, and protect information when educational institutions ("Institution," "Customer," or "School") and their students ("Students" or "Users") use our Platform.

This Privacy Policy applies to information collected through:

The NurseKind AI mobile application (iOS and Android)
The NurseKind AI web-based faculty dashboard
Canvas Learning Management System (LMS) integration
Any related services, features, or content we offer

IMPORTANT EXCLUSIONS AND SCOPE LIMITATIONS

HIPAA Applicability: Depends on Platform Mode

NURSEKIND AI IS HIPAA-COMPLIANT FOR ITS CLINICAL RECORDING & ASSESSMENT FEATURE, WHICH MAY PROCESS REAL PATIENT PROTECTED HEALTH INFORMATION (PHI). ITS AI PATIENT PRACTICE SESSIONS FEATURE IS FICTIONAL-ONLY AND NOT SUBJECT TO HIPAA.

The Platform has two distinct modes with different data-handling and legal treatment:

Clinical Recording & Assessment: students may record real clinical interactions (with proper patient authorization) for AI-assisted assessment. Audio is transcribed and analyzed only by processors under a signed Business Associate Agreement (AssemblyAI for transcription; Google Cloud for storage, encryption, and AI-assisted scoring). This mode IS subject to HIPAA, and NurseKind AI maintains the administrative, physical, and technical safeguards required by the HIPAA Security Rule for it.
AI Patient Practice Sessions: voice-based simulation with fictional, institution-authored patients only. NO actual patient Protected Health Information is processed or stored in this mode; the Platform technically blocks any non-fictional scenario from reaching it. This mode is governed by FERPA (educational records), not HIPAA.

Student Responsibilities (AI Patient Practice Sessions mode):

Students MUST NOT submit recordings of actual patient interactions to the AI Patient Practice Sessions feature
Students MUST NOT include real patient names, medical record numbers, dates of birth, or other identifiable patient information in that feature
Students MUST use only simulated, hypothetical, or role-play scenarios as instructed by their educational program when using AI Patient Practice Sessions

Real patient interactions belong in the Clinical Recording & Assessment feature, subject to your institution's patient-authorization requirements. Violations of this policy may result in immediate account termination and notification to the student's institution.

NOT a Clinical Decision Support Tool

THE PLATFORM IS AN EDUCATIONAL ASSESSMENT TOOL ONLY, NOT A CLINICAL DECISION SUPPORT SYSTEM.

Platform Purpose:

Evaluate communication skills and humanistic behaviors in educational contexts
Provide formative feedback for student learning and professional development
Support nursing education program assessment and improvement
Supplement faculty evaluation with AI-powered insights

The Platform is NOT Used For:

Clinical diagnosis or patient treatment decisions
Patient care recommendations or protocols
Determination of clinical competency for licensure or certification
Replacement of clinical preceptor evaluation
Direct patient care or treatment planning
Medical decision-making of any kind

Educational Context Only: All assessments and feedback are provided in the context of nursing education and student development, not clinical practice.

Supplemental Assessment Tool - Faculty Oversight Required

AI-GENERATED ASSESSMENTS REQUIRE FACULTY REVIEW AND PROFESSIONAL JUDGMENT.

Faculty Authority and Responsibility:

Faculty retain SOLE AUTHORITY for all grading and educational decisions
AI-generated scores and feedback are ADVISORY only and inform, not replace, professional judgment
High-stakes decisions (grades, clinical progression, graduation eligibility) require human faculty review
Faculty should review actual recordings when making critical competency determinations
Educational institutions maintain full responsibility for student assessment and progression decisions

Platform Limitations:

AI assessments may contain errors, inaccuracies, or limitations
Technology cannot account for all contextual factors in human interactions
Assessment frameworks are evidence-based but not infallible
Results represent ONE data point among multiple evaluation methods

NurseKind Assumes NO Responsibility For:

Grading decisions made by faculty or institutions
Student progression or graduation determinations
Clinical competency assessments
Licensure or certification recommendations
Educational outcomes or student performance

The Platform is designed to support and enhance faculty evaluation, never to replace human professional judgment in educational decision-making.

FERPA COMPLIANCE AND SCHOOL OFFICIAL DESIGNATION

Education Records

NurseKind AI acknowledges that certain information collected through the Platform, including audio recordings of student-patient interactions, assessment scores, performance analytics, and related educational data, constitutes "education records" as defined under the Family Educational Rights and Privacy Act ("FERPA"), 20 U.S.C. § 1232g and 34 C.F.R. Part 99.

School Official Status

The Institution designates NurseKind AI as a "school official" with "legitimate educational interests" in student education records pursuant to FERPA 34 C.F.R. § 99.31(a)(1). NurseKind AI operates under the direct control of the Institution with respect to the use and maintenance of education records and uses such records only for authorized educational purposes as directed by the Institution.

Institutional Control

The Institution retains ownership and control of all student education records. NurseKind AI acts solely as a service provider and data processor on behalf of the Institution. We do not use student education records for any purpose other than providing the Platform services as authorized by the Institution.

INFORMATION WE COLLECT

Information Collected Directly from Students

When Students use the Platform, we collect:

Student Account Information:

Name
Email address
Student identification number (as provided by Institution)
Program/course enrollment information
Academic institution affiliation

Audio Recording Data:

Voice recordings of student-patient interaction simulations
Audio file metadata (duration, timestamp, file format)
Interaction context information (scenario type, clinical setting)

Assessment Response Data:

Student self-assessments
Reflection notes
Response to AI-generated feedback

Usage Information:

Platform access times and frequency
Features accessed
Device information (device type, operating system, browser type)
IP address and general location data

Information Received from Institutions

We receive the following information from educational institutions:

Student roster data (names, email addresses, student IDs)
Course enrollment information
Program affiliation and academic year
Faculty/instructor assignments
Institutional configuration preferences

Information Collected from Canvas LMS Integration

Current Canvas Integration (Read-Only):

Student roster synchronization
Course enrollment data
User authentication credentials

Future Canvas Integration (When Implemented):

Assessment score data for grade passback
Assignment completion status
Course grading configuration

Information Generated by Our Platform

The Platform generates:

Audio transcriptions of student recordings
AI-generated assessment scores and feedback
Performance analytics and trends
Comparative benchmarking data (anonymized and aggregated)
Progress tracking metrics

HOW WE USE INFORMATION

Educational Services

We use collected information to:

Transcribe and analyze student-patient interaction audio recordings
Generate AI-powered assessment scores evaluating humanistic nursing behaviors
Provide personalized feedback on communication skills, empathy, and therapeutic techniques
Enable faculty review of student performance
Track student progress over time
Generate performance reports and analytics for faculty and administrators
Facilitate Canvas LMS integration for roster management and (future) grade synchronization

Platform Improvement

We may use aggregated, de-identified, and anonymized information that cannot reasonably identify individual students to:

Improve AI assessment algorithms and accuracy
Enhance Platform features and functionality
Conduct internal research and development
Generate industry benchmarking reports for nursing education

Communication

We use contact information to:

Send Platform-related notifications and updates
Provide technical support
Respond to inquiries
Communicate important security or privacy updates

We do NOT use student information for:

Marketing or promotional purposes
Selling or renting to third parties
Behavioral advertising
Creating student profiles for non-educational purposes

ARTIFICIAL INTELLIGENCE AND THIRD-PARTY SERVICES

AI Processing Services

NurseKind AI utilizes third-party artificial intelligence services to analyze student recordings:

AssemblyAI (Transcription Service):

Purpose: Converts audio recordings to text transcripts with speaker diarization
Data Shared: Audio recordings, file metadata
Processing Location: United States
Data Usage: AssemblyAI processes audio strictly for transcription purposes and does not use customer data to train their models
Privacy Policy: https://www.assemblyai.com/legal/privacy-policy

OpenAI (AI Analysis Service):

Purpose: Analyzes transcripts to generate assessment scores and feedback on humanistic nursing behaviors
Data Shared: Anonymized transcripts (student names replaced with generic identifiers), interaction context
Processing Location: United States
Data Usage: Student data is NOT used to train AI models by default. OpenAI API does NOT use customer data for model training. We have executed OpenAI's Student Data Processing Addendum confirming that student data will NOT be used for training, model improvement, or any purpose beyond generating assessments for the specific student submission. Any use of student data for training would require explicit written agreement with the educational institution.
Privacy Policy: https://openai.com/policies/privacy-policy

Infrastructure and Data Storage

Google Cloud SQL (Database):

Purpose: Secure data storage and database management
Data Shared: All Platform data including audio files, transcripts, assessment scores, user accounts
Processing Location: United States
Security: Encryption at rest and in transit, Row Level Security policies
Privacy Policy: https://cloud.google.com/privacy

Firebase Cloud Functions (Backend Processing):

Purpose: Secure API request handling, business logic execution
Data Shared: API requests, processing instructions
Processing Location: United States
Privacy Policy: https://firebase.google.com/support/privacy

Payment Processing (for Individual Student Subscriptions)

RevenueCat (iOS In-App Purchases):

Purpose: Manage iOS subscription purchases
Data Shared: Purchase information, subscription status (no financial data stored by NurseKind)
Processing Location: United States
Privacy Policy: https://www.revenuecat.com/privacy

Subprocessor Commitments

All third-party service providers (subprocessors) have agreed to:

Maintain appropriate technical and organizational security measures
Use student data only for providing contracted services
Comply with FERPA requirements and educational data protection standards
Notify NurseKind immediately of any data security incidents
Delete or return data upon termination of services

We maintain a current list of all subprocessors and will notify Institutions of any changes to our subprocessor list with at least 30 days advance notice.

INFORMATION SHARING AND DISCLOSURE

Sharing with Institutions

We share student information with the educational institution that authorized the student's access:

Faculty/instructors can access audio recordings, transcripts, assessment scores, and performance analytics for their enrolled students
Program administrators can access aggregated performance data and analytics for their programs
Institutional administrators can access system-wide usage and performance metrics

Sharing at Student Direction

Students may share their own assessment results and feedback as they choose. The Platform may provide features allowing students to export or share their individual performance data.

Legal Obligations

We may disclose information when required by law or legal process:

To comply with valid legal process (subpoena, court order, warrant)
To comply with FERPA-permitted disclosures
To protect the rights, property, or safety of NurseKind, our users, or the public
In connection with an investigation of fraud, intellectual property infringement, or other unlawful activity

Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of assets, student information may be transferred to a successor entity, subject to the same privacy protections and with notice to affected Institutions.

What We Do NOT Do with Student Information

We do NOT:

Sell or rent student information to third parties
Share student information with third parties for their marketing purposes
Use student information for behavioral advertising or ad targeting
Create student profiles for non-educational purposes
Disclose student information to law enforcement without valid legal process (except in emergencies involving threat of death or serious bodily harm)

DATA SECURITY

Security Measures

NurseKind AI implements industry-standard security measures to protect student information:

Technical Safeguards:

AES-256 encryption for data at rest
TLS 1.2+ encryption for data in transit
Secure API authentication using JWT tokens
Multi-factor authentication for administrative access
Regular security vulnerability scanning and penetration testing
Automated security monitoring and intrusion detection

Physical Safeguards:

Data stored in SOC 2 Type II certified data centers
Redundant backup systems with geographic distribution
Disaster recovery and business continuity plans

Administrative Safeguards:

Limited Personnel Access: Currently, only two company principals (founders) have access to student data - Dr. Stacie A. Dee (CEO) and [Co-Founder]. See Personnel Disclosure document for complete details.
Both principals have completed FERPA training and signed confidentiality agreements
When employees are hired in the future, background checks will be required before data access
Mandatory FERPA and data privacy training for all personnel with data access
Principle of least privilege access controls
Audit logging of all data access and modifications
Incident response plan and procedures

Data Breach Notification

In the event of a data breach involving student education records, we will:

Notify the affected Institution within 24 hours of confirming the breach
Provide detailed information about the nature and scope of the breach
Describe the measures taken to address the breach
Offer recommendations to mitigate potential harm
Cooperate fully with the Institution's breach response procedures
Notify affected individuals as required by applicable law or at Institution's direction

DATA RETENTION AND DELETION

Retention During Active Use

While a student is actively enrolled in courses using the Platform, we retain:

Audio recordings and transcripts
Assessment scores and feedback
Performance analytics and progress data

Retention After Course Completion

After a student completes a course or program:

Data is retained for 60 days to allow for grade disputes, academic review, or late access needs
After 60 days, student data is automatically deleted unless the Institution requests extended retention

Deletion Upon Request

Institutions may request immediate deletion of student data at any time. Upon receipt of such request, we will:

Delete all student education records within 5 business days
Provide written certification of deletion
Ensure deletion from all backup systems within 30 days

Contract Termination

Upon termination of an Institution's agreement with NurseKind:

Default Retention Period: All student education records will be deleted within 30 days of contract termination
This 30-day period allows for final data exports and transition activities
Institutions may request immediate deletion (completed within 5 business days) or extended retention (by written agreement only)
Institutions may request data export in machine-readable format (CSV, JSON) before deletion
Written certification of deletion will be provided upon request
Deletion includes all copies in backup systems (completed within 60 days of termination)

Individual Student Requests

Students who wish to delete their own data should contact their Institution, as the Institution is the data controller for education records. Institutions may then request deletion on behalf of the student.

STUDENT AND PARENT RIGHTS

FERPA Rights

Students (and parents, if applicable) have rights under FERPA including:

Right to inspect and review education records
Right to request amendment of inaccurate records
Right to consent to disclosure of education records (except where FERPA permits disclosure without consent)
Right to file complaints with the U.S. Department of Education

These rights are exercised through the Institution, not directly through NurseKind. Students should contact their school's registrar or designated FERPA official.

Access to Information

Students may request access to their information stored in the Platform by contacting their Institution or by submitting a request to privacy@nursekind.ai. We will respond within 30 days.

Correction of Information

Students who believe their information is inaccurate or incomplete may request correction through their Institution. We will work with the Institution to make appropriate corrections within 30 days.

Data Portability

Students may request a copy of their data in a structured, machine-readable format by contacting their Institution. We will provide such data within 30 days of a valid request.

CHILDREN'S PRIVACY

The Platform is designed exclusively for students aged 18 and older enrolled in post-secondary nursing education programs. We do not knowingly collect information from individuals under 18. If we become aware that we have inadvertently collected information from someone under 18, we will promptly delete such information.

STATE-SPECIFIC PRIVACY RIGHTS

California

California students have additional rights under the California Consumer Privacy Act (CCPA) and Student Online Personal Information Protection Act (SOPIPA):

SOPIPA Commitments:

We will not use student information for targeted advertising
We will not create student profiles for non-educational purposes
We will not sell student information
We will not disclose student information except as authorized

CCPA Rights:

Right to know what personal information is collected
Right to delete personal information (exercised through Institution)
Right to opt-out of sale of personal information (we do not sell information)

New York

Under New York Education Law § 2-d, we provide:

Parents' Bill of Rights (available at https://nursekind.ai/parents-bill-of-rights)
Supplemental information about data collection and use
Commitment to data security and breach notification
Employee training on student data privacy

Parents and eligible students may contact their school district to exercise rights under Education Law § 2-d.

Colorado

Under Colorado's Student Data Transparency and Security Act:

We maintain a transparent list of all data elements collected
We implement comprehensive data security measures
We prohibit use of student data for targeted advertising
We provide data deletion upon authorized request

INTERNATIONAL USERS

The Platform is designed for use in the United States only. All data is stored on servers located in the United States. If you access the Platform from outside the United States, you acknowledge that your information will be transferred to, stored in, and processed in the United States.

CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Platform features. We will:

Post the updated Privacy Policy on our website with a new "Last Updated" date
Notify Institutions at least 30 days before material changes take effect
Obtain Institution consent for material changes that expand data collection or use
Maintain previous versions for Institution reference

Continued use of the Platform after the effective date of changes constitutes acceptance of the updated Privacy Policy, subject to Institution's consent rights.

CONTACT INFORMATION

For questions about this Privacy Policy or our privacy practices:

Privacy Officer

NurseKind AI, LLC

418 Broadway STE Rive

Albany, NY, 12207, USA

Email: privacy@nursekind.ai

Phone: (to be provided)

For FERPA-related inquiries, students should contact their Institution's registrar or FERPA official.

To file a complaint regarding our privacy practices:

Family Policy Compliance Office

U.S. Department of Education

400 Maryland Avenue, SW

Washington, DC 20202-8520

Website: https://studentprivacy.ed.gov/file-a-complaint

TRANSPARENCY COMMITMENT

We are committed to transparency in our data practices. Additional resources available at https://nursekind.ai/privacy:

Current list of all third-party subprocessors
Data Processing Agreement template
Security and compliance certifications
Frequently Asked Questions about student data privacy
Instructions for data access, correction, and deletion requests

This Privacy Policy is effective as of the "Last Updated" date above and applies to all information collected on or after that date.