NurseScript Privacy Policy
Last Updated: September 14, 2024
Overview
NurseScript Privacy Policy
Last Updated: September 15, 2024
Overview
NurseScript (“we,” “our,” or “us”) is committed to protecting your privacy and maintaining the confidentiality of Protected Health Information (PHI) in accordance with the Health Insurance Portability and Accountability Act (HIPAA) and other applicable privacy laws.
- Account credentials (username, password)
- Biometric data (Face ID/Touch ID templates stored locally)
- Device information (iOS version, device model)
- Voice recordings for transcription
- Nursing notes and documentation
- Patient care information (when applicable)
- Care plans and assessments
Usage Data
- App usage analytics (anonymized)
- Feature usage statistics
- Error logs and crash reports (no PHI included)
Primary Purposes
- Provide voice-to-text transcription services
- Generate nursing documentation and care plans
- Maintain app functionality and user experience
- Ensure data security and HIPAA compliance
Secondary Purposes
- Improve app features and performance
- Provide customer support
- Comply with legal obligations
Data Security
Encryption
- All PHI encrypted using AES-256-GCM encryption
- Data encrypted both at rest and in transit
- Voice data temporarily encrypted during API transmission
Access Controls
- Biometric authentication (Face ID/Touch ID) required
- Passcode backup authentication available
- Automatic session timeout after 15 minutes of inactivity
- Emergency data wipe functionality
Audit Controls
- Complete audit trail of all data access and modifications
- User activity logging for compliance purposes
- Automatic security monitoring and alerts
Third-Party Services
OpenAI Whisper API
- Voice recordings processed for transcription
- Data transmitted over encrypted connections
- No PHI permanently stored by third-party service
- Business Associate Agreement in place
Apple Services
- iCloud backup (optional, user-controlled)
- App Store analytics (anonymized)
- iOS security frameworks (LocalAuthentication, CryptoKit)
Data Retention
User-Controlled Retention
- Users set custom data retention periods
- Automatic secure deletion based on retention settings
- Manual deletion available at any time
Default Retention Periods
- Voice recordings: Deleted immediately after transcription
- Notes and documentation: User-defined (30 days to indefinite)
- Audit logs: 6 years (HIPAA requirement)
- Account data: Until account deletion
Data Sharing
We DO NOT Share
- PHI with unauthorized third parties
- Personal information for marketing purposes
- Individual user data with advertisers
- Unencrypted health information
We MAY Share
- Anonymized usage statistics for app improvement
- Required disclosures for legal compliance
- Data with healthcare organizations (with proper agreements)
User Rights
Access and Control
- View all stored personal information
- Export data in standard formats (PDF, text)
- Delete individual notes or entire account
- Modify retention settings at any time
HIPAA Rights (where applicable)
- Right to access PHI
- Right to request amendments
- Right to accounting of disclosures
- Right to request restrictions on use/disclosure
HIPAA Compliance
Administrative Safeguards
- Security officer appointed
- Workforce training on privacy policies
- Access management procedures
- Incident response procedures
Physical Safeguards
- Device-level security controls
- Workstation security measures
- Media controls for data disposal
Technical Safeguards
- Access control mechanisms
- Audit controls and monitoring
- Data integrity protections
- Transmission security measures
Children’s Privacy
NurseScript is designed for healthcare professionals and is not intended for use by individuals under 18. We do not knowingly collect personal information from children under 18.
International Users
NurseScript is designed primarily for healthcare professionals in the United States. International users should ensure compliance with local healthcare privacy laws and regulations.
Changes to Privacy Policy
We may update this privacy policy to reflect changes in our practices or applicable laws. Users will be notified of material changes through the app interface and email (where provided).
Privacy Officer
Email: privacy@nursescript.app
Phone: 917-864-7862
Address: 180 Cedar Street, Paterson, NJ 07501
Data Protection Officer (if applicable)
Email: dpo@nursescript.app
Support
Email: support@nursescript.app
Website: https://www.nursescript.app/support
Business Associate Agreements
Healthcare organizations using NurseScript should ensure proper Business Associate Agreements (BAAs) are executed before processing PHI. Contact us for institutional licensing and BAA execution.
Breach Notification
In the event of a data breach involving PHI, we will:
- Investigate and contain the breach immediately
- Notify affected users within 60 days
- Report to appropriate authorities as required by law
- Provide credit monitoring services if applicable
Disclaimer
NurseScript is a documentation tool and does not provide medical advice, diagnosis, or treatment. Users remain responsible for clinical decisions and compliance with institutional policies and procedures.
For questions about this Privacy Policy or our privacy practices, please contact our Privacy Officer at privacy@nursescript.app.