NurseSuite — Privacy Policy
Effective July 16, 2026 · NurseSuite LLC, a Maryland limited liability company
This Privacy Policy explains how NurseSuite LLC (“NurseSuite,” “we,” “us”) collects, uses, shares, and protects information when you use our websites, mobile applications, and related services (the “Service”). NurseSuite helps nursing institutions prepare for accreditation and regulatory survey readiness and improve nursing workflow. The Service is built on a no-PHI principle and is not a medical device. Where a separate written agreement or Business Associate Agreement (BAA) applies, that agreement governs to the extent of any conflict.
• Business contact data: name, work email, organization, role, and any message you submit through demo or contact forms.
• Account data: institutional user login credentials for the Service; passwords are stored salted and hashed, never in plaintext.
• Operational and compliance content you submit: non-PHI content such as policy documents, audit/tracer/readiness records, accreditation-standards content, and de-identified, unit-level operational summaries.
• Usage and log data: limited technical data such as IP address, browser/device type, pages viewed, and timestamps, used to operate and secure the Service and retained for up to 12 months.
We do not collect protected health information (PHI) or direct patient identifiers (patient names, MRNs, dates of birth, diagnoses, or clinical results) by design, and you should not submit them to the Service.
We use information to provide, operate, secure, and improve the Service; to authenticate users and administer accounts; to respond to inquiries and provide support; to power optional AI-assisted features (see Section 4); and to comply with legal obligations. We do not sell personal information, and we do not use it for third-party advertising.
Certain optional features use third-party artificial-intelligence (large language model, “AI”) services to assist you — for example, a compliance assistant, policy gap analysis, and paraphrasing of accreditation-standards content. To provide these features, the Service sends limited non-PHI text (such as your policy documents, standards content, and de-identified operational summaries) to the applicable AI provider, which processes it on our behalf as a service provider / subprocessor. We do not knowingly send protected health information to AI providers.
The AI provider is configurable and may change. AI providers used or available for the Service include OpenAI (model gpt-4o-mini). The provider currently in use and a current subprocessor list are available on request to customer@nursesuite.com. OpenAI does not use API-submitted data to train its models by default, and a DPA is available. AI output may be inaccurate and is decision support only; it must be reviewed by qualified personnel before you rely on it.
We share information only with service providers that process it on our behalf under contract, and as required by law. Our subprocessors include:
• Amazon Web Services: cloud hosting (Lightsail), DNS (Route 53), and related infrastructure — United States.
• AI / LLM providers: OpenAI (model gpt-4o-mini), for the optional AI features described in Section 4 (non-PHI text only).
• Email delivery: Resend (transactional email), used to send account and notification emails when enabled.
• Web fonts: the public marketing site loads typography from Google Fonts.
We may also disclose information to comply with law, enforce our terms, or protect the rights, safety, and security of NurseSuite, our customers, or others. We do not sell or share personal information for advertising. A current subprocessor list is available on request.
We retain information for as long as needed to provide the Service and for legitimate business or legal purposes. Business contact data is retained until the inquiry is resolved (and no longer than 24 months) and deleted on request to customer@nursesuite.com. Operational data retention follows the applicable agreement. On contract termination, we return or destroy customer data within 30 days as specified in that agreement. Usage and log data are retained for up to 12 months; backups purge on their normal rotation (within 30 days).
We use administrative, technical, and physical safeguards appropriate to the non-PHI nature of the data, including encryption in transit (TLS), access controls, and hosting on AWS infrastructure. See the NurseSuite Security & Privacy Overview for details. No method of transmission or storage is completely secure.
Depending on your location, you may have rights to access, correct, delete, or port your personal information, and to opt out of certain processing. Residents of California and other U.S. states with applicable privacy laws (where applicable) may exercise the rights those laws provide; we do not sell personal information. To make a request, contact customer@nursesuite.com. We will verify and respond as required by applicable law.
Our websites do not use advertising or analytics cookies or third-party trackers. The public marketing site loads web fonts from Google Fonts; the application uses only a strictly-necessary session cookie to keep you signed in.
The Service is intended for institutional and professional use and is not directed to children. We do not knowingly collect personal information from children.
The Service is hosted in the United States (AWS, US East region). If you access the Service from outside the United States, you understand that your information will be processed in the United States.
NurseSuite is designed to avoid creating, receiving, storing, or transmitting PHI. If a feature ever requires PHI, we will execute a BAA and apply the corresponding HIPAA safeguards before that feature is enabled for your organization.
We may update this Privacy Policy from time to time. Material changes will be communicated by updating the effective date on this page and, where appropriate, notifying account administrators. Your continued use of the Service after changes take effect constitutes acceptance.
Privacy questions or requests: customer@nursesuite.com · NurseSuite LLC (a Maryland limited liability company); mailing address available on request.