Stat Privacy Policy

1. Who we are and what this covers

Stat is a healthcare staffing market-intelligence product operated by NursePal LLC (“NursePal”, “we”, “us”). Stat is an analytics engine and chatbot: you ask questions about U.S. healthcare staffing markets, and Stat answers with rate estimates, fill probabilities, forecasts, demand signals, and facility, agency, MSP, and VMS information computed from aggregated public job postings and NursePal’s own datasets.

This policy describes how we handle information in the Stat app for iPhone and iPad (bundle id com.nursepal.stat) and in Stat on the web at nursepal.com/stat. It is the privacy policy referenced by the Stat app’s App Store listing. Your use of Stat is also governed by the Stat Terms of Use.

Stat is an access-controlled product. Accounts are issued by NursePal to authorized users. There is no consumer sign-up, and Stat is free to the users we give access to — the app sells nothing, and we collect no payment or financial information of any kind.

NursePal also operates a separate nurse and facility marketplace at nursepal.com. If you use that marketplace, the NursePal platform privacy policy applies to it. Where the two conflict for Stat, this policy controls.

2. The short version

• The personal information we collect is your first and last name, your email address (which is your username), and your password. That is the whole list.
• No payments, no billing, no financial data. Stat contains no purchases and no subscriptions, and we never ask for a card.
• We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not track you across other companies’ apps or websites.
• Stat is not a medical or clinical product. Do not enter patient information. We do not want and do not knowingly collect protected health information (PHI) in Stat.
• You can export your data and delete your account from inside the app at any time: Settings → Account → Delete account.
• Questions or requests: support@nursepal.com.

3. Information we collect

a. Your account (personal information)

The only personal information we ask you for is:

• First and last name — so the app can address you and so we can identify your account.
• Email address — your username, and how we verify your account, reset your password, and send service messages.
• Password — stored only as a salted one-way hash. We never store or can read your actual password.

We also keep the housekeeping fields that go with an account: whether your email is verified, which version of the terms you accepted and when, your account creation date, and your most recent sign-in.

If you sign in with Sign in with Apple or Google sign-in instead of a password, we receive the same information — your email address, your name where the provider supplies it, and the provider’s stable user identifier — and no password. We never receive your Apple or Google credentials. If you choose Apple’s Hide My Email, we only ever see Apple’s private relay address, and that is the address we use to contact you.

b. Your conversations with the AI assistant

Stat is a chatbot, so using it means having a conversation with an AI model. So that your history is there when you reopen the app, we store that conversation: the questions you send, the assistant’s replies, and the charts and tables generated for you. These are your working notes, visible only to you and to the small number of NursePal staff who administer the service. We review them only to diagnose a wrong or failed answer, and we never disclose them to other customers.

c. Security and diagnostic logs

Serving a request writes the ordinary technical record: IP address, app or browser version, timestamps, and which screens or endpoints were called, plus crash and error diagnostics. We use these only to run the service, keep it secure, enforce usage limits, and fix faults.

d. Anything you send us directly

If you email us or send feedback, we keep that correspondence so we can answer you.

4. What we do not collect

• No payment or financial information. No card numbers, no billing addresses, no purchase history — Stat sells nothing.
• No health or patient data. Stat has no clinical function and asks for none. Do not enter PHI, patient identifiers, or clinical records.
• No precise location. The app does not request or use device GPS. Market questions are answered from the city, state, or ZIP you type.
• No contacts, photos, microphone, camera, calendar, or health data — the app requests none of these permissions.
• No advertising or cross-app tracking. Stat contains no third-party advertising SDKs and does not use the Advertising Identifier (IDFA). We do not ask for App Tracking Transparency permission because we do not track you across apps or websites owned by other companies.
• No sale of personal information and no sharing of it for cross-context behavioral advertising, as those terms are defined under California and other U.S. state privacy laws.

5. How we use your information

We use the information above only for these purposes:

• To create and secure your account, sign you in, and keep sessions valid.
• To answer your questions: your prompt and the relevant market data are processed to produce the response, chart, or export you asked for.
• To keep your conversation history available to you across your devices.
• To send service messages about your account — verification, password resets, access changes, and outage or maintenance notices.
• To keep the service secure and available: enforcing usage limits, detecting abuse or bulk extraction, and fixing faults.
• To improve Stat’s accuracy: diagnosing wrong answers and tuning our own models and analytics.
• To comply with law and to establish, exercise, or defend legal claims.

We do not use your information for advertising, and we do not use your conversations to build any product that identifies you. Aggregated, de-identified counts (for example, how often a specialty is searched) may inform our market analytics; those counts do not identify you or your organization.

6. AI processing of your questions

Stat uses large language models to interpret your question and phrase the answer. Your prompt, the relevant conversation context, and the market data retrieved to answer it are sent to our AI provider (currently OpenAI) for that purpose. We use commercial API endpoints under terms that prohibit the provider from using our submitted content to train its general-purpose models. We send only what is needed to answer the question.

7. How we share information

We share personal information only in the following circumstances, and never with data brokers or advertisers:

• Service providers who process data on our behalf under contract: Amazon Web Services (hosting, storage, and transactional email), OpenAI (model inference), Apple and Google (only if you choose their sign-in, and only to authenticate you), and our error-monitoring tooling.
• At your direction — for example, when you export a PDF or spreadsheet and send it to someone.
• Legal and safety — when required by law, subpoena, or legal process, or where necessary to protect our rights, our users, or the security of the service.
• Corporate transaction — in connection with a merger, acquisition, financing, or sale of assets, subject to this policy continuing to apply to the transferred information.

Equal protection by third parties. Every third party with whom we share user data is bound by written terms that require them to provide protection of that data at least equal to the protection stated in this policy, to use it only for the purpose we engaged them for, to keep it confidential and secure, and not to sell it or repurpose it for their own ends.

8. How long we keep information

• Account records — for as long as your account is open, and then as described in section 9 after you delete it.
• Conversations and generated charts — until you delete the conversation or your account. Deleted conversations are hidden immediately and are purged from backups on our ordinary backup rotation.
• Security and diagnostic logs — generally up to 24 months, then deleted or aggregated into non-identifying counts.

9. Deleting your account, exporting your data, and withdrawing consent

Delete your account from inside the app. Go to Settings → Account → Delete account (the same control exists on the web at nursepal.com/stat/settings/account). No email, phone call, or support ticket is required.

When you delete your account:

• Your name, email address, password credential, and any linked Apple or Google identity are erased from our systems.
• Every session is revoked immediately and the account can no longer be used.
• Your conversations and generated charts are removed from view and purged on our backup rotation.
• We retain only non-identifying usage counts and anything the law specifically requires us to keep.

Export your data. You can download your profile and your full conversation history as JSON from the same account screen at any time.

Withdraw consent. You may revoke the Stat app’s access from your Apple or Google account settings, disable notifications in iOS Settings, or delete your account to withdraw consent entirely. Withdrawing consent does not affect processing already carried out.

10. Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal information; to opt out of the sale or sharing of it (we do neither); to limit the use of sensitive personal information (we collect none); and not to be discriminated against for exercising these rights.

California (CCPA/CPRA) and the other U.S. state privacy laws (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others as they take effect) grant these rights to residents of those states. In the last 12 months we collected only the categories described in section 3 — identifiers (name and email), your own content, and internet and device activity — for the business purposes in section 5, and disclosed them only to the service providers in section 7. We did not sell or share personal information.

EEA, UK, and Switzerland (GDPR). Our legal bases are: performance of our contract with you (providing the service you were given access to), legitimate interests (securing the service, preventing abuse, improving accuracy), and legal obligation. You may object to processing based on legitimate interests, and you may lodge a complaint with your supervisory authority. Information is processed in the United States; where required we rely on the European Commission’s Standard Contractual Clauses.

To exercise any right, use the in-app controls in section 9 or email support@nursepal.com. We respond within the time the applicable law allows (45 days in most U.S. states, one month under GDPR) and may need to verify your identity through the email address on the account. An authorized agent may submit a request on your behalf with proof of authorization.

11. Security

Traffic is encrypted in transit with TLS. Passwords are stored only as salted hashes. Session tokens are held in the iOS Keychain on device and can be revoked from the server. Access to production data is limited to personnel who need it, and administrative access to accounts is audit-logged. No system is perfectly secure; if a breach affects your information we will notify you and the regulators as required by law.

12. Children

Stat is a business tool for healthcare staffing professionals, issued to authorized users. It is not directed to children, and you must be at least 18 years old to hold an account. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we delete it. A parent or guardian who believes a child has provided us information can write to support@nursepal.com.

13. Storage on your device

The app stores your authentication tokens in the iOS Keychain and keeps a local cache of your recent conversations and interface preferences so the app opens quickly and works during brief connectivity gaps. This local data is removed when you sign out or delete the app. On the web, Stat uses strictly necessary cookies and local storage for sign-in and preferences; it does not use advertising cookies.

14. Changes to this policy

We may update this policy as Stat changes. We will revise the effective date above, and for material changes we will notify you in the app or by email before the change takes effect. Continuing to use Stat after a change takes effect means you accept the updated policy.

15. Contact us

NursePal — Stat privacy
Email: support@nursepal.com
Web: nursepal.com/stat