Appalachian Exam Coach — Nursing Coach Privacy Notice
1. Scope and controller
Appalachian Integrity LLC controls the account and study information described here. This notice covers Nursing Coach at learn.appalachianintegrity.com/nursing and its identified mobile interfaces. Other Appalachian Integrity products have their own notices and accounts; one product does not authorize reuse of another product's data. The web service is hosted by Bluehost. Transactional messages use the Company's hosting email service from john@appalachianintegrity.com. Hosted Stripe processes the website purchase using the Company's existing Stripe account. Provider processing and retention remain subject to the categories and limits described below. Contact john@appalachianintegrity.com or (540) 524-2290 for privacy questions.
2. Information processed
Account records include your email, display name, adult-status acknowledgment, account identifier, password hash and account timestamps. Passwords are not stored in plaintext. Verification, password-reset and invitation records use hashed tokens. Study actions may be processed on your device; the progress sent to our server consists of event identifiers, question and category identifiers, scores and timestamps. Raw recognized speech is not part of the saved progress record. Agreement evidence includes account reference, displayed legal versions and exact document hashes, timestamp and consent choices; the backend records an HMAC-derived IP reference. Security and audit events include an account reference, action, timestamp, request identifier and HMAC-derived IP reference. An HMAC reference is pseudonymous and may remain linkable; it is not a promise of anonymity. Host access logs may separately include IP address and user-agent. Support messages contain what you choose to send. Do not send patient information, government identifiers, passwords or full payment credentials.
3. Payment and recipients
A payment provider receives the billing information you give it and the order details needed to process a one-time purchase. Website purchases use Stripe-hosted Checkout, passing account email and product metadata. The app server does not receive full card numbers through hosted Checkout. The app retains transaction identifiers, purchase status and entitlement evidence. Hosting, transactional email and payment providers process data for the service; authorized Company personnel may access it for support, security, operation and legal duties. External providers may have independent obligations and their own policies. We may disclose information when law requires it or as reasonably necessary to investigate misuse or protect legal rights. A business transfer remains subject to applicable notice and data-use obligations. No advertising networks, sale of study data, targeted-advertising profiles or generative-AI processing are implemented in this app.
4. Purposes
We use these records to authenticate you, verify email, reset passwords, authorize invitations, save and synchronize study progress, grant paid access, reconcile purchases, deliver service notices, investigate errors or fraud, secure the service and meet supported financial or legal obligations. We do not create clinical records, provide patient care or use study performance to decide employment, credit, insurance or licensure. This notice does not characterize ordinary nursing study as a HIPAA-covered clinical service. New processing requires a truthful updated notice and any consent required by law.
5. Device storage and voice
Necessary cookies maintain sign-in sessions; blocking them can prevent authentication. Browser storage may hold app preferences and working state. Clearing it, changing profiles or losing a device can remove local information. Microphone access is optional; screen answers remain available without it. Android recognition may use a supported on-device recognizer or a system speech provider that sends audio to remote servers; provider retention varies. On-device or offline operation is not guaranteed. The Android feature presents a provider notice and requires deliberate microphone setup while stationary and a device permission choice. Listening uses short foreground sessions and is canceled on pause, navigation, sign-out or backgrounding; the app provides no always-on or background listening. Nursing Coach temporarily processes recognized text into an answer or command on your device. It does not make or store its own microphone audio recordings, persist raw recognized text, or upload that audio or text to the Nursing Coach application server. The saved progress fields described in section 2 do not include raw transcripts. Browser speech recognition and read-aloud also depend on your selected browser, platform or voice and may involve their providers. Processing and retention by an outside speech provider depend on its policy and your device configuration; stopping the app does not delete that provider's records. Avoid speaking patient information or other sensitive personal details. You may deny or revoke microphone permission and continue with screen answers. Provider settings, device permissions and app controls are separate choices.
6. Retention and deletion
Active account and progress information remains while the account operates, subject to service needs, applicable law and deletion controls. Application retention settings are 400 days for security/audit records and 30 days for contact-bearing completed checkout state. Necessary purchase and agreement evidence is retained while an account is active and for 2,555 days after account deletion, with a pseudonymous account reference. Expired email tokens, obsolete rate limits and eligible expired invitations are removed through maintenance. We use scheduled or administrative maintenance to enforce eligible application retention limits; those limits do not promise the same deletion schedule for every outside provider. We retain only categories supported by the purpose; a financial ledger does not require preserving every profile field or study answer. After verified account deletion, active contact/profile fields, credentials, tokens and progress are removed, and contact-bearing checkout data is scrubbed. Restricted purchase, agreement and audit evidence may remain for the supported financial, security or legal period. Exact historical legal-document copies contain the applicable notice text, rather than a learner's study answers. A legal hold may defer deletion of the specific relevant records. Backups, mail copies, host logs and Stripe records have separate schedules; removal from the active application database is not immediate erasure from all copies. Bluehost backup and host-log schedules and outside speech-provider retention are not controlled or promised by this application notice. We explain retained categories and reasons on a request. Deletion restrictions do not override nonwaivable privacy rights.
7. Access and requests
Use account controls to export profile, progress, agreement and purchase metadata or request account deletion after identity verification. Export does not require buying the upgrade. You may also email john@appalachianintegrity.com for access, correction, deletion, portability or an applicable opt-out; creating a new account is not required solely to submit a request. We verify identity proportionately and explain actions, retained categories and supported reasons. If self-service deletion is interrupted by an unresolved payment or technical condition, contact support; a payment disagreement does not override a nonwaivable privacy right. Where the Virginia Consumer Data Protection Act applies, response periods are generally 45 days, with a permitted extension and notice, and appeals are answered within 60 days. To appeal a denied request, reply to the response or email the same address with Privacy appeal in the subject. A denied covered Virginia appeal includes information about contacting the Virginia Attorney General. Other applicable jurisdictions may provide additional rights. Statutory coverage depends on facts and thresholds; this notice does not waive those rights or declare the Company categorically exempt.
8. Security and adults
The application uses hashed passwords and tokens, access controls and protected sessions. The web service uses HTTPS; appropriate operational safeguards remain necessary. No system is guaranteed immune to unauthorized access, and no security certification is claimed. We investigate incidents and provide notifications required by applicable law. This adult study product is not directed to children and requires users to be 18 or older. If you believe a child supplied information, contact us for investigation and appropriate deletion. Do not put real-person health information into educational scenarios or support reports.
9. Notices and changes
Verification, reset, purchase and security emails are service communications. Marketing email is not required for account access and no marketing list is implemented in this build. Any future marketing requires a separate compliant process. We give appropriate advance notice of material privacy changes and obtain consent for a new purpose where required; posting a notice cannot retroactively authorize an impermissible use. Prior applicable notices remain available. This version identifies the service providers and application retention settings used for the early release. We update this notice when material processing changes.