Privacy & Compliance

NurturePath is designed with HIPAA (Health Insurance Portability and Accountability Act) compliance in mind. We treat all health-related information as Protected Health Information (PHI) and implement administrative, physical, and technical safeguards to protect it.

Key HIPAA safeguards we implement:

• Access controls — only authorized users can view PHI
• Audit logs — all access to health records is logged
• Data encryption — PHI is encrypted in transit (TLS) and at rest (AES-256)
• Minimum necessary standard — we collect only what is needed for care delivery
• Business Associate Agreements (BAA) available upon request

If you believe a HIPAA violation has occurred, please contact us immediately at privacy@nurturepath.app.

We collect and process personal data solely to provide care coordination features. We do not sell, rent, or share your data with third parties for marketing purposes.

Data we collect:

• Account information (name, email, role)
• Care recipient profiles and health notes entered by caregivers
• Activity logs and shift handover records
• App usage analytics (anonymized)

Data retention: Your data is retained as long as your account is active. Upon account deletion, all personal data is permanently removed within 30 days.

Under applicable privacy laws (HIPAA, GDPR, CCPA), you have the right to:

• Access — request a copy of your personal data
• Correction — request corrections to inaccurate data
• Deletion — request deletion of your account and data
• Portability — receive your data in a machine-readable format
• Objection — object to certain uses of your data

To exercise any of these rights, contact: privacy@nurturepath.app

NurturePath is free to use during early access. All features are included at no cost, and there are no recurring subscriptions or in-app purchases.

We may introduce optional paid features in a future version; any changes will be communicated in advance and will never affect data you have already entered.

In the event of a data breach involving PHI, we will notify affected users and relevant authorities within 60 days as required by the HIPAA Breach Notification Rule.

To report a security vulnerability: security@nurturepath.app