Privacy Policy

This policy applies to the Nightingale mobile app and website (together, the "App"), operated by My Nightingale Cares, LLC. It covers anyone who uses the App, whether or not you create an account, and anyone who receives an invitation, share link, or content sent through the App.

a. Account information. When you register, we collect your email address and password (stored only as a cryptographic hash). If you sign up with Google, we receive your email address and the name on that account. We may also keep your chosen role in the App (for example, patient or caregiver).

b. Health and wellness information you choose to record. The App is a journal and organizer — you are the author. If you choose to log things in the App, we store exactly what you type: medication names, dosages and refill dates, symptom and pain logs, mood and energy levels, hydration and nutrition entries, wound and skin care routines, rehabilitation exercises, calendar entries, packing lists, journal entries and photos, and any notes you write. You control what you record, and you can delete any of it at any time from within the App.

c. Care circle information. If you invite caregivers or family, we collect the email address of the person you invite and, once they accept, we share with them only the records you choose to share (for example, your medications, appointments, or tasks). Invitations are always initiated by you.

d. Content you choose to share publicly. Some features let you share content outside your care circle — for example, posting a reflection to Instagram or creating a public link to a rehab routine. When you use these features, that content is published under the settings you choose on the external service. We cannot unpublish content once a third-party service holds it, so please share thoughtfully.

e. Payment information. If you purchase a subscription, payments are processed by Stripe, our payment processor. We never receive or store your full card number. Stripe shares with us the facts needed to run your subscription — your Stripe customer identifier, subscription status, and renewal dates.

f. Technical information. Like nearly all apps, we and our hosting providers automatically collect basic technical records: device type, operating system, IP address, timestamps, and error logs. We use these to keep the App working and secure, not to profile you.

We use your information only to:

• operate the App you asked for — showing your tasks, logs, reminders, and history back to you;
• sync and share data with the care circle members you invite, exactly as you direct;
• provide the optional AI-assisted features you explicitly request (for example, infusion-day theme ideas, food ideas, or smoothie suggestions), which use only the inputs you provide to that feature;
• process payments and manage subscriptions;
• send service messages — password resets, invitations, and subscription notices. We do not send you marketing you did not ask for;
• maintain the security, integrity, and reliability of the App, and comply with law.

Where the law requires a legal basis (for example, under the GDPR or similar laws), our bases are: performance of our contract with you (running your account and features), your consent (public sharing, AI features, and optional analytics), and our legitimate interests in securing and improving the App. You may withdraw consent at any time by turning the feature off or deleting the content.

We do not sell, rent, or trade your personal information. We never have. Full stop. Beyond that, we share your information only in these limited circumstances:

• People you choose. Your care circle members see only the records you share with them. Public share links are visible to anyone who has the link, which is their purpose — create them only if you want that.
• Instagram and other third-party services you connect. When you post to Instagram from the App, your content and caption go to Meta under Meta's own terms and privacy policy.
• Service providers. We rely on a small set of vetted providers to run the App: our cloud hosting and database provider, Stripe for payments, and the AI providers behind the optional AI features. These providers process your data only on our instructions, under contractual confidentiality and security obligations.
• Legal requirements. We may disclose information if required by law, court order, or valid legal process, or to protect the rights, property, or safety of our users, ourselves, or the public. If we are ever legally compelled to disclose your health records, we will challenge overbroad requests where the law allows.
• Business transfers. If Nightingale is ever acquired or merges with another company, your data would transfer with it — under this policy until you are notified of a change.

We want to be precise here, because precision protects you. Nightingale is a self-directed wellness and organization tool. It is not a healthcare provider, pharmacy, hospital system, or insurer, and we are not a "covered entity" or "business associate" under HIPAA. That law does not apply to us — so we voluntarily hold ourselves to standards at least as protective. We designed the App so that, by default, the health information you log is visible only to you and the care circle members you personally invite. Your entries are never used to advertise to you, sold, or fed into any training set, and we do not build advertising profiles from your health data. The App does not provide medical advice; always follow your care team's guidance.

The App is intended for adults managing their own care or supporting someone else's. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Before any social feature is enabled — posting to Instagram, creating public share links, or viewing shared user content — the App requires the user to declare their age range, and users under 13 are denied access to those social features and to publicly shared user content. If we learn that we have collected information from a child under 13, we delete it promptly. Parents may contact us through the App's Contact page with any concern about their child's data.

We keep your records for as long as your account is active, so your history is there when you need it. If you delete an entry, it is deleted. If you delete your account or ask us to erase your data, we delete your personal information, except where we must retain a narrow set of records (such as transaction records) to comply with tax, accounting, or legal obligations — and even then it is used only for that purpose. Backups age out on a fixed schedule; residual copies are not recoverable to us after that cycle completes.

We protect your information with industry-standard safeguards: encryption in transit, hashed passwords, strict per-record access controls so one user can never see another's private records without permission, and least-privilege access for our own team. No system is perfect, and we cannot promise absolute security — but if we ever discover a breach affecting your information, we will notify affected users and regulators as the law requires, and we will tell you plainly what happened and what we are doing about it.

Wherever you live, we honor these requests — and in many places the law entitles you to them: to access a copy of your data; to correct it; to delete it; to know who it has been shared with; to receive it in a portable format; and to object to or restrict processing. Residents of California and other states with similar laws may also opt out of any "sale" or "sharing" of personal information — though, as noted above, we do not sell or share it in those senses in the first place. We do not discriminate against you for exercising any right. To make a request, use the Contact page in the App or email us; we will respond within the timeframe your law requires, and we may verify your identity first — only to make sure we hand your data to the right person.

The App is operated from the United States. If you use it from another country, your information is transferred to and processed in the United States, and we apply the protections described in this policy to that processing.

We may update this policy as the App evolves. The "last updated" date at the top will always reflect the current version, and if a change materially reduces your protections, we will notify you in the App before it takes effect. The published version at our website's privacy page is the authoritative one.

Questions, requests, or concerns about privacy can be sent to My Nightingale Cares, LLC through the App's Contact page. We read everything, and privacy requests are handled as a priority.

This policy is provided for informational purposes and describes the practices of My Nightingale Cares, LLC with respect to the Nightingale App. It is not legal advice.