Privacy policy

Who we are

This service is run by Epitome Solutions. In this policy, we and us mean Epitome Solutions. This service means our website and our phone app. They help internationally educated nurses prepare for licensing exams and plan the steps to register in another country. The product name may change. This policy will still apply.

Company details: [to be confirmed: full legal name, country of registration and postal address of Epitome Solutions]

This policy covers this service only. It does not cover other websites that we may link to, such as the websites of regulators and exam providers.

What we collect

We collect what the service needs to work. Some details are required. Many are optional.

Your account

• Your email address.
• A password. We keep only a scrambled copy of it, called a hash. We cannot read your password.
• A name, if you choose to enter one.
• How you signed in, when your account was made, and when you were last seen.
• The role of your account. Most accounts are for learners. A few are for nurse reviewers or for Epitome staff.

What you tell us

• The country where you want to register, as a first choice and, if you wish, a second choice.
• Where you trained: the country, the type of nursing qualification, the year you finished, and the years you have worked as a nurse.
• Your language choices.
• Your country. The app reads the region setting of your phone and asks you to confirm it. We do not use GPS or your exact location.
• Your choices about the optional uses of your information (see the section on why we use your information).
• Your exam date, the days you plan to study and the minutes a day, if you enter them in the app. For now these stay on your phone. We do not receive them.

What you do in the service

• Practice and test sessions: which questions you were shown, your answers, how long you took, whether you used a hint, and your scores.
• Timed mock tests, when you take them: the questions, your answers, the time and your results.
• A skill estimate that we calculate from your answers, and a readiness band that we calculate from timed mock tests. These are estimates on our own scale. They are not exam scores.
• The question sets you download to use offline.
• The codes you enter, including codes that did not work, and the premium access that a code gave you.
• How many free practice questions you used each day.
• A log of these actions with the time. Each entry also records the kind of device (Android, iOS or web), the version of the app, and whether you were offline. We use this log to rebuild your skill estimate and to find errors.

Dates you confirm in the pathway planner

The pathway planner asks for dates that you confirm yourself. Examples are the day you took an English test, paid a fee, registered for an exam, or received a result. This can include the date of a pass result or a fail result for the NCLEX-RN or the OSCE. The planner also keeps the type of English test, your stream from the Ahpra self-check, and whether you will sit the exam outside Australia.

All of this is optional. Enter only what you want to enter. We keep only the facts you enter. We work out the plan again each time you open it.

Device and technical information

• Sign-in records. Each time someone tries to sign in or sign up, we record the email address used, whether it worked, and the time. We also record a scrambled form (a hash) of the network address, which is called the IP address. We use these records only to block repeated guessing. A daily job deletes records that are more than 7 days old.
• Our hosting provider and our database provider can see technical details when you connect. Examples are your IP address, your browser or device type, and the pages and requests you make. They keep their own server logs. Details are in the sections on who can see your information and how long we keep it.

What stays on your phone

• Your sign-in token, in the secure storage of the phone.
• The questions you downloaded for offline use, your answers that are not yet sent to us, and a saved copy of your pathway plan. These are kept in an encrypted database on the phone. The key for it is in the secure storage of the phone. [to be confirmed: encryption of the offline database to be checked on a real Android phone before launch]
• Your exam date and study settings, if you entered them. They stay on the phone until you remove the app.
• When you sign out of the app, it removes the downloaded questions, the answers that were not yet sent, and the saved plan from the phone. Answers that were not yet sent are lost.

What stays in your web browser

On the website, your browser keeps a sign-in token, your account reference number and the time the token ends. This is kept in the local storage of your browser. The website removes it when you sign out or when the token ends after 14 days.

What we do not collect

The service does not ask for your exact location, your contacts, your photos, your camera, your microphone or your payment card details. It does not take uploads of documents today. It does not send push notifications today. It has no advertising identifiers, and no analytics or crash-reporting tools from other companies.

Why we use your information

We use your information for the purposes below. For each one we give the reason we are allowed to do it.

To run your account and sign you in

Reason: you asked for the service, and we need this to give it to you.

To give you practice, tests, your pathway plan and your premium access

Reason: you asked for the service.

To keep the service safe

For example, to block repeated password guesses and misuse of codes. Reason: we have a real need to protect the service and its users, and the information we use for this is small.

To keep the questions accurate

We combine answers from many learners, without names, to see how hard each question is and to find mistakes. Reason: the same need to keep the service accurate.

Optional uses, only if you agree

There are four. (1) Reading documents you upload, with AI. This is not available today. (2) Sharing your pathway stage and readiness band with a partner organisation. This is not available today. (3) Sending you product and study emails. We send none today. (4) Using the exam result you report in totals for groups of at least 100 learners. We publish no such totals today. Reason: your consent. You can change these choices in the phone app.

To obey the law and answer lawful requests

[to be confirmed: lawyer to list the legal duties that apply to Epitome in each country]

The app asks you to agree to these choices at the end of setup. The first choice, to process your study data to run the app, is required. If you do not agree to it, you cannot use the app. We do not sell your information. We do not use it for advertising.

Who can see your information

• You can see your own information in the service.
• Epitome staff who run the service can see it when they need to, to run the service, fix problems, protect it and answer your requests.
• Nurse reviewers check practice questions. They can see questions and the history of reviews. They do not see the answers or profiles of learners.
• The companies that host the service. Vercel hosts the website and the programs that run it. Supabase hosts the database. They store and handle your information for us. [to be confirmed: data processing terms signed with each provider]

Partners. No partner organisation receives your information today. In the future, a partner, for example a consultancy that gives you a code, could see your pathway stage and readiness band only if you agree. Partners never see your answers, your question results, your documents or your payments.

Other companies. We do not give your information to advertisers, data brokers, analytics companies, payment companies or AI companies. We do not send anything to Ahpra, NMBA, NCSBN, Pearson VUE or any other regulator or exam provider. This service is independent of them.

The law. We may share information if a law or a court order requires it. [to be confirmed: lawyer to confirm the wording and the rules for each country]

AI and automatic calculations

Today, no information about you is sent to an AI model or to an AI company. The service does not have an AI coach or an AI planner yet. We use AI tools to help write draft practice questions. Our rule is that a registered nurse must approve each question before a learner sees it. No information about learners is used to write questions.

If we add AI features later, we will change this policy first. We will remove personal details, such as names and email addresses, before any text goes to an AI provider. We will not let anyone train an AI model on your information unless you give a separate and clear consent.

The service calculates a skill estimate and a readiness band from your answers. This is a statistical formula. It is not a chat model. It does not decide anything about your registration, your visa or your job. You can ask us how it works.

Where your information is stored

The programs that run the service are set to run in the Singapore region of Vercel (sin1).

The database is set up with Supabase in the Singapore region (ap-southeast-1) according to our setup notes. [to be confirmed: check the region in the settings of the live Supabase project]

This means your information is handled in Singapore, even if you live in Nepal, India, the Philippines or another country. The two providers are companies that work in several countries, and their staff may reach our data from other countries to support their services. [to be confirmed: where each company is based, from which countries its staff can reach our data, and the legal basis for moving data between countries]

Your phone keeps its own copy of some information for offline use, as described above.

How long we keep your information

Sign-in records

Deleted when they are more than 7 days old. A daily job does this.

Your account, profile, choices, answers, test results, pathway dates, codes and access records, and the activity log

Kept until you delete your account. You can do this yourself at any time. We do not delete these automatically today, not even for accounts that nobody uses. [to be confirmed: whether Epitome will set a time limit for unused accounts]

Information on your phone

Downloaded questions, answers not yet sent and the saved plan are removed when you sign out of the app. Your exam date and study settings stay until you remove the app.

Server logs kept by our providers

[to be confirmed: how long Vercel and Supabase keep their logs on our plans]

Backups

Our database provider may keep backup copies. Deleting your account does not change a backup. A backup may still hold your information until that backup expires. [to be confirmed: backup period for the production database, and the backup policy]

Records we must keep by law

[to be confirmed: lawyer to say whether any record must be kept, and for how long]

When you delete your account, we erase the account and the information linked to it from our live database. This includes your email address, your answers, your pathway dates, your premium access and the activity log. Two records stay, without your name. A code that you used stays marked as used, so that nobody can use it again. If you were a nurse reviewer, the record of each decision on a question stays for the safety of the questions, under a label that is not your name. [to be confirmed: lawyer to confirm that these two records may stay]

Your choices and rights

The law where you live may give you rights over your information. We want to help you use them, in whatever country you live. This is what you can do now. You can download your information and delete your account yourself. We do not have self-service buttons for every right yet, so for some of them you need to write to us.

See your information

The app and the website show many details, such as your profile, your choices, your premium access and your pathway dates. You can also download a copy of the information we hold about you as one file. On the website, open Account, then Download my data. In the phone app, open Account, then Privacy centre, then Download my data. The file does not include answer keys or explanations of questions.

Correct your information

You can change your profile in the app and your pathway dates in the app and on the pathway page of the website. For anything else, write to us.

Take back an optional choice

In the phone app, open Account, then Privacy centre, and switch off any optional choice. The website does not have this screen yet. Write to us and we will change it for you. The required choice cannot be switched off while you use the service. To take it back, delete your account.

Delete your information

You can delete your account yourself. On the website, open Account, then Delete my account. In the phone app, open Account, then Privacy centre, then Delete my account. You enter your password again and type the words delete my account. When you confirm, the live database is cleared in one step, straight away, and every sign-in on every device stops working. If something goes wrong, nothing is deleted and the page tells you so. We cannot undo a deletion. A backup is not changed (see how long we keep your information). If you cannot use the button, write to us and give the email address of your account. [to be confirmed: how we check that the person who asks owns the account, because email addresses are not verified] [to be confirmed: number of days we need to delete an account when you write to us]

Ask us to stop or limit a use

Write to us and tell us what you want us to stop.

Make a complaint

Please tell us first, and we will try to put it right. You may also complain to the data protection authority in your country. [to be confirmed: lawyer to list the authority and its contact for each country we serve]

How fast we answer

We will answer within [to be confirmed: number of days] days.

To make a request, use the contact details at the end of this page.

Children

This service is for adults. You must be 18 or older to use it. We do not knowingly collect information from anyone under 18. If you think a child has given us information, write to us and we will delete it.

Cookies, tracking and advertising

The website keeps your sign-in in the local storage of your browser, as described above. We need this to keep you signed in. We do not use advertising cookies, advertising identifiers, analytics tools or tracking pixels. These pages do not load scripts or fonts from other companies. [to be confirmed: check again before launch, after the website design changes]

How we protect your information

• Connections are encrypted, both between your device and our servers and between our servers and the database.
• Passwords are stored as a hash made with a strong one-way method, so we cannot read them.
• Codes are stored as hashes. A copy of the database would not list working codes.
• A sign-in lasts 14 days. It stops at once if your password is reset or your account is turned off.
• After 5 wrong passwords for one email address, sign-in for that address is blocked for 15 minutes. Other limits apply to a network address and to code entry.
• Apps and browsers cannot write to the database. They can read only the rows that belong to the signed-in user. Our server does all the writing.
• Offline information on the phone is encrypted, as described above.

We are honest about limits. We do not check yet that an email address belongs to you. There is no password reset button, so we reset passwords by hand. No system is perfectly safe, and we cannot promise that nothing will go wrong. If a security problem affects your information, we will tell you as the law requires. [to be confirmed: process and deadline for telling you and the authorities, by country]

Changes to this policy

We may change this policy. We will put the new version on this page and change the date at the top. If a change is important, we will tell you in the app. [to be confirmed: how we will tell you, because email addresses are not verified yet] If a change needs your consent, we will ask you again.

Contact

For questions or requests about your information, write to: Contact details will be added before launch

Please include the email address of your account, so that we can find your records. Do not send your password.

Postal address and named privacy contact: [to be added by Epitome]

The rules for using the service are in the terms of use.