Privacy Policy

1. About This Policy

Nurse Diary (“we”, “us”, “our”) is committed to protecting the privacy of our users (“you”, “your”). This Privacy Policy explains how we collect, use, disclose, and protect your personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and the Health Records and Information Privacy Act 2002 (NSW).

This policy applies to all personal information collected through our website at nursediary.health and our associated services.

By creating an account or using our services, you consent to the practices described in this policy. If you do not agree, please do not use our services.

2. What Information We Collect

We collect the following categories of personal information:

• Identity information: first name, last name, display name
• Contact information: email address, mobile phone number
• Profile information: date of birth, professional role (work role)
• Account credentials: hashed password, two-factor authentication secret
• Diary content: clinical diary entries, events, notes, and associated data you enter into the service
• Payment information: billing plan selection; card details are processed directly by Stripe and are never stored on our servers
• Technical information: IP address, browser type, device fingerprint, access timestamps, session data

The diary content you enter may constitute health information as defined under the Privacy Act 1988 and the Health Records and Information Privacy Act 2002 (NSW). We handle this information with the heightened care required by those Acts.

3. How We Collect Your Information

We collect personal information directly from you when you:

• Create an account or sign up for a subscription
• Log in and use the Nurse Diary service
• Enter diary events and clinical notes
• Update your account profile or settings
• Contact us for support

We may also collect limited technical data automatically through server logs, session cookies, and device fingerprinting to maintain security and detect fraudulent login attempts.

4. Why We Collect Your Information (Purpose)

We collect and use your personal information for the following purposes:

• To create and manage your account
• To provide access to the Nurse Diary service
• To process subscription payments via Stripe
• To send account setup, security, and transactional emails
• To secure your account (two-factor authentication, login monitoring, rate limiting)
• To comply with our legal obligations
• To investigate and respond to security incidents or complaints

We do not use your personal information for marketing purposes without your explicit consent. We do not sell, rent, or trade your personal information to third parties.

5. Disclosure of Your Information

We may disclose your personal information to:

• Stripe, Inc. — our payment processor. Stripe processes subscription billing on our behalf and operates under their own Privacy Policy. We share your name, email address, and mobile number with Stripe for billing purposes.
• Amazon Web Services (AWS) — our cloud infrastructure and email delivery provider, operating in the ap-southeast-2 (Sydney) region. AWS processes data on our behalf under data processing agreements.
• Law enforcement or government bodies — where required by law, court order, or to protect the rights, property, or safety of Nurse Diary, our users, or others.

We do not disclose your personal information to any other third parties without your consent.

6. Data Storage and Security

Your data is stored on servers located in Australia (AWS Sydney, ap-southeast-2). We do not transfer your personal information outside of Australia except to Stripe, Inc. in the United States, which operates under appropriate safeguards.

We implement the following security measures to protect your information:

• Passwords are stored using bcrypt hashing — we cannot see your password
• Two-factor authentication (TOTP) is required for all accounts
• All connections are encrypted using TLS (HTTPS)
• Data at rest is protected using AES-256 encryption where applicable
• Failed login attempts trigger rate limiting and account lockout
• All security-relevant events are logged and monitored
• Access to production systems is restricted to authorised personnel only

Despite these measures, no system is completely secure. In the event of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches (NDB) scheme (Part IIIC of the Privacy Act 1988).

7. Data Retention

We retain your personal information for as long as your account is active and for a period of 7 years after account closure, consistent with professional record-keeping obligations applicable to health-related information in NSW under the Health Records and Information Privacy Act 2002.

After the retention period, your information will be securely deleted or de-identified. You may request earlier deletion of your account and data subject to our legal obligations (see Section 8 below).

8. Access, Correction, and Deletion Rights

Under the Australian Privacy Principles (APPs 12 and 13) and the Health Records and Information Privacy Act 2002 (NSW) (HPP 7 and 8), you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate or out-of-date information
• Request deletion of your account and personal information (subject to legal retention obligations)

To exercise these rights, contact us at privacy@nursediary.health. We will respond within 30 days. We may require identity verification before processing requests.

We will not charge you for making an access request. If we deny access or correction, we will explain why in writing.

9. Cookies and Tracking

We use session cookies to maintain your logged-in state. These cookies are:

• Secure (HTTPS only)
• HttpOnly (not accessible to JavaScript)
• SameSite=Lax (protects against CSRF attacks)
• Retained for up to 30 days of inactivity

We do not use third-party tracking cookies, advertising pixels, or analytics platforms. Stripe may set cookies as part of its payment processing — see Stripe’s Privacy Policy for details.

10. Health Information

Diary entries you make in Nurse Diary may contain health information about you or third parties. We handle this information in accordance with:

• The 15 Health Privacy Principles in the Health Records and Information Privacy Act 2002 (NSW)
• APP 3, APP 6, and APP 11 of the Privacy Act 1988 (Cth)

Health information is used only to provide the diary service to you. It is not shared with any third party (including employers, health insurers, or government bodies) without your explicit consent, except as required by law.

Important: Nurse Diary is a personal diary tool only. It does not constitute a clinical health record or medical record under any applicable legislation. Do not rely on Nurse Diary as your sole record of clinical events.

11. Children

Our services are intended for users aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we become aware that a person under 18 has created an account, we will close the account and delete the associated data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email at least 14 days before the changes take effect. Continued use of our services after that date constitutes acceptance of the updated policy.

The current version of this policy is always available at nursediary.health/privacy-policy.

13. Complaints

If you believe we have handled your personal information in breach of the Privacy Act 1988 or the Health Records and Information Privacy Act 2002 (NSW), please contact us first:

Privacy Officer
Nurse Diary
Email: privacy@nursediary.health

We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you may lodge a complaint with:

• Office of the Australian Information Commissioner (OAIC)
  www.oaic.gov.au — 1300 363 992
• NSW Privacy Commissioner
  www.ipc.nsw.gov.au — 1800 472 679

14. Contact Us

Nurse Diary
Email: privacy@nursediary.health
Website: nursediary.health

---

This policy is governed by the laws of New South Wales, Australia. Last reviewed: 20 June 2026.