Privacy policy

What we collect

Account details: your name and email address, because an account needs one and your reports are emailed to you; your track (NCLEX-RN, NCLEX-PN or Nursing School); your plan and when it ends; a password hash if you set a password, and the public half of a passkey if you add one. We never see or store the passkey itself or your card number.

Your study: every answer you give, how long each one took, how long you read a rationale, the questions you star, your notebook entries and your flashcard schedule. This is what section scores, readiness bands, the Predictor and your study history are computed from.

Exam integrity: for the free readiness exam, a random device identifier your browser keeps so the one-sitting rule can be applied, and the IP address of the request, kept on the sitting record for fraud review. In secure mode, a record of each departure from a sitting (the time and the question you were on). The country and region a sign-up or sitting came from, resolved at the edge from the request.

Payments: the plan, the amount and the date, and the Stripe identifiers that let us find the charge. Stripe holds the card.

Support and reports: what you write to us, and the question you reported with the reason.

Contact and partnership messages: if you write to us through the form on the Contact or Partner with us page, we collect your name, email address, organization, school or social handle, the topic, your message, and the website and audience size if you give them. We use them only to reply to you about your message or a partnership. They are delivered to our team at info@lumennursing.co, kept for two years after our last reply, then deleted. If you tick the box for partner news, that consent is recorded with its date and you can withdraw it at any time.

Technical: the ordinary server logs any website keeps (the page requested, the time, the browser, the IP address) for security and to keep the service running. We do not run advertising trackers. On the public pages, and never inside the app or an exam, we count visits with Plausible, a cookieless analytics service that sets no cookies and stores no personal data.

Why we use it

To provide the service you signed up for: serving questions, scoring them, computing readiness, emailing reports and receipts, resuming a session where you left it.

To keep it honest and secure: applying the one-sitting rule, recording secure-mode departures, detecting fraud and abuse, and keeping the bank statistically sound. Aggregate item statistics (how often a question is answered correctly, how long it takes) are derived from everyone’s answers with no account attached.

To tell you things: codes that sign you in, reports, receipts, renewal notices, replies to your messages. Separately, and only if you agreed, study nudges and offers.

To improve the bank: a reported question is reviewed by a nurse editor; patterns in answers show us where a rationale is unclear or a key is wrong.

Where European or UK law applies, our legal bases are: performing our contract with you (the service itself), our legitimate interests (security, fraud prevention, improving the bank, telling existing customers about closely related products), your consent (marketing where we ask for it), and legal obligations (tax and accounting records).

What a school can see

If you claimed a seat paid for by a school, that school sees your progress, named per student, because that is what they bought: questions answered, section scores, readiness, how often you practice, and secure-mode records from exam sittings.

A school never sees an individual answer, never sees your notebook or flashcards, and cannot reach another school’s students. When their access period ends, so does their view. If you also use the account on your own after that, nothing new is shared with the school.

Who else touches it

We use a small number of service providers who process data on our instructions and are bound by contract to use it for nothing else: Supabase (database and file storage), Vercel (hosting and edge network), Resend (email delivery), Stripe (payments), Plausible Analytics (cookieless, privacy-friendly visit counts on the public pages) and Cloudflare Turnstile (a check on the contact and partnership forms that tells people apart from automated spam; it sees technical details of the request, not your message). Each sees only what it needs to do its job.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We may disclose information if the law requires it, to protect the rights and safety of students or the company, or as part of a merger or sale of the business, in which case this policy continues to apply to it.

Cookies and local storage

We set only first-party cookies, and no third-party cookies. On the public pages, lumen_src records how you first found us (a campaign tag or the referring site, and the first page you landed on), and lumen_last records the campaign tag of a later visit that carries one. Each lasts 60 days and is used only to tell which channels bring students.

If you arrive through a referral or partner link, ln-ref remembers that code for 90 days so the referral is credited. When you sign in, ln-session keeps you signed in for 30 days, and, if you choose it, a trusted-device cookie lets a known device skip the emailed code for 30 days. Staff using the console have their own sign-in cookie. Your browser also keeps a few preferences and the readiness exam’s device identifier in local storage. None of these is used for advertising.

How long we keep it

Your account and study data are kept while the account is open, so your history is there when you come back. When you delete the account we delete your profile, answers, notebook and flashcards within 30 days. Aggregate item statistics, with no account attached, stay, because they are what keeps the bank honest.

Readiness-exam sitting records (email, device identifier, IP address, result) are kept for as long as the one-sitting rule needs them. Payment records are kept for seven years as tax and accounting law requires. Server logs are kept for a short period for security, then discarded.

Security

Data is encrypted in transit and at rest. Sign-in is by password with optional passkey, or by a one-time emailed code; repeated failures are rate-limited. Access to student data inside the company is limited to the people who need it to run the service and support you, and every administrative action is written to an audit log. No system is perfectly secure; if a breach ever affects your data we will tell you and the regulator as the law requires.

Your rights

Wherever you live, you can ask us to tell you what we hold about you, correct it, give you a copy, or delete it, and you can object to or restrict a use of it. Email us from the address on the account and we will act within 30 days, usually much sooner. We will not treat you differently for exercising a right.

We do not sell or share personal information as those terms are defined under California law. If you live in California you may use an authorized agent to make a request; we will verify it through the account email.

Do Not Track: our site does not respond to browser Do Not Track signals; we do not track you across other websites.

If you are in the European Economic Area or the United Kingdom, the GDPR and UK GDPR give you these rights, the right to withdraw consent at any time, and the right to complain to your data-protection authority. Data is processed in the United States; where we transfer it from the EEA or UK we rely on our providers’ standard contractual clauses.

Email

We email you the code that signs you in, your readiness report, receipts, renewal notices and replies to your messages. Those are part of the service and cannot be turned off while the account is open.

Study nudges and offers are separate: you can unsubscribe from them at any time from the link in the email or from Settings, without losing anything else, and nudges are capped at one per student per week. Every marketing email carries our postal address (1401 21st St, Ste R, Sacramento, CA 95811) and an unsubscribe link, as the CAN-SPAM Act requires.

Children

Accounts are for people aged 18 and over. The service is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has given us information, email us and we will delete it.

Changes and contact

If we change this policy materially we will say so by email to the address on your account before the change takes effect, and we will update the date at the top of this page.

Questions or requests: info@lumennursing.co, or by post to Lumen Nursing Education Group LLC, 1401 21st St, Ste R, Sacramento, CA 95811.