Privacy Policy

Our commitment to you

Nurty is built on trust. We never sell your personal data, never share session contents without your consent, and give you full control to delete your account and all associated data at any time.

⚠ Pilot notice (read me)

Nurty is currently in a structured clinical pilot with a small cohort of licensed therapists and their clients. During this pilot:

Features, flows, and data-handling practices may evolve based on clinical feedback. We will notify you of material changes at least 14 days in advance.
Pilot data is collected to evaluate clinical safety, effectiveness, and usability. It is processed under the same security controls as production data and is never sold or used for advertising.
You may withdraw at any time, request a full export of your data, or request permanent deletion. We will action requests within 30 days.
If Nurty winds down or is sold during the pilot, we will give you at least 30 days’ notice and offer you an export of your data before any transfer or deletion.
Nurty is not yet a medical device and is not FDA-cleared or Health Canada–licensed. It is a supportive tool used alongside the work you do with your therapist — not a substitute for clinical care.

By using Nurty during the pilot, you acknowledge this status and consent to participate. Questions: privacy@nurty.co.

1. What we collect

We collect information you provide directly (name, email, session responses) and usage data to improve the product (anonymized analytics, error logs). We do not collect sensitive health data beyond what you voluntarily share in sessions.

2. How we use your data

Your session data is used exclusively to power your personalized therapy experience. We use aggregated, anonymized data to improve our AI models. We never use your personal conversations to train models without your explicit consent.

3. AI processing & third-party data sharing

Your therapy conversations are processed in real time by Anthropic's Claude AI to generate responses. Messages are sent to Anthropic's servers via encrypted HTTPS connections and are not retained by Anthropic after processing (per Anthropic's zero-retention API policy). Voice features use OpenAI Whisper for transcription and ElevenLabs for text-to-speech. No third-party AI provider stores your conversation data after processing. We do not sell, share, or use your therapy data for advertising purposes.

4. Data storage & security

All data is encrypted at rest (AES-256) and in transit (TLS 1.3). Authentication tokens and calendar credentials are encrypted with AES-256-GCM. We enforce rate limiting on all API endpoints, require authenticated access for all sensitive operations, and apply row-level security policies to ensure users can only access their own data. We conduct regular security audits.

5. Sharing with therapists

If you are connected to a licensed therapist through Nurty's Supervisor feature, your therapist may have read access to session summaries. You control which therapists have access and can revoke access at any time. Therapist access requires license verification and can be revoked by you at any time.

6. Third-party services

We use trusted third-party services for authentication (Supabase), payments (Stripe), AI therapy responses (Anthropic Claude), speech transcription (OpenAI Whisper), and voice synthesis (ElevenLabs). Each provider processes data only as needed to deliver their service and is bound by their respective privacy policies and data processing agreements.

7. Your rights

You have the right to access, correct, or delete your data at any time. To exercise these rights, visit Settings → Privacy or email privacy@nurty.co. We will respond within 30 days. For EU/EEA residents: you have additional rights under GDPR including data portability and the right to restrict processing.

8. Data retention

Session metadata (date, duration, modality) is retained for as long as your account is active. When you delete your account, all associated data — including session history, survey responses, and profile information — is permanently deleted from our servers and payment provider within 30 days. Anonymized aggregate analytics may be retained.

9. Cookies

We use essential cookies for authentication and session management. We do not use advertising or tracking cookies. You can manage cookie preferences in your browser settings.

10. Children's privacy

Nurty is not intended for users under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, please contact us immediately at privacy@nurty.co.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email and in-app notification at least 14 days before they take effect.