Your learning data deserves clear protection.

1. Who is responsible for your data

NursPal is operated by Oyeniyi Moyosoluwa Samuel in Nigeria. For the personal data described here, he is the operator responsible for deciding how and why it is processed.

2. Information we collect

• Account and identity details such as name, email address, date of birth and account identifiers.
• Education details such as institution, location, institution type, nursing programme, study stage and chosen exam pathway.
• For learners aged 16 or 17, a parent or guardian email address and the relationship selected by the learner, together with the status of the consent request.
• Learning activity such as topics opened or completed, reading and study time, progress, practice and mock attempts, answers, notes and highlights where those features save activity.
• Payment records such as Paystack reference, amount, currency, transaction status and Premium access dates. NursPal does not ask you to send us your full card number, PIN or OTP.
• Technical, security and operational information such as timestamps, audit events, error information and basic device or request data made available by our hosting and security providers.
• Communication choices, support messages and other information you choose to send us.

3. Why we use it

• to create, verify, secure and support your account;
• to personalise your pathway and preserve learning progress;
• to provide Premium access and reconcile payments safely;
• to operate structured lesson access, prevent misuse, resolve service errors and maintain platform integrity;
• to analyse institution and programme trends in aggregated or appropriately controlled form so we can improve content, outreach and events;
• to send essential service messages and, only where you choose it, marketing emails or study reminders;
• to meet legal, accounting and regulatory responsibilities.

Depending on the activity, our basis is performing the service you request, your consent, compliance with a legal obligation, or a legitimate operational interest that does not override your rights. You can withdraw optional email choices in Profile without losing ordinary platform access.

4. Required and optional information

Fields marked as required are needed to register, apply age and guardian rules, configure the learning experience or protect the service. Marketing emails and study reminders are optional and are off unless you choose them. If required information is not provided, we may be unable to create the account or complete the relevant registration and compliance record.

5. Children and young learners

Direct registration is currently available from age 16. Learners aged 16 or 17 must provide a different email address for a parent or responsible guardian and tell us that person's relationship to them. We keep this information limited to consent follow-up, account protection and compliance. After the learner verifies their own email, the guardian receives a separate, time-limited and single-use review link. Opening that link does not approve anything: the guardian must enter their name, confirm or correct their relationship to the learner, and actively approve or reject the request. We record the decision, time and applicable document version. A request that remains pending is not treated as approved, but pending status alone does not pause ordinary learning, saved progress or Premium access. The learner can view the status, resend the review email or correct the guardian email in Profile. People under 16 should not create an account.

6. Who processes information with us

We use service providers to operate NursPal. These currently include Supabase for authentication and database services, Vercel for application hosting, Paystack for payment processing, and Resend for transactional email. They process information under their own security and privacy terms and only for relevant services. Some providers may process data outside Nigeria; where that occurs, we expect appropriate contractual, technical or legal safeguards.

We do not sell learners' personal data. We may disclose limited information when required by law, to protect users and the platform, to investigate fraud or security incidents, or as part of a future business transfer subject to appropriate protection and notice.

7. Storage, retention and security

We ordinarily keep account, learning, consent, guardian, payment, security and audit records only for as long as they are needed and for no longer than six years after account closure or the relevant transaction or record. We may delete or irreversibly de-identify information sooner when it is no longer needed.

Limited information may be retained for longer where applicable law requires it or where it is reasonably needed for an active complaint, dispute, fraud or security investigation, regulatory matter or court proceeding. When the applicable retention period ends, we securely delete or irreversibly de-identify the information.

We use safeguards such as authenticated access, protected data controls, audit records and restricted administrative access. No internet system can promise absolute security. Where the law requires it, we will assess and notify affected people and regulators of qualifying breaches.

8. Cookies and local device storage

NursPal uses necessary browser storage for functions such as login, security and theme preference. If we later introduce non-essential analytics, advertising or marketing tracking, we will provide an appropriate choice before using it where consent is required.

9. Your choices and rights

Subject to applicable Nigerian data-protection law, you may ask to be informed about processing, access your data, correct inaccurate data, object to or restrict certain processing, withdraw consent, request deletion, request portability where applicable, and raise concerns about automated decisions. Some details and email preferences can be updated directly from Profile.

Contact us to exercise a right. We may need to verify your identity and may retain information where the law permits or requires it. You may also complain to the Nigeria Data Protection Commission.

10. Changes and contact

Material changes will be shown through a new version or effective date and, where appropriate, a renewed notice or consent request.