Privacy Policy
Nightingale is built on a zero-knowledge identity model. After you verify, we permanently destroy every piece of evidence linking your account to your real identity. Even if compelled by a court order, we cannot produce data that identifies who contributed any specific entry.
Accounts require only a username and password. No email address, phone number, or name is stored in our authentication system.
Hospital emails, nursing license numbers, and NPI numbers are used once to confirm you are a healthcare worker, then permanently deleted. We do not retain them.
There is no "forgot password" flow. This is intentional: password recovery requires linking your account to an external identity (email, phone). We refuse to do this.
Your public contributions (compensation data, profile) live in a separate database schema from the temporary verification data. There are no foreign keys between them — by design.
The public database schema — the one that stores facility data and compensation entries — contains zero personally identifiable information. Ever. This is enforced as a hard constraint.
When enough verified workers contribute data for a given facility and role, we aggregate responses rather than exposing individual entries. This protects contributors from reverse-engineering.
If Nightingale receives a valid legal demand to identify a user, we will comply with our legal obligations — but our system is designed so that compliance produces nothing useful. The data we would hand over is: a username (which you chose), a hashed password (unreadable), and a verification result (e.g., “verified as RN via license”).
We have no email addresses, no names, no nursing license numbers, no NPI numbers on file. Verification artifacts are destroyed before we could ever be compelled to produce them. This is not a policy decision — it is a technical architecture decision.
Questions about our privacy practices? Contact us or read our Trust & Security page.