Privacy notice

Nora is operated by Sophie Snelling, trading as Nora, who is the data controller for personal data processed by Nora in its own capacity.

Nora is run by Sophie Snelling and Chris Tunbridge. For privacy or data protection enquiries, you can contact us at support@meetnora.uk.

When you visit meetnora.uk, we and our hosting providers process limited technical information, such as your IP address, device and browser information, pages visited, referring page, and security or performance events. We use this to deliver, secure and improve the website and to understand its performance.

We use Vercel Analytics and Vercel Speed Insights. Authentication and security features may also use strictly necessary cookies or similar storage to keep you signed in, protect forms and prevent abuse.

If you accept cookies on the website or on the Nora signup page, we use Google Ads to measure visits that come from our Google advertising and to understand how those ads perform. Google may set cookies or similar technologies and receive technical information such as your IP address, device and browser details, the pages you visit, and information about the ad that brought you here. We store your accept or decline choice separately in the browser for the website and for the signup page. We do not sell personal information.

We also advertise in ChatGPT. We do not currently set cookies or send conversion events to measure those ads. A visit from a ChatGPT ad may include a click reference in the page address. We do not store that reference in a cookie or send it to OpenAI.

Our legal bases are our legitimate interests in operating a secure, reliable website and your consent for advertising cookies and similar technologies. You can accept or decline advertising cookies in the banner on the website and on the signup page. If you change your mind, clear that site's stored data in your browser and the banner will appear again. You can also control cookies through your browser settings; disabling necessary cookies may stop parts of the site or app working.

When you join the Nora early-access list, we collect your email address, the date and time you joined, and a record of your request to be notified.

We use this information to manage the list, confirm your request where applicable, send the early-access notification you asked for, honour unsubscribes, and protect the form from misuse. Please do not provide health information, client information, therapy notes or other sensitive personal information in the early-access form.

The legal basis for the early-access notification is your consent. You may withdraw it at any time using the unsubscribe link in an email or by contacting us. We rely on legitimate interests to keep limited security and administrative records relating to the form.

We keep early-access information until we have sent the invitation you requested, and delete the list no later than six months after the final early-access invitations are sent, unless you ask us to delete it sooner or separately create a Nora account. We will not use the early-access list for unrelated newsletters, promotions, profiling or advertising without separately telling you and obtaining permission where required.

When you create or use a Nora account, we process your account and profile information, including your email address, name, profile image if you add one, login and account-security information, account settings, feature access, and records needed to administer a subscription or payment if paid plans are offered.

We use this information to create and secure your account, provide the app, send transactional messages such as account verification, password reset and email-change confirmations, provide support, prevent fraud and abuse, enforce our terms, comply with law, and improve the reliability and security of Nora. Our legal bases are performance of our contract with you, compliance with legal obligations, and our legitimate interests in running and securing Nora.

Nora is designed for therapists. If you enter information about clients, sessions, notes, documents, health information, risk information or other practice content, you will usually be the controller of that information and Nora will usually process it on your documented instructions as your processor. You remain responsible for your lawful basis, any special category condition, professional duties, and for giving your clients an appropriate privacy notice.

Nora encrypts client records, notes, documents and file content in your browser before they are stored. Nora does not hold the keys needed to read that encrypted content at rest. To run the service, however, we can still process limited structural metadata, including account and record identifiers, timestamps, session timing, statuses, record relationships, encrypted file size and declared file type. Encryption reduces exposure but does not remove all privacy or security risk, particularly if your device or browser is compromised.

We process practice data only as needed to provide, secure, maintain, troubleshoot and support Nora, comply with law, and meet our contractual obligations. The applicable data processing terms govern this processor relationship.

We use carefully selected service providers to operate Nora. Depending on the feature, these currently include:

• Vercel for hosting, website analytics and performance monitoring
• Google for advertising measurement on the website and the signup page, if you accept advertising cookies
• Supabase for database, authentication and private file storage
• Upstash for rate limiting and abuse prevention
• Resend for transactional and early-access email delivery
• Stripe for payment processing if and when paid plans are made available

Providers act under contracts and process information only as permitted by those arrangements. We may also disclose information when required by law or where necessary to establish, exercise or defend legal claims. We do not sell personal information.

Our providers may process information outside the United Kingdom. Where that happens, we use transfer protections recognised under UK data-protection law, such as an adequacy regulation or approved contractual safeguards. Contact us if you would like more information about the safeguards relevant to your information.

We keep personal information only for as long as necessary for the purposes described in this notice. Account information is generally kept while your account is active; support, security and billing records may be kept for longer where needed to resolve issues, prevent abuse, comply with legal obligations or establish, exercise or defend legal claims. We apply the early-access retention period described above to early-access data. Practice data is retained in line with the service arrangements and your instructions, subject to technical backup and legal requirements. When you delete your account, we send a short internal notification to support containing the account email so we know the account was closed. We delete that message once it has been processed.

Depending on the circumstances, you may have the right to:

• Ask for access to your personal information
• Ask us to correct inaccurate or incomplete information
• Ask us to delete information
• Ask us to restrict processing
• Object to processing based on legitimate interests
• Withdraw consent where we rely on it
• Receive information you provided in a portable format

You can delete your Nora account from Settings in the app. That erases your account data and the practice records we hold for that account.

To exercise these rights, email support@meetnora.uk. We may need to confirm your identity before responding. If you are a client of a therapist using Nora, please contact that therapist first because they are normally the controller of your practice data.

Please contact us first if you have concerns about how we use your information, at support@meetnora.uk.

You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.

We may update this notice as Nora changes. The current version will always be published on this page with its updated date. Where a change is material, we will take appropriate steps to notify affected users.