Privacy notice

Nora is operated by CJHT DESIGN LTD, of The Bungalow, The Green, Snitterfield, Stratford-Upon-Avon, England, CV37 0JG. For the processing described in this notice, we are the controller. If you have questions or want to exercise your privacy rights, contact us at support@meetnora.uk.

When you visit meetnora.uk, we and our hosting providers process limited technical information, such as your IP address, device and browser information, pages visited, referring page, and security or performance events. We use this to deliver, secure and improve the website and to understand its performance.

We use Vercel Analytics and Vercel Speed Insights. Authentication and security features may also use strictly necessary cookies or similar storage to keep you signed in, protect forms and prevent abuse. We do not use the website to sell personal information or to run targeted advertising based on your personal information.

Our legal bases are our legitimate interests in operating a secure, reliable website and, where applicable, your consent for non-essential cookies or similar technologies. You can control cookies through your browser settings; disabling necessary cookies may stop parts of the site or app working.

When you join the Nora early-access list, we collect your email address, the date and time you joined, and a record of your request to be notified.

We use this information to manage the list, confirm your request where applicable, send the early-access notification you asked for, honour unsubscribes, and protect the form from misuse. Please do not provide health information, client information, therapy notes or other sensitive personal information in the early-access form.

The legal basis for the early-access notification is your consent. You may withdraw it at any time using the unsubscribe link in an email or by contacting us. We rely on legitimate interests to keep limited security and administrative records relating to the form.

We keep early-access information until we have sent the invitation you requested, and delete the list no later than six months after the final early-access invitations are sent, unless you ask us to delete it sooner or separately create a Nora account. We will not use the early-access list for unrelated newsletters, promotions, profiling or advertising without separately telling you and obtaining permission where required.

When you create or use a Nora account, we process your account and profile information, including your email address, name, profile image if you add one, login and account-security information, account settings, feature access, and records needed to administer a subscription or payment if paid plans are offered.

We use this information to create and secure your account, provide the app, send transactional messages such as account verification, password reset and email-change confirmations, provide support, prevent fraud and abuse, enforce our terms, comply with law, and improve the reliability and security of Nora. Our legal bases are performance of our contract with you, compliance with legal obligations, and our legitimate interests in running and securing Nora. Where we need consent for a particular optional feature, we will ask for it at that point.

Nora is designed for therapists. If you enter information about clients, sessions, notes, documents, health information, risk information or other practice content, you will usually be the controller of that information and Nora will usually process it on your documented instructions as your processor. You remain responsible for your lawful basis, any special category condition, professional duties, and for giving your clients an appropriate privacy notice.

Nora encrypts client records, notes, documents and file content in your browser before they are stored. Nora does not hold the keys needed to read that encrypted content at rest. To run the service, however, we can still process limited structural metadata, including account and record identifiers, timestamps, session timing, statuses, record relationships, encrypted file size and declared file type. Encryption reduces exposure but does not remove all privacy or security risk, particularly if your device or browser is compromised.

We process practice data only as needed to provide, secure, maintain, troubleshoot and support Nora, comply with law, and meet our contractual obligations. The applicable data processing terms govern this processor relationship.

Nora's AI assistant is optional and is disabled until you accept its privacy notice in the app. If enabled, your messages and the context you choose to share are sent to Anthropic to generate a response. The context is assembled in your browser after decryption; Nora does not store that decrypted context in its database as part of the chat request.

The assistant's sharing controls default to limiting free-text and risk-field sharing, but some structured context such as client, session or note identifiers, names, statuses and timestamps may be used to make the feature work. The controls limit context Nora generates; they do not filter information you type into a prompt. Do not enable or use the assistant unless you have decided it is appropriate for the data and professional duties involved. You remain responsible for reviewing its output and for any decision made using it.

We use carefully selected service providers to operate Nora. Depending on the feature, these currently include:

• Vercel for hosting, website analytics and performance monitoring
• Supabase for database, authentication and private file storage
• Upstash for rate limiting and abuse prevention
• Resend for transactional and early-access email delivery
• Anthropic for the optional AI assistant when you enable and use it
• Stripe for payment processing if and when paid plans are made available

Providers act under contracts and process information only as permitted by those arrangements. We may also disclose information when required by law or where necessary to establish, exercise or defend legal claims. We do not sell personal information.

Our providers may process information outside the United Kingdom. Where that happens, we use transfer protections recognised under UK data-protection law, such as an adequacy regulation or approved contractual safeguards. Contact us if you would like more information about the safeguards relevant to your information.

We keep personal information only for as long as necessary for the purposes described in this notice. Account information is generally kept while your account is active; support, security and billing records may be kept for longer where needed to resolve issues, prevent abuse, comply with legal obligations or establish, exercise or defend legal claims. We apply the early-access retention period described above to early-access data. Practice data is retained in line with the service arrangements and your instructions, subject to technical backup and legal requirements.

Depending on the circumstances, you may have the right to:

• Ask for access to your personal information
• Ask us to correct inaccurate or incomplete information
• Ask us to delete information
• Ask us to restrict processing
• Object to processing based on legitimate interests
• Withdraw consent where we rely on it
• Receive information you provided in a portable format

To exercise these rights, email support@meetnora.uk. We may need to confirm your identity before responding. If you are a client of a therapist using Nora, please contact that therapist first because they are normally the controller of your practice data.

Please contact us first if you have concerns about how we use your information.

You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.

We may update this notice as Nora changes. The current version will always be published on this page with its updated date. Where a change is material, we will take appropriate steps to notify affected users.