Privacy policy

NightingaleMD, Inc. (“NightingaleMD,” “we,” “us,” or “our”) is committed to protecting the privacy and security of personal information. This policy describes how we handle information when you visit nightingale.md, use Florence or Nightingale Copilot, or otherwise interact with our services.

1. Information we collect

1.1 Information you provide

• Contact and professional information: Information you choose to provide when you email us, request a workflow review, or otherwise contact us, such as your name, work email, role, organization, and systems involved.
• Communications: Messages, feedback, workflow descriptions, or inquiries you send to us.
• SMS enrollment information: Your mobile number, optional first name, affirmative consent choice, and associated consent-record information such as date and time, source, and disclosure version.
• Nightingale Copilot credentials: The sign-in credentials you enter to access the Nightingale Copilot browser extension, used to authenticate you as described in Section 11.

1.2 Protected health information

When Florence or another NightingaleMD service is deployed by a healthcare provider or health plan, we may process protected health information (“PHI”) as defined by HIPAA. When we act as a Business Associate, that processing is governed by an executed Business Associate Agreement and applicable law. See our HIPAA and protected health information page.

1.3 Technical information

Our hosting and security providers may process standard technical information such as IP address, browser and device type, pages requested, referring page, and timestamps to deliver, protect, and troubleshoot the website. Google Analytics also collects information about visits to our marketing website, as described in Section 8.

2. How we use information

We may use information to:

• Respond to workflow-review requests and inquiries.
• Provide, maintain, secure, and improve NightingaleMD services.
• Understand how visitors find and use our marketing website so we can improve it.
• Communicate with customers, care teams, patients, and prospective customers about service or support.
• Send consented, non-marketing healthcare-related text messages on behalf of participating organizations.
• Document and manage SMS opt-in choices and honor STOP and HELP requests.
• Comply with legal, contractual, security, and regulatory obligations.

3. SMS communications

NightingaleMD may send recurring, non-marketing healthcare-related text messages on behalf of participating providers, care teams, and health plans. Messages may include appointment reminders, care follow-ups, medication-adherence support, scheduling assistance, care-management outreach, and requests to confirm or update care-related information.

Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for assistance. Consent is not required as a condition of receiving medical care. See the full SMS communications consent disclosure.

NightingaleMD does not sell or share SMS opt-in data, consent records, or mobile phone numbers with third parties or affiliates for marketing or promotional purposes.

4. How we disclose information

We do not sell personal information. We may disclose information to:

• Service providers that help us operate, secure, and support our services under applicable contractual obligations.
• Healthcare organizations and their authorized representatives as directed by the customer and governed by applicable agreements.
• Authorities or other parties when required by law, legal process, or to protect rights, safety, and service integrity.
• Transaction participants in a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate protections and notice where required.

5. Data security

We use administrative, technical, and physical safeguards designed for the nature of the information and our role in processing it. These include encryption in transit and at rest where applicable, access controls, security monitoring, incident response procedures, and vendor risk management.

• SOC 2 Type 2 audit: Our SOC 2 Type 2 observation period began September 15, 2026. The independent report is targeted for December 2026, subject to completion of the audit. Status as of October 2, 2026.
• Patient identity: In configured protected workflows, Florence verifies identity against multiple fields supplied by the customer’s roster, EHR, or other source of truth. Caller ID alone is not treated as proof of identity.

6. Data retention

We retain personal information for as long as reasonably necessary for the purposes described in this policy, to meet contractual obligations, and to comply with law. PHI retention is governed by applicable law and our agreements with covered entities.

7. Your choices and rights

Depending on your relationship with us and applicable law, you may be able to:

• Request access to or correction of personal information we maintain about you.
• Request deletion or a portable copy where applicable.
• Opt out of marketing communications.
• Reply STOP to opt out of NightingaleMD text messages.

Requests involving PHI should generally be directed to the provider, health plan, or other covered entity that made the information available to NightingaleMD.

8. Cookies and tracking

Our marketing website uses Google Analytics, a web analytics service provided by Google LLC, to understand how visitors find and use the site. Google Analytics collects information about your visit, including the pages you view, the page that referred you, your approximate location derived from your IP address, your device and browser type, and how you interact with pages. It sets first-party cookies named _ga and _ga_<container-id>: the first distinguishes one browser from another, and the second keeps track of a visit.

We have turned off Google signals and ad personalization for Google Analytics on this website, and we do not use Google Analytics for advertising. The website does not send what you type into its forms to Google Analytics. When you submit a workflow-review request, Google Analytics records only that a request was submitted.

The website does not load Google Analytics when your browser sends a Global Privacy Control signal. You can also opt out of Google Analytics on every website by installing the Google Analytics opt-out browser add-on. Google explains how it uses information from sites that use its services in How Google uses information from sites or apps that use our services and in the Google Privacy Policy.

The marketing website does not use third-party advertising trackers. Other NightingaleMD services may use cookies or local storage when required for authentication, security, preferences, or service functionality.

9. Children’s privacy

Our public website is not directed to children. Patient information involving minors is processed only as directed by participating healthcare organizations and subject to applicable agreements and law.

10. Changes to this policy

We may update this policy from time to time. Material changes will be posted on this page with a revised effective date and any additional notice required by law.

11. Nightingale Copilot browser extension

Nightingale Copilot is an optional Chrome browser extension for authorized clinicians and care teams who use NightingaleMD alongside the PracticeFusion electronic health record. Users sign in with their NightingaleMD credentials to authenticate and access their NightingaleMD dashboard.

When an authorized user chooses to file selected documentation, such as note sections, appointments, or vitals, the extension enters that information into the PracticeFusion chart the user has open. It operates only on PracticeFusion pages and only in response to the user’s explicit action. PHI handled through the extension remains subject to applicable Business Associate Agreements and customer instructions.

The extension stores one non-personal display preference locally and does not store personal, patient, or health data on the device. It does not sell data, use data for advertising, or use or transfer data for purposes unrelated to these functions. On first use, the extension presents a first-use data-use disclosure and requests consent before sign-in.

These practices correspond to the Chrome Web Store data categories disclosed for the extension: authentication information, personally identifiable information, and health information.

12. Contact us