Privacy Policy
NHID-Clinical · Effective 15 August 2026
How NHID-Clinical, publisher of AI Governance Practice, handles your data. Every statement below describes what the app does today, not what it may do later.
Who we are
NHID-Clinical is an AI governance and security platform and is the controller of the personal data described here.
Using the app without an account
No account is required. Used signed out, none of your learning data leaves your device: your answers, review schedule, streak, daily goal, and theme stay in your browser's local storage and are never transmitted to us. The one thing that is sent is pseudonymous usage measurement, described below — it carries no account, no name, and nothing about which answer you gave, but it does carry a rotating device identifier, and you can switch it off in Settings.
What we collect if you create an account
Your email address, and your learning progress: which scenarios you answered, the option you chose, whether it was correct, how long you took, your self-reported confidence, your review schedule, and your streak. We do not ask for your name, employer, job title, or any health information, and you should not enter patient data, protected health information, or confidential material anywhere in the app.
What we never collect
No third-party analytics or advertising SDK is present in the app. No advertising identifiers, no third-party trackers, no cross-site tracking, no device fingerprinting, no precise or GPS location, no IP addresses in storage, and no payment details — there is no checkout. We do not sell or share personal data, and we do not use your data to train machine learning models. The usage measurement described in the next section is our own, is not linked to any account, and is never combined with your learning data.
Pseudonymous usage measurement
We count how the app is used so we know whether it is worth maintaining. This data is pseudonymous rather than anonymous, and the difference matters: a random identifier is stored on your device, replaced every 90 days, and sent with each record, so records from one device can be grouped together within that window. It is not an account and is not joined to one — signed in and signed out produce the same record — but we do not claim it makes you unidentifiable, and you should not read it that way. We record which kind of session you started, which Body of Knowledge domain and sub-domain a question belonged to and whether it was answered correctly. Coarse technical context is inferred from the connection rather than reported by the app: a country and — in the United States only — a state, whether the device is a phone, tablet or desktop, and your browser and operating system family. Your IP address is used momentarily to work out the country and is then discarded; it is never written to our database, and there is no field in which it could be stored.
If you report a problem
The Help page has a form for telling us something is wrong. It sends what you typed, which kind of problem you picked, and the path of the page you were on — the path only, never the query string after it. An email address is optional: give one if you want a reply, leave it blank and the report is anonymous. No account is needed to send a report, and nothing is attached to your account even when you are signed in — the report carries no user id and is never joined to your learning data or to usage measurement. Reports are readable only by the operator of this site. Unlike usage records, they are not deleted on a schedule: a report is kept so the same problem is not investigated twice, and so a fix can be traced back to what prompted it. Please do not include patient data, protected health information, or anything confidential in a report.
What usage measurement never includes
It never includes your email address or user id, even when you are signed in — a signed-in and a signed-out visit produce identical records. It never includes which question you saw, which option you chose, your score, your streak, or any free text. It is stored separately from learning data, with no link between the two, so the two cannot be combined. Individual records are never inspected: only aggregated daily totals are read, and the raw records are deleted after 90 days.
Turning usage measurement off
Settings → Privacy has a switch that disables it. With it off, nothing is sent at all — the request is not made, rather than made and discarded. The app works identically either way, and studying never depends on this being available: if the measurement service is unreachable, blocked by your browser, or switched off, the app behaves exactly the same.
Where your data is stored
Account data is stored in Supabase, our hosted database and authentication provider, which processes it on our behalf under contract. Every progress row is protected by row-level security keyed to your user id, so one account cannot read another's data. Traffic is encrypted in transit over HTTPS. The app itself is a set of static files served by GitHub Pages, which processes standard request logs as our hosting provider.
Why we process it, and on what basis
Your email exists to authenticate you and to contact you about your account. Progress data exists to deliver the product you asked for: tracking what you have completed and scheduling reviews. We process it to perform our contract with you under the Terms of Service. We do not use it for marketing or profiling.
How long we keep it
For as long as your account exists. Deleting your account removes it immediately and permanently. Data held only on your device persists until you clear it or uninstall the app.
Deleting your data
Settings → Data → Reset progress clears your answers and review schedule. Settings → Account → Delete account permanently deletes your account and every progress record attached to it; deletion cascades from your authentication record, so nothing is left behind, and it cannot be undone. Signing out clears the local copy on that device.
Your rights
Depending on where you live, you may have rights to access, correct, export, restrict, or erase your personal data, to object to processing, and to complain to your data protection authority. Deletion is available directly in the app; for anything else, write to us and we will respond within the period the applicable law requires.
Children
The app is intended for working professionals and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has created an account, contact us and we will delete it.
Health and AI governance context
Scenarios reference healthcare, clinical, and AI risk situations because that is the subject being taught. They are fictional teaching material. We are not a covered entity or a business associate under HIPAA, we do not process protected health information, and nothing in the app should be used to record or transmit real patient data.
Changes to this policy
If we change how data is handled, the effective date above will change and material changes will be surfaced in the app before they take effect.
Contact
Questions about this document, your account, or your data go to contact@nhid-clinical.org.
Independent Educational Product
AI Governance Practice provides original educational content for professional development in AI governance.
This product is not affiliated with, endorsed by, sponsored by, or connected to the International Association of Privacy Professionals (IAPP), CompTIA, Cloud Security Alliance, or any certification body.
This product does not contain actual certification exam questions and does not guarantee exam success.
All questions and scenarios are original educational material.