Version 2.1, in force from 31 October 2026. This English text is the authoritative version.
1. Who we are
NurseFlyAbroad is a free, open website where nurses prepare for exams and for working abroad. It is run by the NurseFlyAbroad team from Dubai, United Arab Emirates (“we”, “us”). We decide why and how your personal data is used, so we are the controller (in India: the Data Fiduciary).
Privacy contact, also our grievance contact for India, the Philippines and Nigeria: privacy@nurseflyabroad.com. General contact: hello@nurseflyabroad.com.
We do not have an office in the EU or the UK. If a representative is appointed under Article 27 of the GDPR or the UK GDPR, it will be named here.
2. What we never do
- We never sell or rent your personal data, and we never trade it.
- We never share it for other companies' marketing.
- We never pass it to recruiters, agents, employers or partner (affiliate) companies. Partners get no personal data from us, not even your email.
- We never ask for passwords, passport, Aadhaar, PAN or other ID numbers, bank or card details, or health records.
- We never make decisions about you that have legal or similar effects using automated means only.
3. What we collect, why, and for how long
You can use practice, guides, the vocabulary trainer and the agent check without giving us your name or email. The table lists every kind of personal data the site stores, taken from the site's code and database. “Random ID” means the random code your browser creates for this site (see 3.1); it is not your name.
Legal bases (GDPR and UK GDPR, Article 6(1)): (a) consent; (b) contract, meaning steps you ask us to take; (c) legal obligation; (f) legitimate interests, which we only use where they do not override your rights. The laws of India, the Philippines, Nigeria and the UAE have similar bases; see section 10.
3.1 Things you do on the site
| Data | Why | Legal basis | How long | Who can see it |
|---|---|---|---|---|
Random ID for your browser (kept in your browser as vr_anon_id) | So practice questions do not repeat, so you get one “Helpful” vote per post, and so your own posts and help-desk chats are recognised as yours without an account. | Legitimate interests (f); storage strictly necessary for the service you ask for. | In your browser until you clear it. On our servers only with the records below. | Our team. Never shown publicly. |
| Route choices: where you are from (country, region), where you want to work, your language, your country from your IP address, device type (phone, tablet, computer) | Statistics to plan content for the countries nurses come from and go to. The site shows the right exams from your browser either way. | Consent (a): sent only if you allow usage statistics. | 24 months after your last change. | Our team. |
| Practice results: question set, exam, score, the answer you chose for each question, right or wrong, time taken, language, your country from your IP address | To find questions that are too hard or wrong, and to improve the question bank. Your own review of mistakes is kept in your browser. | Consent (a): sent only if you allow usage statistics. | 24 months. | Our team. |
| Practice position: which question set and how far you got | So questions do not repeat until you have seen the whole set. | Legitimate interests (f), to provide the service. | 24 months after your last practice. | Our team. |
| Usage statistics: event type (for example “page opened”, “film played”, “practice finished”), the page address without anything after “?”, small details such as language and question set, your country from your IP address, device type, time | To see which pages and tools help nurses, and to fix what does not work. | Consent (a): sent only if you allow usage statistics. | 13 months. | Our team. |
3.2 Things you send us
| Data | Why | Legal basis | How long | Who can see it |
|---|---|---|---|---|
| Contact record, created when you use the study-plan form, post in the community or use “Email the team”: name, email and/or WhatsApp number, destination, exam, profession, exam date, city, language, where you are from, which form you used, your reminder choice, your country from your IP address, device type, campaign tags if you came from a campaign link, random ID | To send the study plan or reply you asked for. To send study reminders and rule-change alerts only if you ticked that box. | Contract (b) for what you asked for; consent (a) for reminders, which you can withdraw at any time. | 24 months after your last contact with us, or until you ask us to delete it. | Our team. Never shown publicly. Never given to partners or recruiters. |
| Help-desk chats: your questions and the Guide's answers, language, your country from your IP address, random ID | To answer you and keep the conversation going; to find gaps in our guides; to stop abuse. | Contract (b) to answer; legitimate interests (f) to improve and protect the service. | 12 months after the last message. | Our team; the AI service while it writes the answer (section 6). |
| “Email the team” requests: name, email, your question, language, link to the chat | So a person can answer you by email. | Contract (b). | 24 months. | Our team. |
| Community questions and replies: title, text, topic, destination, language and display name (public); email, random ID, your country from your IP address and the moderation result (private) | To run the community, answer with the Guide, let you mark the answer that helped, and keep it safe. | Contract (b); legitimate interests (f) for moderation and safety. | Public until you or we remove it. Your email and random ID are removed from posts after 24 months. Posts we reject are deleted after 90 days. | Everyone can read the public part. Our team sees the private part. Your email is never shown. |
| “Helpful” votes: random ID and the post you voted for | One vote per browser; the weekly “Most helpful” list from real votes only. | Legitimate interests (f). | While the post exists, or until you delete your data. | Only the vote count is public. |
| Reply notifications: email, the question you follow, random ID, an unsubscribe code; emails waiting to be sent | To tell you about replies, only if you ticked “Email me replies”. We do not send these emails yet; when we start, every email will have a one-click unsubscribe link. | Consent (a). | Until you unsubscribe (then deleted within 30 days), and at most 24 months. Queued emails: 90 days. | Our team; our email provider once we have one (section 7). |
| Saved progress (optional): name, email, exam goal, destination, language, the practice reports linked to your browsers, the sign-in method, and the version of this notice you accepted | So you can open your progress and report cards on another device. | Consent (a), given when you tick the box to save. | 24 months after your last activity, or until you delete it. | Our team. Never public. |
| Sign-in account (optional): if you sign in with Google, Facebook, Microsoft or Apple, we receive your name and verified email address from that provider and keep a sign-in account for you with our database provider (Supabase Auth). No password is stored by us. | So you can sign in again and open your saved progress. | Consent (a), when you choose to sign in. | Until you delete your data, and at most 24 months after your last activity. “Delete my data” on the Your data page removes the sign-in account too. | Our team; the sign-in provider you chose (section 7). |
| Newsletter and study tips (optional): email, the exact consent wording you saw, its version and language, an unsubscribe code, and the weekly tip drafts made for you | To send the tips you ticked, based on the areas you find hard. Nothing is sent until our email provider is connected. | Consent (a). One-click unsubscribe in every email. | Until you unsubscribe, then deleted within 30 days; drafts and queued emails 90 days. | Our team; our email provider (section 7). |
| Privacy requests: request type, email (if you give one), a one-way hash of your random ID (never the ID itself), your message, language, status and dates | To answer your request and to show we did. | Legal obligation (c). | 24 months after the request is closed. | Our team. |
3.3 Things our hosting records automatically
Like every website, our hosting provider (Vercel) records each request: IP address, page address, browser type and time. These logs are used to deliver the site and keep it secure (legitimate interests) and are kept for a short time under Vercel's own rules. We do not store IP addresses in our database. Our code uses your IP address only in memory, to limit how many requests one connection can send and to read your country (country code only).
4. What we do not collect
We do not ask for, and do not want: passwords, passport, Aadhaar, PAN or other ID numbers, bank or card details, health information, religion, caste or immigration status. Please do not type them into the help desk or the community. Community posts that contain phone numbers, ID numbers or email addresses are held for a person to check before anyone sees them. Accounts are optional: you can save your progress with your name and email, or with Google, Facebook, Microsoft or Apple sign-in (section 3.2). There are no passwords.
5. Cookies, usage statistics and ads
The cookie policy lists every cookie and browser storage item, what it does and how long it lasts. In short:
- Necessary items (language, practice progress, your choices, the random ID) are always on.
- Usage statistics are off until you allow them. They go only to our own database, not to Google or any analytics company.
- Advertising (Google ads and ad measurement) is off until you allow it, and is only offered when we switch ads on. Right now ads and ad measurement are switched off. Google's tags load only after you accept. Ads are not shown to visitors in the EEA, the UK and Switzerland, or where we cannot tell the country, until Google’s own consent message is switched on. See how Google uses information from sites that use its services.
- If your browser sends Global Privacy Control or Do Not Track, we treat it as a “no” to advertising.
- Rejecting is as easy as accepting, and the site works the same. Change your mind any time with “Cookie settings” at the bottom of every page. We store your choice, the policy version and the date in your browser.
- Partner offers are labelled. If you click one, you leave our site and the partner may set its own cookies. We send no personal data to partners.
6. The AI Guide
The NurseFlyAbroad Guide in the help desk and the community is an AI bot, and it is always labelled as one. It is not a nurse, a lawyer or an agent. It never asks for phone, passport, ID or bank details.
- To write an answer, the text of your question and the earlier messages in the chat (or your community post) are sent through Vercel AI Gateway to an AI model made by Anthropic. Community posts also get a short AI safety check.
- Vercel states that AI Gateway does not keep prompts or answers after the request is complete (Vercel AI Gateway security). Anthropic states that it deletes API inputs and outputs within 30 days, except where it must keep them to enforce its usage policy or the law (Anthropic privacy center). Vercel lists Anthropic as a provider that does not train models on prompts sent through AI Gateway (Vercel ZDR providers).
- We keep help-desk chats in our database as described in section 3.2.
- The AI check can hold a community post. A person then reviews it and decides. No AI decision has legal or similar effects on you.
7. Who processes your data
We use a small number of service providers (processors). They may use the data only to provide their service to us, under data processing terms. We never share personal data with anyone else, except where the law requires it; we check every such request.
| Provider | What they do for us | Data | Where | Safeguards |
|---|---|---|---|---|
| Vercel Inc. | Hosting, server code, request logs; AI Gateway for the Guide | Everything you send to the site passes through it; request logs | United States by default, and other regions | EU Standard Contractual Clauses and UK Addendum; EU-U.S. Data Privacy Framework certification; SOC 2 Type 2; encryption at rest (AES-256) and in transit (TLS 1.3) (source) |
| Supabase | Our database | All records in section 3 | India (Mumbai) | Data Processing Agreement; SOC 2 Type 2; encryption at rest (AES-256) and in transit (TLS) (source, source) |
| Anthropic (through Vercel AI Gateway) | The AI model that writes the Guide's answers and checks posts | Text of your questions, chats and posts | United States | Deleted within 30 days; not used for training (section 6) |
| Google (only if ads are switched on and you accept advertising) | Ads and ad measurement | Cookies, ad and device identifiers, IP address, pages visited | United States and other countries | Google's own terms; for some uses Google is an independent controller. Google Consent Mode keeps everything denied until you accept. |
| Google, Facebook (Meta), Microsoft or Apple (only if you choose that sign-in) | Sign-in, through our database provider's sign-in service (Supabase Auth) | Your name and verified email address, from the provider you chose | Where the provider operates | Their own terms; we receive only your name and verified email. We never post for you or read your contacts. |
| Brevo (email delivery) | Sends the emails you asked for: sign-in links, reply notifications and the newsletter. Used only from the day it is connected; until then nothing is sent. | Your email address, your name and the text of the email | See Brevo's own privacy policy; Brevo is a company based in France | A data processing agreement is in place before the first email is sent. One-click unsubscribe in every email. |
| ImprovMX (mail forwarding) | Passes mail sent to our addresses (hello@, support@, privacy@ nurseflyabroad.com) to the team's inbox | Your email address and what you write to us | See ImprovMX's own privacy policy | Used only to forward; we answer from our own mailbox. |
If NurseFlyAbroad ever moves to a different operator, this notice keeps applying to your data. We will tell you before that happens, and you can delete your data first.
8. International transfers
Our team works from the UAE. Our providers store and process data in the United States and other countries. When personal data leaves your country, we use the safeguards your law requires:
- EEA, UK and Switzerland: the European Commission's Standard Contractual Clauses (with the UK Addendum), and, for Vercel, its EU-U.S. Data Privacy Framework certification.
- India: transfers are allowed except to countries the Government of India restricts under section 16 of the DPDP Act; we will follow any such restriction.
- Philippines: we stay responsible for your data wherever it is processed (Data Privacy Act, section 21), through contracts with our providers.
- Nigeria: transfers rely on an adequate level of protection or appropriate safeguards such as standard contract clauses (NDPA, sections 41 to 43).
- UAE: transfers follow Articles 22 and 23 of the Personal Data Protection Law.
You can ask us for a copy of the safeguards we use.
9. Your rights
Wherever you live, you can:
- see the data we hold about you and get a copy, in a common file format you can move elsewhere;
- correct data that is wrong or incomplete;
- delete your data;
- object to a use of your data, or ask us to limit it;
- withdraw consent at any time, as easily as you gave it (cookie settings, the unsubscribe link, or an email);
- complain to us, and to your data protection authority.
How: on the Your data page you can download or delete everything stored under your browser's random ID at once, and send a request about data linked to your email. Or email privacy@nurseflyabroad.com. It is free. We answer within 30 days. We reply only to the email address the data is linked to, so only its owner receives the data; we may ask you to confirm the request from that address. We never ask for ID documents for this.
10. Rights under your country's law
European Economic Area and United Kingdom (GDPR and UK GDPR)
You have the rights of access, rectification, erasure, restriction, data portability and objection, the right to withdraw consent, and the right not to be subject to decisions based solely on automated processing (Articles 15 to 22). You can complain to the data protection authority where you live or work; in the UK, the Information Commissioner's Office (ico.org.uk).
India (Digital Personal Data Protection Act, 2023)
We process your data with your consent, or under section 7(a) where you give us data yourself for a specific purpose (for example, a study plan). You have the right to a summary of the data we process and who we share it with (section 11); to correction, completion, updating and erasure (section 12); to grievance redressal (section 13); and to nominate a person to use your rights if you die or cannot act (section 14). You can withdraw consent as easily as you gave it. Contact our grievance contact at privacy@nurseflyabroad.com. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
Philippines (Data Privacy Act of 2012, Republic Act No. 10173)
You have the right to be informed, to access, to object, to erasure or blocking, to rectification, to data portability and to damages. You can file a complaint with the National Privacy Commission (privacy.gov.ph).
Nigeria (Nigeria Data Protection Act, 2023)
You have the right to information, access, rectification, erasure, restriction, data portability, to withdraw consent, to object, and not to be subject to decisions based solely on automated processing. You can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
United Arab Emirates (Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data)
You have the right to information, data portability, correction or erasure, restriction of processing, to stop processing, and to object to decisions based on automated processing. You can complain to the UAE Data Office.
Everywhere else
Nurses use NurseFlyAbroad from many countries, including Kenya, Ghana, Zimbabwe, Nepal, Brazil and across Eastern Europe and Latin America. We give everyone the same rights described in section 9, and you can complain to the data protection authority in your country.
11. How we protect your data
These are the measures in place today:
- The whole site uses HTTPS, and browsers are told to always use it (HSTS).
- The database cannot be reached from the browser. Row-level security is on for every table with no public access rules. Only our server reads and writes, with a secret key that never leaves the server.
- Our admin page is protected by a long secret token. Its sign-in cookie is HttpOnly, Secure and SameSite=Strict, lasts 12 hours, and sign-in attempts are rate-limited.
- Every form and API checks its input (type, length and format) and limits how many requests one browser or connection can send.
- Community and help-desk data never shows your email or random ID publicly.
- Security headers: a Content Security Policy, no framing of our pages by other sites, no content-type guessing, a strict referrer policy, and camera, microphone, location and payment features switched off.
- No personal data in page addresses, usage statistics or our logs: page addresses are stored without anything after “?”, and details that look like an email address or phone number are dropped from statistics.
- Data exports from the admin page are protected against spreadsheet formula injection and leave out unsubscribe codes.
- Data is deleted or anonymised automatically when its time in section 3 runs out.
- Our hosting and database providers encrypt stored data (AES-256) and data in transit (TLS), and each holds a SOC 2 Type 2 report (section 7). These are their reports, not ours; NurseFlyAbroad itself has no security certification.
Found a security problem? Email privacy@nurseflyabroad.com (see also security.txt).
12. If something goes wrong
If a security breach affects personal data, we will contain it, find out what happened, and fix it. Where the law requires, we will inform the relevant authority within the time it sets: within 72 hours under the GDPR, the UK GDPR, the NDPA and the Philippine rules, and as required by the DPDP Act and the UAE PDPL. If the breach is likely to put you at risk, we will tell you directly and without undue delay, in plain words: what happened, what data, what we are doing, and what you can do.
13. Adults only (18+)
NurseFlyAbroad is for adults aged 18 or over, such as nurses, midwives and nursing students. It is not meant for children. If you are under 18, please do not send us personal data. If we learn that someone under 18 sent us personal data, we will delete it.
14. Changes to this notice
The version number and date are at the top. If we make a significant change, we will show a notice on the site, and where your consent is needed we will ask again. Earlier versions are available on request.
- Version 2.1, 31 October 2026: added saved progress, optional sign-in, the newsletter and the email providers (sections 3.2 and 7); the operator and contact details; ads are not shown in the EEA, the UK and Switzerland without Google's consent message; “Delete my data” also removes the sign-in account.
- Version 2.0, 29 October 2026: full rewrite from the site's code and database; usage statistics now need consent; Your data page; retention periods applied automatically.
- Version 1.0: first notice.
15. Contact and response times
- Privacy and data requests: privacy@nurseflyabroad.com. General questions: hello@nurseflyabroad.com. Help with the site: support@nurseflyabroad.com.
- Requests through the Your data page get a reference number at once. Email requests: we confirm receipt within 7 days.
- We answer every request within 30 days. If a request is very complex, the GDPR allows up to two more months; if we need that, we tell you why within the first 30 days.
- Security reports: we aim to reply within 3 working days.
- Postal address: available on request by email to privacy@nurseflyabroad.com until a company address is added here.