Privacy policy

Last updated October 7, 2026 · Version 2026-10-07

Prelaunch notice: this site is for testing only and registration is closed. Do not enter real personal information. These policies describe the current application; operator details and operational retention procedures must be finalized before real-account registration opens.

1. Who operates this service

Preceptor Harbor coordinates nursing education placements. The legal operator’s identity has not yet been published. The initial service is for adults seeking or supporting placements in Texas. This policy covers information handled by this application, not the separate records or websites of a school, preceptor, or clinical site.

Privacy questions and requests: Privacy contact pending — real-account registration is not open.. Do not include patient information, identification documents, or passwords in a privacy request.

2. What we collect and why

• Account information: name, email address, role, account ID, active/suspended status, and school/site assignment where relevant. These identify you, control access, and support account administration. In live mode, Supabase Auth processes passwords and authentication records; passwords are not copied into placement profiles.
• Student placement information: school, program, course, required hours, learning competencies, patient-population and clinical-setting requirements, city/state/ZIP, travel radius, and available dates. We use these to compare placement requirements and coordinate approvals. ZIP is used for approximate distance, not device GPS.
• Optional professional information: a short background, work experience, certifications, and an optional PDF résumé. You can leave these blank. A résumé is not required to browse potential matches. Only provide information relevant to the placement.
• Preceptor information: professional credentials, title, degree, specialties, skills, experience, license states and expiration, optional board certifications/NPI, availability, capacity, practice settings, program preferences, and associated sites. This supports matching and institutional review. Information supplied by users is not an independent credential verification.
• Organization information: school/site names, work contact names and emails, website, location, clinical requirements, capacity, affiliation status, approved programs, agreement dates, and agreement requests. Exact clinical-site addresses are restricted until placement approval, except for authorized organization administration.
• Placement and accountability records: introductions, requested dates, decisions, compliance-review status, agreement requests, sharing choices, policy versions, and timestamps. Audit records contain an actor ID, action, record ID, and time; the app does not intentionally copy passwords or full form submissions into its audit log.
• Technical information: necessary session cookies and network information needed to serve a request. Hosting and authentication providers may process IP addresses, device/request information, and security logs. Their production configuration and retention must be reviewed before launch.

We do not ask for Social Security numbers, birth dates, home street addresses, payment cards, patient records, health histories, immunization files, or background-check reports. Do not put these in free-text fields or résumés. A school’s compliance-complete marker is an attestation; this app does not collect the underlying medical documents.

3. How matching works

Matching uses stated program, population, setting, state, approximate distance, dates, hours, credentials, capacity, and affiliation coverage. The score and its factors are shown to students. It is a comparison tool, not an AI decision or a guarantee of eligibility, safety, or placement. Schools, sites, and preceptors make their own decisions.

4. Who can receive information

Signed-in students can view available preceptors’ professional details and general site information. Student profiles are not a public directory. A submitted request shares the student introduction, professional profile, and optional résumé with the selected preceptor, the relevant school/site administrators, and platform administrators supporting that request, subject to sharing permission and access controls. Basic placement identity, dates, and approval records remain available to authorized participants for coordination and accountability.

When email delivery is enabled, Resend processes the recipient email address and a request link for approval notifications. Supabase processes passwordless sign-in requests. Notification records include the recipient, request reference, processing status, and attempt timestamps. Emails do not include student profiles or documents. Email delivery is currently disabled.

In live mode, Supabase provides authentication, database storage, and private résumé storage. Infrastructure providers process information to deliver and protect the service. No advertising, analytics, data-broker, AI-model, payment, social-login, or embedded-media integration is currently implemented. We do not sell personal information or share it for targeted advertising. We may disclose information when required by law or reasonably necessary to address fraud or protect rights, subject to applicable law.

5. Your sharing choices

Account terms acceptance is separate from permission to share a student profile. Profile sharing is optional until you submit a request, and each new request requires a separate unchecked permission box. In My profile, choose Stop sharing to withdraw permission for all existing requests without completing other profile fields. You may also uncheck the profile sharing box and save.

Withdrawal stops future access through this app to shared profile details, introductions, and new résumé links. An already issued résumé link may remain usable for up to 60 seconds. Withdrawal cannot recall downloaded copies or delete a school’s separate records, and does not automatically cancel a placement or erase its basic approval record. Re-enabling profile sharing does not restore withdrawn permissions on old requests; contact the participants about any placement that still needs review.

6. Retention and deletion

The fictional demo uses a browser session that expires after 24 hours. Signing out clears the session but does not automatically erase its saved demo workspace on the server. Do not use the demo to store real information.

In the current application, account, profile, placement, agreement, consent, and audit records persist until an authorized operator removes them. There is no automatic account or placement-record deletion schedule yet. Before real-data launch, the operator must approve retention periods for each category and implement deletion, backup expiry, and legal-hold procedures. We do not promise that signing out or withdrawing sharing deletes these records.

Résumé replacement attempts to remove the previous file after the new record is saved; failures require operator cleanup. Infrastructure backups and logs may retain copies under the provider’s configured retention. An approved deletion request must address the primary database, its projections, authentication, files, and backups, while retaining only records required for a documented legal or institutional purpose.

7. Access, correction, deletion, and complaints

You can view and edit your profile, view your requests, and withdraw sharing in your workspace. Contact Privacy contact pending — real-account registration is not open. to request access or a copy, correction, deletion, information about recipients, or to appeal a privacy decision. State your request and account email; do not send identity documents unless a proportionate verification method is specifically arranged. We will verify requests before disclosing or changing information and explain any applicable exception or refusal. Your legal rights and response deadlines depend on the laws that apply; using a privacy right will not result in unlawful discrimination.

Texas residents may complain to the Texas Attorney General. The Texas Data Privacy and Security Act’s application depends on the operator’s activities, status, and exemptions; this notice does not claim that every statutory right applies to every account.

8. Security, schools, and service providers

The app checks account roles and organizational access on the server. Résumés use private storage and short-lived download links. These measures reduce risk but cannot guarantee security. A live deployment must use HTTPS. Do not share credentials or upload files you are not authorized to disclose.

Participating schools and sites have their own privacy duties and retention rules. Any handling of school-controlled education records requires appropriate institutional arrangements; this policy and a sharing checkbox do not replace them. This service is not intended to receive protected patient health information and is not represented as HIPAA-certified or FERPA-certified.

Production hosting regions, provider contracts, and any international transfers must be documented before live launch. No claim is made that all information will remain in Texas.

9. Children and changes

The service is intended for adults 18 and older. Do not create an account for a child. Contact us if you believe a child’s information was submitted. We will review and address it. Material changes to this policy will be dated and communicated through the service; new uses requiring permission will require a new choice.