Privacy

Who we are

nou is an invitation-only clinical reasoning support workspace for authorised psychologists and supervised colleagues. Contact for privacy requests: hello@thenou.app.

Roles (worldwide)

Account data (email, auth): processed by nou as controller to operate access and security.

Clinical case content: the clinician or their organisation is the controller. nou hosts it as processor / service provider only when you enter it. Minimise identifiable patient data.

What we process

• Account identifiers and session security data
• Case material, measures, and exports you create
• Operational logs (access, generation, export) without emailing clinical bodies
• Optional AI inference on prompts you submit for provisional drafts

UK / EU / EEA

• Account data: contract and legitimate interests (security).
• Health data: only if entered by a regulated professional for care / professional purposes, with Art. 9 safeguards as applicable.
• Processor terms: execute a DPA before routine hosting of patient-level data.
• DPIA: owned by the controller organisation; nou supplies security / processor information on request.
• Rights: access, rectification, erasure, restriction, portability, objection — contact ops.
• Transfers outside UK/EU use appropriate safeguards (e.g. SCCs) where required by counsel.

United States

Where PHI is involved, HIPAA may apply to covered entities. Hosted PHI requires a signed BAA before nou acts as a business associate. We do not sell personal information (CCPA/CPRA). See Security.

Australia

Health information under the Australian Privacy Principles is sensitive. Organisations remain responsible for APP compliance when using nou. Request a service/privacy addendum via Agreements if needed for your practice group.

Canada

PIPEDA and provincial health privacy statutes (e.g. PHIPA in Ontario) may apply. Practices should confirm custodian obligations and whether a BA-style agreement is required in their province.

Retention

Account data is kept while the account is active and for a limited period afterward for security and legal claims. Case content is retained until deleted by the clinician or as required by a signed agreement / legal hold. Export before account closure if you need a local archive.

AI processing

Provisional drafts may be generated by third-party models (e.g. Groq). Do not include unnecessary identifiers in prompts. Outputs are labelled provisional and require human review (transparency posture aligned with EU AI Act / UK expectations for clinical support tools).