Privacy Policy

1. Who we are

EndorseMe is operated by Black Health Intelligence Pty Limited (ACN 693 026 112, ABN 23 693 026 112), trading as Endorse Me. EndorseMe helps current and future Nurse Practitioners organise professional registration, education, employment, continuing professional development and supporting evidence. We are not AHPRA, the Nursing and Midwifery Board of Australia, or an official government submission service.

This policy explains how we handle personal information when you visit EndorseMe, create an account, use the platform or contact us. It is intended to be read with our Terms of Service.

2. Information we collect

Depending on how you use EndorseMe, we may collect:

• account details, such as your name, email address and sign-in credentials;
• professional details, including registration, qualifications, roles, CPD and practice hours;
• portfolio content and supporting documents that you choose to upload or create;
• support requests, feedback and service communications;
• technical and usage information needed to operate, secure and improve the service; and
• subscription status and payment-related identifiers from Stripe. Stripe, not EndorseMe, handles your full payment-card details.

Do not upload identifiable patient information. If you use case examples, remove names, dates of birth, contact details, record numbers and any other information that could identify a patient.

3. How we collect and use information

We collect information directly from you when you register, enter portfolio data, upload a document, make a payment or contact us. We also receive limited technical information when you use the site.

We use information to:

• provide the account, portfolio, readiness and export features you request;
• authenticate users, protect accounts and investigate misuse or security issues;
• provide subscription, billing and customer support;
• maintain and improve the reliability and usability of EndorseMe; and
• meet legal, regulatory and record-keeping obligations that apply to us.

4. AI-assisted features

Some optional EndorseMe features use AI to help draft, organise or analyse content. When you choose to use one, the text or document content needed for that request may be processed through our AI service infrastructure. AI output is informational and draft-only. You must review, correct and verify it before relying on it in a professional or regulatory context.

EndorseMe's AI features are developed and reviewed in alignment with Australian AI-safety practices, including transparency, human oversight and data governance. They do not diagnose, provide medical advice, determine whether practice qualifies for endorsement, or replace a regulator, supervisor or treating practitioner.

5. Who else handles your information, and where

We disclose personal information only where reasonably needed to run EndorseMe, or where required or permitted by law. We do not sell it. Below is the actual list of companies involved and the country each one works in, so you can see it rather than take our word for it.

Your records are stored in Australia.

Your account, portfolio, CPD, practice hours and uploaded documents live in our database and file storage, which run in Sydney, Australia (Supabase, region ap-southeast-2). They are not copied to another country to be stored.

Some things are handled overseas.

When you use the website, and for a few specific features, information passes through these companies:

• Vercel — website and app hosting. Every page you load and every action you take is served by Vercel. Our server code runs in Vercel's Washington DC region in the United States, so information travels there while a page or request is being handled.
• Resend — email. Emails we send you are delivered by Resend, which processes email in the United States. Your name, email address and the contents of the message go to it.
• Stripe — payments. Stripe takes and stores your card details; we never see the full card number. Stripe is a United States company.
• Vercel AI Gateway — the optional AI features. When you choose to use one, the text of that request is sent through Vercel's AI Gateway to the model answering it. Today those models are GPT-5.5, run by OpenAI, and Claude, run by Anthropic — both United States companies. Vercel states that the Gateway deletes prompts and responses once a request completes. Vercel does not publish which country the Gateway itself processes requests in.
• Deepgram and Groq — voice notes. If you dictate a note, the audio is sent to one of these to be turned into text. Both are United States companies. Audio cannot be automatically scrubbed the way typed text can, so please do not say anything that identifies a patient.
• Vercel Analytics — how the site is used. Records which pages are viewed, to help us see what people use. Private links are stripped out before anything is sent. It is part of Vercel and processes in the United States.
• Abe AI — the professional development finder. When you open the course finder, we send Abe AI a scrambled code for your session. We do not send your name or your email address. Abe AI does not publish which country it processes in.
• Your browser's notification service — only if you turn notifications on. A web notification is delivered by whoever makes your browser: Google for Chrome and Android, Apple for Safari and iPhone, Mozilla for Firefox. We send the notification to them and they pass it to your device, so they handle the address of your device and the fact that a notification was sent. The contents are encrypted so only your device can read them. These companies are outside Australia and do not publish where this is handled. Turning notifications off in Settings stops it.
• Telegram — only if you connect it. Matron can be used through Telegram if you choose to link it. If you do, your messages go through Telegram's servers outside Australia. Telegram does not publish where. Do not send anything through Telegram that you would not want handled that way; the website works without it.

If you use any other optional third-party integration, that provider's own privacy terms will also apply. We keep this list current — if you spot something missing, tell us and we will fix it.

6. Security, retention and browser technology

We use technical and organisational measures designed to protect account and portfolio information. No online service can guarantee absolute security, so keep your password confidential and tell us if you believe your account has been accessed without permission.

We retain information while your account is active and afterwards only for as long as reasonably necessary for the purposes described here, including legal, security and record-keeping needs. The site uses functional browser storage for authentication and settings, and Vercel Analytics to help us understand aggregate site use.

7. Access, correction and complaints

You can ask to access or correct personal information we hold about you, or ask a question or make a privacy complaint, by emailing office@endorseme.com.au. We will respond in a reasonable time and explain if we cannot meet a request. If you are not satisfied with our response, you may be able to complain to the Office of the Australian Information Commissioner.

8. Changes to this policy

We may update this policy when our information handling changes. We will publish the current version on this page and update the date above.