Privacy Policy

Version 2.0 · Effective October 12, 2026 · InBoundAI365, LLC d/b/a Neurodivergent Vitals

In plain English: We collect what we need to sign you in, take payment, and remember your progress. We don't sell your data, we don't run ad trackers, we don't collect or infer anything about your health, and you can delete your account yourself.

What changed on October 12, 2026: a full list of the service providers we use, including Google Fonts and the browser's speech recognition; the Job Finder, exam date, planner and display-preference data we store; the content-access log; a plain statement that we do not collect or infer health information; self-serve account deletion; our phone number; and a "Changes to this policy" section. We removed an outdated reference to pay-later financing providers, which checkout no longer offers.

1. Personal information we collect 2. How we use it 3. Who we share it with Service providers we use 4. Cookies and local storage 5. How long we keep it 6. Security 7. Your rights and choices 8. Children 9. Where data lives 10. Changes to this policy 11. Contact

1. Personal information we collect

These are the categories of personal information we collect, where each comes from, and why.

Account information

When you create an account, our sign-in provider (Clerk) collects your name, email address, and password or the identity you sign in with (for example Google), plus sign-in events and device and IP data used for security. A Cloudflare Turnstile check may run during sign-up to stop bots. We receive your name, email, a user ID, and sign-in status.

Payment information

Payments are processed by Stripe. Stripe collects your card or payment details directly; we never receive your full card number. We keep Stripe's identifiers for your purchase (session, customer, subscription, and charge IDs), the amount, the plan you chose, any promotional code, and, for showing you a receipt, the card brand and last four digits as returned by Stripe. When you join, we also record your agreement to automatic renewal: the version of the renewal terms you saw, the plan, the time, a hashed IP address and your browser string.

Learning data

To run the Service we store what you do in it: lessons started and completed, where you paused, drill and check answers and their timestamps, mastery status per chapter, recall scheduling, your free-trial start date, and settings such as theme, voice volume and display preferences (font, text size, spacing and motion). When you are signed in, this syncs to our servers so it follows you between devices; when you are not, it stays in your browser.

Exam date and planner

If you enter your exam date, we store it to count down to it. If you use the Planner, we store the school calendar and study plan you build there (classes, clinicals, exams, study blocks, and the names and notes you give them), synced to your account.

Job Finder

If you use the Job Finder (included with membership), we store the ZIP code you enter and an approximate location we derive from it (the center of that ZIP code, not your precise location), your search radius, the certifications you hold, your pay floor, the employers you exclude, and whether you want job alerts. Job alerts are off unless you turn them on. Job listings themselves come from employers' public job pages, not from you.

Resume builder

If you use the resume builder, we store what you type into it — your name, phone number, email address and city, the certifications, education and work history you enter, and the skills you tick — so it is there when you come back on any device. It is stored with your account, shared with no one, and deleted when your account is deleted. Downloading the PDF happens in your browser; the file is not sent to us.

Content-access log

To detect bulk copying of paid lessons and audio, we keep a content-access log: for each signed-in account, a count per day of paid lesson files and audio clips fetched, with the first and last time that day. It does not record which lesson or clip, and it is used only to investigate abuse of our Terms.

Terms acceptance

When you accept our Terms and Privacy Policy (the first time you open the app after sign-up, after a material update, or at checkout), we record the version, the time, your confirmation that you are 16 or older, a hashed IP address and your browser string, as evidence of the agreement.

Communications

If you email us, we keep the correspondence so we can help you and keep a record of it. If a required account email (for example your membership terms or a renewal notice) fails to send, we keep a copy queued until it is delivered.

Technical data

Our hosting provider (Cloudflare) processes IP addresses, request logs, and basic browser information to deliver the site and defend it against abuse. We do not use advertising trackers, social-media pixels, or third-party analytics cookies. We keep our own cookieless count of page views per day — the page and the name of the website that linked to it, nothing that identifies you. When you arrive from one of our ads, the ad link carries a short ad tag that names the ad (not you). We count visits per ad tag, and if you then create an account we note the first ad tag on your account, so we can tell which ads actually help learners. Until you sign in, the tag sits only in your open browser tab and is gone when you close it.

Health information

We do not collect or infer health information or any medical condition about you. The medical content in the Service is course material about patients; your answers to it are study records, not information about your own health. Display preferences such as font or text size are ordinary settings and are not used to draw any conclusion about you.

2. How we use it

to provide, personalize, and improve the Service — including saving and syncing your progress and deciding what to teach or ask next;
to take payment, deliver receipts and the renewal notices the law requires, manage payment plans and refunds, and prevent fraud;
to communicate with you about your account, purchases, and material changes, and — if you opt in — study reminders, job alerts and product news (you can unsubscribe any time);
to secure the Service, investigate abuse, and enforce our Terms;
to understand how the Service is used, in aggregated or de-identified form, and to publish statistics that do not identify anyone;
to comply with law.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

3. Who we share it with

Only service providers that process data on our behalf under contract, and only what each needs (listed below). We may also disclose information if required by law or legal process, to protect the rights, safety, or property of users or InBoundAI365, or as part of a merger, acquisition, or sale of assets (in which case this policy continues to apply to your data until changed with notice).

Service providers we use

Cloudflare — hosting, our database and file storage, content delivery, security and bot protection (including Turnstile during sign-up). Our site's security policy also allows Cloudflare Web Analytics, a cookieless page-view counter that does not follow you across sites. Receives: IP address, request data, and everything stored in your account.
Clerk — sign-in and account management, and the sign-up and verification emails. Receives: name, email, password or sign-in identity, sign-in events, device and IP data.
Stripe — payments, receipts, and the billing page where you update your card. Receives: payment details, email, the plan and amount.
Resend — sends our transactional emails (membership terms, renewal notices, cancellation confirmations). Receives: your email address and the message.
Google Fonts — serves the typefaces our pages use. Your browser requests the font files from Google, which receives your IP address and browser information.
Google speech recognition (in Chrome) — only when you choose to answer out loud ("Say it"). The app uses your browser's built-in speech recognition; in Google Chrome that audio is sent to Google to be turned into text under Google's own terms. We receive only the text, and we do not store your voice. Other browsers may process it on your device or with their own provider.

4. Cookies and local storage

We use a small number of strictly necessary cookies: our own session cookie (nv_s) that proves your access to paid content, and Clerk's cookies that keep you signed in. Cloudflare may set a security cookie during the sign-up bot check. Your browser's local storage holds your theme choice and, if you study without an account, your progress, exam date and planner; the app also keeps an offline copy of its free pages in your browser. Stripe's checkout pages set their own cookies under Stripe's policy. We do not use advertising or analytics cookies. You can clear cookies and local storage in your browser at any time; doing so signs you out and, without an account, erases local progress.

Do Not Track and Global Privacy Control. We do not track you across other websites or over time for advertising, so the Service works the same whether or not your browser sends a Do Not Track or Global Privacy Control signal — there is no tracking for either signal to switch off.

Third-party tracking. We do not allow other parties to collect personal information about your online activities over time and across different websites when you use the Service. The providers in Section 3 process data only to run their part of the Service for us; Stripe's checkout pages are covered by Stripe's own privacy policy.

5. How long we keep it

Account and learning data are kept while your account exists. When you delete your account (or ask us to), we erase your learning data, exam date, planner, Job Finder profile and content-access log right away; copies in our providers' backups roll off within 90 days. Purchase records, automatic-renewal agreements, Terms acceptances, and correspondence are kept for as long as needed for tax, accounting, dispute, and legal-compliance purposes (typically seven years). Aggregated statistics that do not identify anyone may be kept indefinitely.

6. Security

Data is encrypted in transit; access to production systems is limited to those who need it; payments never touch our servers; and paid content is protected by signed, server-verified sessions. No system is perfectly secure, and we cannot promise that unauthorized access will never occur. If a breach affects your data, we will notify you as required by law.

7. Your rights and choices

You can update your name, email, and password from the Account page inside the app. You can delete your account yourself from Account → Delete account: auto-renewal is turned off first so nothing more is charged, then your data is erased as described in Section 5. You can also email hello@neurodivergentvitals.com from your account address to: access a copy of your data, correct it, delete your account and data, or object to a particular use. We will verify the request and respond within 45 days (extendable once as the law allows). We do not discriminate against you for exercising your rights.

California residents have these rights under the CCPA/CPRA, including the right to know the categories of personal information we collect (listed in Section 1), the purposes (Section 2), and the categories of third parties we share with (Section 3). We do not sell or share personal information as those terms are defined in the CPRA, so there is nothing to opt out of. If that ever changes, we will treat a Global Privacy Control signal as a valid opt-out before any selling or sharing begins. You may designate an authorized agent by providing written permission. Residents of other U.S. states with privacy laws have comparable rights and may use the same contact. Nevada residents: we do not sell covered information.

Email preferences. Transactional messages (receipts, renewal notices, payment problems, material changes) are part of the Service. Any optional reminders, job alerts or news are opt-in and include an unsubscribe link.

8. Children

The Service is not directed at children under 13 and we do not knowingly collect personal information from children under 13. Users must be 16 or older (Section 1 of the Terms), and we ask you to confirm that the first time you sign in. If you believe a child under 13 has given us personal information, email us and we will delete it.

9. Where data lives

We are based in the United States and our providers store and process data in the United States (Cloudflare may serve cached, non-personal content from locations near you). If you use the Service from outside the United States, you understand your data will be processed in the United States, where privacy laws may differ from those of your country.

10. Changes to this policy

We will post any changes here, update the version and effective date above, and summarize what changed at the top of this page. For material changes we will notify you by email or in the Service at least 30 days in advance, and we ask signed-in users to accept the updated policy the next time they open the app.

11. Contact

Questions or requests: InBoundAI365, LLC · Neurodivergent Vitals · hello@neurodivergentvitals.com · (916) 518-8149 · 2110 K St, Sacramento, CA 95816.