Privacy Policy
TL;DR: We collect only what we need to provide our service. We never sell your data. We’re FERPA compliant. You can request your data or delete your account anytime.
Introduction
ScrubCampus (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our nursing education platform and related services (collectively, the “Service”).
We understand that educational data requires special protection. As a platform serving nursing students, educators, and healthcare institutions, we take our responsibility to protect your information seriously.
By using our Service, you agree to the collection and use of information in accordance with this policy.
Information We Collect
Information You Provide
| Data Type | Examples | Purpose |
|---|---|---|
| Account Info | Name, email, password | Authentication & communication |
| Educational Info | Institution, courses, progress | Service delivery |
| User Content | Quiz responses, notes | Learning features |
| Communications | Support requests, feedback | Customer support |
| Payment Info | Billing address, payment method | Transaction processing |
Information Collected Automatically
| Data Type | Examples | Purpose |
|---|---|---|
| Device Info | Browser, OS, screen size | Compatibility & optimization |
| Log Data | IP address, access times, pages | Security & analytics |
| Usage Data | Features used, completion rates | Product improvement |
| Performance | Response times, errors | Reliability monitoring |
For detailed information about cookies, see our Cookie Policy.
How We Use Your Information
Service Delivery
- Provide, maintain, and improve our educational platform
- Personalize your learning experience based on your progress
- Enable multiplayer quiz features and real-time interactions
- Process transactions and send related information
Educational Analytics
- Generate progress reports and performance analytics
- Identify areas for improvement and provide recommendations
- Create aggregated, anonymized insights about learning patterns
- Support institutional reporting requirements
Communication
- Send service-related notices, including updates and security alerts
- Respond to your comments, questions, and support requests
- Send promotional communications (with your consent)
Safety and Compliance
- Detect, prevent, and address fraud, abuse, and security issues
- Enforce our Terms of Service and other policies
- Comply with applicable laws and regulations
Data Sharing
We do not sell your personal information.
| Recipient | What We Share | Why |
|---|---|---|
| Your Institution | Educational records, progress | If you access via an institution |
| Service Providers | Data needed for their service | Cloud hosting, payments, analytics |
| Legal Authorities | As required by law | Compliance with legal processes |
| Business Transfers | All data (with notice) | Mergers, acquisitions |
Service Providers We Use
- Cloud Hosting: AWS, infrastructure services
- Payment Processing: Stripe (we never see full card numbers)
- Analytics: Privacy-focused analytics
- Authentication: Keycloak for secure SSO
All providers are contractually obligated to protect your information.
Data Retention
| Data Type | Retention Period | Reason |
|---|---|---|
| Account Data | Active + 3 years | Service continuity |
| Educational Records | 7 years | Regulatory requirements |
| Usage Data | 2 years (then anonymized) | Product improvement |
| Payment Records | 7 years | Tax/accounting requirements |
| Support Communications | 3 years | Quality assurance |
You may request deletion at any time, subject to legal retention requirements.
Your Rights
Rights for All Users
- Access: Receive a copy of your personal information
- Correct: Fix inaccurate or incomplete information
- Delete: Remove your account and associated data
- Object: Restrict certain processing activities
- Withdraw Consent: Where processing is based on consent
Regional Rights
GDPR Rights (European Users)
If you are in the EEA, UK, or Switzerland, you have additional rights:
- Data Portability: Receive data in a portable format
- Restriction: Limit processing in certain situations
- Object to Profiling: Opt out of automated decision-making
Contact: privacy@scrubcampus.com (response within 30 days)
CCPA Rights (California Residents)
California residents have specific rights under CCPA:
- Right to Know: Disclosure of data collected, used, and shared
- Right to Delete: Request deletion of personal information
- Right to Opt-Out: We do not sell personal information
- Non-Discrimination: Equal service regardless of privacy choices
Contact: privacy@scrubcampus.com
FERPA Compliance
For users accessing ScrubCampus through an educational institution, we act as a “school official” under FERPA:
| Requirement | How We Comply |
|---|---|
| Educational Records | Handled per FERPA requirements |
| Legitimate Interest | Only used for educational purposes |
| Direct Control | Institutions maintain control |
| No Re-Disclosure | Never disclosed without consent |
| Parent/Student Rights | Exercised through institution |
Our agreements with institutions include FERPA school official exception requirements.
Children’s Privacy
Our Service is for post-secondary nursing education and is not intended for children under 13.
- We do not knowingly collect data from children under 13
- If discovered, we will promptly delete such information
- For users 13-18, we encourage parental involvement
Contact us at privacy@scrubcampus.com if you believe a child has provided information.
Security
| Measure | Implementation |
|---|---|
| Encryption | TLS 1.3 (transit), AES-256 (at rest) |
| Access Controls | Role-based access, MFA, audit logging |
| Infrastructure | SOC 2 compliant hosting |
| Training | Regular security awareness for staff |
| Incident Response | Documented detection and response procedures |
See our Security & Compliance page for more details.
Changes to This Policy
When we make material changes:
- We update the “Last Updated” date
- We notify you by email (if you have an account)
- For significant changes, we request consent where required
Continued use after changes take effect constitutes acceptance.
Contact Us
| Purpose | Contact |
|---|---|
| Privacy Inquiries | privacy@scrubcampus.com |
| Data Protection Officer | dpo@scrubcampus.com |
| General Legal | legal@scrubcampus.com |
For GDPR-related inquiries, you may also lodge a complaint with your local data protection authority.