Privacy policy.

When a therapist or practice uses Nora, the practice is the custodian of its client records and Nora acts as a service provider processing that information on the practice's instructions. For your own account information — your login, subscription and settings — Nora is the organisation responsible.

If you are a client of a therapist who uses Nora, your therapist or clinic decides what is recorded about you. Questions about your clinical record should go to them; questions about the platform can come to us.

• Account information: name, email, phone number, password credentials, and sign-in details if you use Google sign-in.
• Practice information: practice name, team members, roles, services and prices, availability, revenue splits, payout settings and hours you log.
• Client information entered by therapists: contact details, appointments, session notes, uploaded documents and homework.
• Booking and messaging content: booking requests, in-app messages, notification preferences and reminder history.
• Payment information: amounts, status, refunds and payout records. Card numbers are collected and stored by our payment processor, not by Nora.
• Technical information: IP address, device and browser details, and log data needed to operate, secure and debug the service.

• To provide the service: booking pages, calendars, telehealth sessions, messaging, notes, documents, payments and payouts.
• To send transactional messages: booking confirmations, reschedules, cancellations, reminders, receipts and account emails, by email and SMS according to your notification settings.
• To take payment for your Nora subscription and to move client payments to the accounts you connect.
• To secure the service, prevent fraud and abuse, and troubleshoot problems.
• To answer support requests and improve the product.
• To meet legal, accounting and regulatory obligations.

We do not sell personal information, and we do not use client records or notes for advertising.

Video sessions are peer-to-peer connections between participants; Nora passes the connection details needed to place the call. We do not record video or audio sessions. In-app messages are stored so both sides can see the conversation history, and are visible to the participants of that conversation.

Nora AI answers questions using a snapshot of your own dashboard data — your appointments, earnings and settings. That snapshot is sent to a third-party AI provider to generate the answer. It is not used to train public models by us, and clients never see another practice's data.

We share information only with service providers that help us run Nora, and only what they need:

• Cloud hosting, database and file storage providers.
• Our payment processor, for subscriptions, client payments, refunds and transfers.
• Email and SMS providers, to deliver confirmations, reminders and account notices.
• An AI provider, for Nora AI responses.
• Professional advisors or authorities, where required by law or to protect rights and safety.

If Nora is ever involved in a merger or acquisition, information may transfer as part of that transaction, subject to this policy.

Nora runs on third-party cloud infrastructure. Some providers process or store data outside Canada, which means that information may be subject to the laws of those jurisdictions. If your practice has specific residency requirements, contact us before relying on Nora for those records.

Access to data is scoped so that a practice sees only its own records, a therapist sees only their clients, and a client sees only their own information. Data is encrypted in transit, documents are kept in private storage with signed, time-limited access, and administrative access is limited to what is needed to support the service. See our security page for more detail. No system is perfectly secure, so please use a strong, unique password.

We keep account and practice information for as long as your account is active. Client records, notes and documents are retained under your instructions — you can delete them from the dashboard — and we keep payment and payout records as long as needed for financial and legal obligations. When an account is closed, we delete or de-identify data on a routine schedule, except where retention is legally required. Export what you need before closing your account.

• Access and correction: request a copy of the personal information we hold about you, or ask us to correct it.
• Deletion: ask us to delete your account information, subject to legal retention limits. If you are a client, requests about your clinical record go to your therapist as the record custodian.
• Notifications: choose email, SMS or both in your settings. Transactional messages about your bookings and payments are part of the service and cannot be fully turned off while your account is active.
• Withdraw consent: stop using the service and close your account at any time.

To make a request, use our contact form. We may need to verify your identity before we act, and we respond within the time frames required by Canadian privacy law.

Nora accounts are for adults. Where a therapist provides care to a minor, the account and consent are managed by the parent or guardian in accordance with the therapist's professional obligations.

We use cookies and similar local storage only for essentials: keeping you signed in, remembering your preferences and keeping sessions secure. We do not use them for advertising.

We will post updates here with a new "last updated" date, and will notify account holders by email where a change materially affects how we handle personal information.