Privacy Policy

Last updated: 25 October 2026

This privacy policy explains what personal data Nurses Notes (“we”, “us”, or “our”) processes when you visit nursesnotes.org, subscribe to our newsletter, contact us, or follow a job listing, why we do it, and what rights you have. It is written to meet the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), the German Telecommunications Digital Services Data Protection Act (TDDDG), and the Philippine Data Privacy Act of 2012.

1. Who is responsible

The controller responsible for processing personal data on this website is:

Nurses Notes
[Full legal name of the owner or company: to be added]
[Postal address: street, postcode, city, country: to be added]
Email: [email protected]
Phone: +1-478-227-6644

We have not appointed a data protection officer, because we are not legally required to. For any privacy question or request, email [email protected].

2. Summary

  • You can read Nurses Notes without giving us any personal data.
  • Analytics and advertising cookies are only used if you agree in our cookie banner, and you can change your choice at any time.
  • Our fonts are hosted on our own server, so no data is sent to Google Fonts.
  • We do not collect job applications or CVs. When you apply for a job, you apply directly on the employer’s website.
  • We do not sell your personal data.

3. Hosting, content delivery, and server logs

Our website is hosted by Namecheap, Inc. (USA). We also use Cloudflare, Inc. (USA) as a content delivery network and to protect the site against attacks. When you visit a page, your browser automatically sends technical data, which our host and Cloudflare process to deliver the page:

  • IP address, date and time of the request, and the page or file requested
  • browser type and version, operating system, and language
  • referring page, amount of data transferred, and whether the request succeeded

Purpose and legal basis: delivering the website, keeping it secure, and finding errors. Our legitimate interest is a secure and working website (Art. 6(1)(f) GDPR). These steps are strictly necessary to provide the service you request (§ 25(2) TDDDG).

Storage: server log files are deleted automatically after a short period, normally no longer than 30 days, unless we need a specific entry to investigate an attack or misuse.

We also use Cloudflare Web Analytics, which counts page views without cookies and without storing your IP address.

4. Cookies and your consent

Cookies are small text files stored on your device. We only use cookies that are not strictly necessary if you agree to them (§ 25(1) TDDDG and Art. 6(1)(a) GDPR).

When you first visit, our cookie banner asks for your choice. You can accept all, accept some, or reject all non-essential cookies. You can change or withdraw your consent at any time with the cookie icon at the bottom of every page. Withdrawing consent does not affect processing that took place before you withdrew it.

Cookie banner provider: the banner is provided by Cookie Compliance from Hu-manity.co, Inc. (USA). It stores your choice in a cookie on your device (“hu-consent”), which is necessary to remember your decision. Our legal basis is our legal obligation to obtain and document consent (Art. 6(1)(c) GDPR together with § 25 TDDDG) and our legitimate interest in a working consent tool (Art. 6(1)(f) GDPR).

Strictly necessary cookies (no consent needed): the cookie that stores your consent choice and, for site editors only, WordPress login cookies.

Statistics and marketing cookies (only with consent): Google Analytics and Google AdSense, described below. We use Google Consent Mode, which means these Google services do not set cookies or use identifiers until you consent.

5. Google Analytics

If you consent to statistics cookies, we use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), to understand how visitors use our website, for example which articles are read and how people find us.

  • Data processed: pages visited, time on page, approximate location (country or city), device and browser information, how you arrived (for example from a search engine), and an online identifier stored in a cookie. Google Analytics 4 does not store full IP addresses.
  • Legal basis: your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG).
  • Storage: analytics data is deleted automatically after the retention period set in our account, no longer than 14 months.
  • Transfers outside the EU: Google may process data in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission has issued an adequacy decision.

More information: Google Privacy Policy.

6. Google AdSense (advertising)

We show ads through Google AdSense, provided by Google Ireland Limited. If you consent to marketing cookies, Google may use cookies and similar technologies to show ads, limit how often you see them, measure their performance, and, if you allow it, personalise ads based on your interests. If you do not consent, no advertising cookies are set.

  • Legal basis: your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG).
  • Transfers outside the EU: Google LLC is certified under the EU-US Data Privacy Framework.

You can manage personalised advertising at Google Ad Settings. More information: How Google uses data in advertising.

7. Fonts

Our fonts (Inter, Literata, and Open Sans) are stored on our own server. No connection is made to Google Fonts or any other font provider when you visit our pages.

8. Newsletter and free cheat sheet

You can subscribe to our free newsletter, for example to receive the electrolytes cheat sheet, new study notes, health tips, and job updates. You only need to give your email address.

  • Double opt-in: after you subscribe, we send you an email asking you to confirm. Your subscription is only active once you confirm.
  • Data processed: your email address, the date and time you subscribed and confirmed, your IP address at the time, and which emails you open or click, so we can prove your consent and improve our newsletter.
  • Legal basis: your consent (Art. 6(1)(a) GDPR).
  • Unsubscribe: you can withdraw your consent at any time with the unsubscribe link in every email or by emailing us.
  • Storage: until you unsubscribe. After that, we may keep your email address on a block list for up to 3 years so we can prove that you previously gave consent and that we respect your choice (Art. 6(1)(f) GDPR).
  • Service provider: we send the newsletter with MailerLite, operated by UAB “MailerLite” (Lithuania, EU), which processes the data on our behalf under a data processing agreement (Art. 28 GDPR).

9. Contacting us

When you email or call us, we process your name, contact details, and the content of your message to answer you. The legal basis is our legitimate interest in replying to enquiries (Art. 6(1)(f) GDPR) or, if your enquiry relates to a contract such as a job listing for your organisation, taking steps before entering into a contract (Art. 6(1)(b) GDPR). We delete your message once your enquiry is resolved, unless we must keep it for legal reasons such as tax records.

10. Job listings

Our job board lists vacancies from hospitals and other healthcare employers. We do not collect applications, CVs, or other application documents. When you click “Apply on company site”, you leave our website and apply directly with the employer, whose own privacy policy applies. Links to employer websites contain tracking parameters (for example “utm_source=nursesnotes”) so the employer can see that you came from Nurses Notes. These parameters do not contain any personal data.

11. Links to other websites and social media

Our articles link to sources such as health authorities and research journals, and our site links to our pages on Instagram, Facebook, and LinkedIn. These are ordinary links: no data is sent to these services unless you click a link. Once you leave our website, the privacy policy of the other website applies.

If you visit our pages on social networks, the network’s own privacy policy also applies. For our Facebook and Instagram pages, we and Meta Platforms Ireland Limited are joint controllers for page statistics (“Page Insights”) under an agreement that you can read in Meta’s Page Controller Addendum. Meta is primarily responsible for this processing and for answering your requests about it.

12. Recipients of your data

We only share personal data with the service providers named in this policy (hosting, content delivery, newsletter, email, analytics, advertising, and consent management) where this is necessary for the purposes described, or where we are legally required to. Service providers that process data on our behalf do so under data processing agreements. We do not sell your personal data or share it with employers, advertisers, or other partners for their own purposes.

13. Transfers outside the EU and EEA

Some of our service providers are based in, or use servers in, countries outside the EU and EEA, such as the USA. We only transfer data where an adequacy decision applies (for example for companies certified under the EU-US Data Privacy Framework) or where the provider has agreed to the European Commission’s Standard Contractual Clauses.

14. How long we keep data

We keep personal data only as long as needed for the purpose for which we collected it, or as long as the law requires. The specific periods are given in each section above. Where tax or commercial law applies, for example to invoices for paid job listings, we keep the relevant records for up to 10 years.

15. Your rights

Under the GDPR, you have the right to:

  • access the personal data we hold about you (Art. 15 GDPR);
  • have incorrect data corrected (Art. 16 GDPR);
  • have your data deleted (Art. 17 GDPR);
  • restrict how we process your data (Art. 18 GDPR);
  • receive your data in a common, machine-readable format (Art. 20 GDPR);
  • withdraw any consent you have given at any time, with effect for the future (Art. 7(3) GDPR); and
  • object to processing based on our legitimate interests (Art. 21 GDPR, see below).

To use any of these rights, email [email protected]. We will reply within one month.

Right to object (Art. 21 GDPR): where we process your data based on our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation. We will then stop, unless we can show compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is needed to establish, exercise, or defend legal claims. You can object to the use of your data for direct marketing at any time, without giving reasons.

Right to complain: you have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live, work, or where you believe a breach took place (Art. 77 GDPR). A list of German supervisory authorities is available from the Federal Commissioner for Data Protection (BfDI).

Visitors in the Philippines: under the Data Privacy Act of 2012, you also have the rights to be informed, to access, to object, to rectification, to erasure or blocking, to data portability, and to damages, and you may file a complaint with the National Privacy Commission.

16. Is providing data required?

You are not legally or contractually required to give us personal data. You can read our website without doing so. If you want to receive our newsletter, we need your email address.

17. Automated decisions and children

We do not make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you (Art. 22 GDPR). Our website is intended for adults and is not directed at children under 16.

18. Security

Our website uses an encrypted connection (TLS/HTTPS). We use technical and organisational measures to protect your data against loss, misuse, and unauthorised access.

19. Changes to this policy

We update this policy when our website or the law changes. The current version is always available on this page, with the date of the last update at the top.