NAC ReadyNAC ReadyLast updated: September 6, 2026 · Privacy Policy version 2026-09-06-r12.
NAC Ready is the registered business name under which this service operates in Ontario, Canada. Privacy questions and requests can be sent to support@nacready.com or through the privacy contact form.
Account data you give us: name, email, and (optionally) phone number, plus a securely hashed password. For Google sign-in, we also store Google's stable, pseudonymous account identifier so your NAC Ready account remains linked if your Google email changes. Usage data: your practice sessions, scores and feedback so we can show your progress. Payment data is handled by our payment provider — we do not store your card details.
Campaign attribution: the source, medium and campaign that brought you to the site. A Google Ads click identifier may also appear in a campaign landing-page URL and may be processed by the Google tag as described below.
To understand the path from registration to practice and subscription, we also keep operational records of checkout creation and paid Stripe invoices linked to an internal account identifier. These records contain Stripe object identifiers, the account role when recorded, test or live mode, payment amounts and currency, billing category and timestamps. They do not contain card details, email addresses, advertising click identifiers or clinical content, and they are not sent to Google Ads. Our internal reports combine this information with campaign attribution and saved-report activity to show aggregate results.
NAC Ready is a simulated-patient study tool. Do not enter real patient identifiers or real patient health information. Remove names, health numbers, dates of birth, exact addresses, contact details and any other information that could identify a real patient or another person. If you accidentally submit such information, contact us promptly so we can assess and remove it.
To create and secure your account, provide the service and your progress, prevent duplicate/abusive accounts, process your subscription, contact you about your account, and measure which NAC Ready campaign links lead to visits and registrations. We do not sell your personal data.
Improving the service. We also analyze practice data — station scores, your self-assessments, the feedback our examiner generates, and how individual questions and flashcards perform — to improve NAC Ready. This lets us find content that is unclear, incorrect, too easy or too hard, refine how scoring and feedback are produced, and make the product and the learning experience better for everyone who uses it. Where a question is reported, or where you optionally rate an AI-patient case or send a comment or problem report, we use the report and any comment you send for the same purpose. Authorized administrators may review that feedback together with the related assessment and consultation transcript. A scheduled AI-assisted quality review may also analyze those materials to identify recurring product problems and prepare advisory improvement recommendations. The AI review is not permitted to change clinical content, assessments or the app automatically. This analysis is carried out in aggregate wherever possible, it is never used to make decisions about you outside the service, and nothing that identifies you is ever published.
We ask for consent to these purposes when you create an account and when you accept the Terms of Service and this Privacy Policy. You may withdraw consent by contacting the Privacy Officer. Withdrawal may mean that we cannot continue providing account, practice, support or subscription features that need the information.
Your account and progress data is stored on Cloudflare infrastructure (hosting and database), which is also where the service runs. Payment processing is handled by Stripe under its own privacy terms — we do not receive or store your card details. Advertising may be purchased through Google Ads; Google processes interactions with its advertising services under Google's Privacy Policy. Depending on the provider and service configuration, information may be processed or stored outside Ontario or Canada. We use the providers described below to operate and promote the service and require them to handle information under their applicable terms and safeguards.
When you use the simulated patient, examiner, feedback, optional post-case survey or speech features, NAC Ready sends only the information needed for that feature. This may include the text of your consultation, the case context, the text of a generated reply, your case ratings or comment, or audio that you record for transcription. We do not attach your name, email or phone number to AI requests, including the scheduled quality-review prompt.
These functions may use Cloudflare (hosting and hosted AI services), Google (AI and speech services), or Groq (AI and speech services). The specific service used can depend on the feature, availability and configuration. Providers may process information outside Ontario or Canada under their own terms and safeguards.
For text-to-speech, the reply text may be processed by a cloud speech provider. If your device's built-in voice is used, the text is spoken locally by your browser or operating system. For speech-to-text, the audio is sent to a speech-transcription provider so it can be converted into text. We do not sell your personal data or use your practice sessions to train a third-party model.
We advertise NAC Ready on Google Search. To understand which ads lead to sign-ups and paid subscriptions, we use optional Google Ads conversion measurement:
gclid, gbraid or wbraid to the ad link. Our short link preserves a valid identifier in the landing-page URL so the Google tag can attribute a later registration or purchase.You can decline measurement, or change your choice later with the Ad privacy control on campaign, account-completion and purchase-confirmation pages. A previous registration-only acceptance does not authorize the expanded purchase measurement: we ask again. A previous refusal remains respected. You can also use Google's advertising controls. NAC Ready, payment and access to your agreement work normally if you decline.
We use an essential cookie to keep you signed in. Campaign attribution is held in browser session storage while you move from the campaign page to registration; during Google sign-in, a temporary first-party cookie carries that attribution through the sign-in redirect and is then deleted.
Your Google Ads measurement choice is stored in your browser's local storage. If you allow measurement, Google may use first-party advertising storage on our domain. A short-lived, signed and HTTP-only first-party cookie carries only the hashed email, an opaque deduplication ID and the post-registration destination to the authenticated registration-complete page; it expires within 10 minutes of registration. If you decline, advertising storage and advertising user data remain denied and the enhanced conversion is not sent.
A separate signed, HTTP-only first-party cookie carries a verified purchase reference, the internal account and checkout reference, payment amount and currency, payment time and an opaque order ID to the authenticated purchase-confirmation page. It expires within 10 minutes. Checkout identifiers are removed from that page's URL before the Google tag loads. The purchase event is sent only after you allow the current measurement purposes; declining never prevents payment, access or agreement delivery.
We keep account, practice, report and progress data while your account is active and for as long as reasonably necessary to provide the service, resolve disputes, prevent abuse, maintain security and meet legal or accounting obligations. Raw audio sent for transcription is processed for that request and is not stored by NAC Ready. Saved report transcripts and the transcript copy attached to optional case feedback are removed after 180 days while the assessment, score and recommendations remain available. Campaign-attribution events are removed after 180 days. Resolved case feedback is ordinarily removed after 24 months, and de-identified daily improvement summaries after 12 months. AI-service telemetry and pseudonymous security events are kept for up to 90 days. Contact-form IP addresses are removed after 30 days, and resolved support or privacy requests are ordinarily removed after 24 months unless a legal, security, accounting or dispute-related reason requires longer retention. Payment and transaction records may be retained for the period required for tax, accounting, fraud-prevention or legal purposes.
The operational checkout and invoice observations used for this internal funnel measurement are removed after 180 days and unlinked from the account when it is deleted. These limited measurement records are separate from payment records retained for accounting or legal purposes.
When information is no longer required, we delete, de-identify or anonymize it. Deletion from active systems may be followed by normal backup expiry, and information may be retained where a legal, security or financial record must be preserved. We use safeguards appropriate to the sensitivity of the information, but no internet transmission or storage system can be guaranteed completely secure.
You can request access to, correction of, deletion of, or an explanation of our handling of your personal information. You may also withdraw consent. You can block cookies or use Google's advertising controls without losing access to NAC Ready. Send a request to support@nacready.com or use the privacy contact form. We may ask for reasonable information to verify the request. We will explain if information must be retained for a legal, accounting, security or dispute-related reason.
Contact the Privacy Officer first so we can investigate and respond. If you believe your concern has not been resolved, you may contact the Office of the Privacy Commissioner of Canada. If we confirm a security incident involving a real risk of significant harm, we will take the steps required by applicable law, including notifying affected individuals and regulators where required.
We may update this policy when the service, providers or legal requirements change. The date and version at the top identify the current policy. Material changes will be posted here and, where appropriate, communicated through the account email.
Written privacy notices and formal correspondence may be sent to NAC Ready at 110 Marine Parade Dr, Suite 505, Toronto, ON M8V 0B6, Canada. Email and the privacy contact form are the preferred channels for privacy requests.