Privacy Policy
Nora is a health companion, which means you tell her things you would not tell most companies. This page explains what happens to that information, in plain language.
Your email address, name, age, sex, and the answers you give during onboarding — your life stage, how you move, how you sleep, the constraints in your day, and any medications, supplements or conditions you choose to share. That last one is optional.
Your messages, and anything you upload — lab results, photographs, documents.
What is needed to run the service and diagnose faults: your account identifier, timestamps, and error logs.
That is all. No location tracking, no contacts, no device fingerprinting, no advertising identifiers, no third-party trackers.
So Nora does not ask you the same thing twice, and so her answers account for what you have already told her. That is the whole purpose. A health companion who forgets your allergies is not useful, and one who makes you retype your history every session is not either.
Your information is used to make Nora better for you. It is not used to train AI models.
One thing we would rather say plainly than bury. We use anonymised, de-identified conversations to improve how Nora reasons — names, identifiers, and anything that could point back to you stripped out first. This is people reading findings and editing her instructions, not a model learning from your data. If you would rather we did not, email support@truenora.com and we will switch it off for your account. No explanation needed.
Running Nora requires a small number of outside services. These are all of them.
| Who | What they do |
|---|---|
| Amazon Web Services and Linode | Cloud infrastructure. Your data is stored here |
| Anthropic | Provides the AI model that generates Nora's answers. Your messages are sent to their API to produce a reply, under terms that prohibit training on your data |
Nobody else receives your information. TrueNora is a wellness tool rather than a healthcare service, so it is not a HIPAA-covered entity — and rather than leave it there, the list above is what we will say instead.
Your data is stored and processed in Australia, and backup copies are held in Australia and Singapore. If you are outside those countries, your information is transferred there in order to provide the service.
During this private beta: your information is kept while your account is active, so Nora can do what you are using her for. Beta data is deleted within one month of the beta period ending, unless you continue as a paying member. You do not need to do anything for that to happen.
As a paying member: we keep your information while your account is active. If you cancel, it is deleted within 90 days.
Backups. Once your information is deleted from our live systems it no longer appears anywhere you or we can see it, but it remains in encrypted backups until those expire — within 90 days for routine backups, and up to 12 months for monthly snapshots. Backups are then purged on the same schedule. We mention this because it is true of almost every service and most policies leave it out.
Ask, and we delete it. Email support@truenora.com — we action requests the same day where we can, and always within 30 days. Backups then expire on the schedule above.
You can also ask what we hold about you at any time, and we will tell you.
Your data is transmitted over encrypted connections, and access is limited to the people who build and operate the service — only to fix problems. No system is perfectly secure and we will not claim ours is.
The infrastructure Nora runs on is currently undergoing ISO 27001 and SOC 2 certification, expected in October 2026. Those certifications cover the underlying platform rather than TrueNora itself, and we will not describe them as ours.
Some clinicians use Nora to think through their own clinical reasoning. Please keep identifying details about a patient out of it — no names, dates of birth, addresses, contact details, or record numbers. Nora answers the clinical question without them, and she will tell you if identifying details appear.
TrueNora is not a business associate under HIPAA and is not a platform for protected health information.
Nora is for adults. You confirmed at signup that you are 18 or over. We do not knowingly collect information from anyone younger, and we delete it if we find it.
If this policy changes materially, we will give 14 days advance notice rather than quietly updating this page. The version number and effective date above will change with it.
Questions, deletion requests, or anything about your data: support@truenora.com