Privacy Policy
Last Updated: October 27, 2026 • Version 2.0
This Privacy Policy details how PrepFord NCLEX safeguards candidate data, session tokens, assessment telemetry, and personal information across our nursing licensure preparation services.
1. Introduction & Scope
Welcome to PrepFord NCLEX ('PrepFord', 'we', 'us', or 'our'). PrepFord provides an independent examination preparation platform designed specifically for nursing licensure candidates preparing for the National Council Licensure Examination for Registered Nurses (NCLEX-RN®) and Practical Nurses (NCLEX-PN®).
This Privacy Policy explains how PrepFord collects, uses, stores, discloses, and protects your personal data when you interact with our website, access our online question banks and diagnostic assessments, register an account, or communicate with our support personnel.
We are committed to transparent, lawful, and secure handling of candidate information. Please read this Privacy Policy carefully to understand our data practices and your rights regarding your personal information.
2. Definitions
To ensure clarity throughout this document, the following terms have specific meanings:
Key Definitions
- •'Candidate' or 'User' refers to any individual accessing or registered on the PrepFord platform.
- •'Personal Data' means any information relating to an identified or identifiable natural person.
- •'Assessment Telemetry' refers to question responses, timing data, topic proficiencies, exam scores, and readiness calculations generated during study sessions.
- •'Services' encompasses the PrepFord web application, NCLEX question banks, rationales, diagnostic evaluations, and customer support channels.
3. Information Users Provide Directly
We collect personal data that you voluntarily provide to us when interacting with the PrepFord platform:
Categories of Directly Provided Data
- •Registration details: Full name, email address, password, and chosen licensure track (NCLEX-RN or NCLEX-PN).
- •Profile preferences: Learning timeline, target examination date, and self-selected study topics.
- •Communications: Inquiries, feedback, support messages submitted through our Contact Us form, email correspondence, or educator consultation requests.
- •Survey and feedback inputs: Voluntary responses provided during user experience evaluations or feature feedback surveys.
4. Account & Authentication Information
To safeguard candidate accounts and prevent unauthorized access to prep materials, PrepFord implements secure authentication mechanisms:
Email/Password Authentication: When registering with email and password, passwords are never stored in plaintext. They are evaluated against high-entropy baseline security policies (zxcvbn score 3 or higher) and cryptographically hashed using salted, industry-standard key derivation functions before storage.
Federated Google Authentication: When you sign in using Google OAuth 2.0, authentication occurs directly via Google's identity servers using the Authorization Code Flow with Proof Key for Code Exchange (PKCE, RFC 7636). We collect only your verified email address, full name, and unique Google account identifier provided by Google Identity Services. We never receive or store your Google account password.
5. Usage, Diagnostic, Device & Technical Data
When you use our learning tools, we automatically collect technical and performance telemetry necessary to deliver tailored study recommendations and maintain platform reliability:
Collected Technical Telemetry
- •Device and network attributes: IP address (truncated or pseudonymized where feasible), browser type and version, operating system, preferred language, and screen resolution.
- •Session logs: Timestamps of logins, page views, navigation paths, and error stack traces for application debugging.
- •Assessment telemetry: Specific questions attempted, answer selections, time elapsed per item, scores achieved, and topic mastery indicators.
6. Cookies & Tracking Technologies
PrepFord uses strictly necessary and functional cookies to ensure platform security, maintain login state, and remember your visual display preferences:
Specific Cookies Deployed
- •'preform_session': A secure, HTTP-only, SameSite cookie used to maintain authenticated user sessions across requests.
- •'preform_oauth_state': A short-lived, encrypted, HTTP-only cookie used exclusively to verify state integrity and prevent Cross-Site Request Forgery (CSRF) during Google OAuth handshakes.
- •Theme preference cookies: Lightweight client storage tokens used to persist your choice of Light, Dark, or System visual mode across browsing sessions.
7. Third-Party Integrations & Google Identity
PrepFord integrates select third-party infrastructure providers to support essential platform operations:
Google OAuth 2.0 / OpenID Connect: Used for streamlined, secure single sign-on. Your interaction with Google's authentication modal is governed by the Google Privacy Policy (https://policies.google.com/privacy).
Hosting & Infrastructure: Our web servers and databases reside within certified, compliant cloud hosting facilities adhering to SOC 2 and ISO/IEC 27001 data center security standards.
8. How Personal Data Is Used
We process candidate personal data strictly for legitimate educational, operational, and security purposes:
Operational Purposes
- •Delivering tailored examination prep content, practice items, and question rationales.
- •Calculating performance telemetry, domain readiness indicators, and individualized study recommendations.
- •Authenticating candidates and safeguarding accounts against unauthorized intrusion.
- •Responding to candidate inquiries, troubleshooting technical issues, and providing curriculum support.
- •Conducting platform performance monitoring, bug triage, and application security audits.
9. Legal Bases for Processing
Where applicable data protection legislation (such as GDPR Article 6, the Kenya Data Protection Act 2019, or UK GDPR) requires a recognized lawful basis, we process personal data under the following grounds:
Applicable Legal Bases
- •Contractual Necessity: Processing required to fulfill our Terms and Conditions and provide your requested NCLEX preparation subscription.
- •Legitimate Interests: Maintaining platform security, detecting fraud, improving study algorithms, and preventing abuse of prep materials.
- •Consent: Where you have provided unambiguous consent for specific voluntary communications or optional survey feedback.
- •Legal Compliance: Adhering to statutory tax, accounting, or judicial obligations.
10. Data Sharing & Service Providers
PrepFord does not sell, rent, monetize, or trade candidate personal data. We never disclose your personal information to third-party advertisers or unauthorized data brokers.
We share personal data strictly with vetted service providers bound by enforceable data processing agreements, including cloud hosting providers, database operators, customer support ticketing infrastructure, and transaction processors. These providers are authorized to process data solely to execute contracted services on our behalf.
11. Payments & Transaction Information
Subscription transactions on PrepFord are processed entirely through certified, PCI-DSS Level 1 compliant payment gateways. PrepFord does not store, intercept, or handle raw payment card numbers, CVVs, or bank account credentials on its servers.
We receive only transaction confirmation metadata (e.g., transaction identifier, subscription plan purchased, renewal date, and billing postal code) required for subscription provisioning and accounting records.
12. Analytics & Communications
We utilize privacy-preserving diagnostic telemetry to identify server latency, broken routes, and accessibility friction points. We do not employ third-party tracking pixels that follow candidates across external web domains.
Service Communications: We may send necessary transactional emails regarding account verification, password resets, subscription renewals, or critical security updates. You cannot opt out of essential transactional notices.
13. Data Retention
We retain candidate personal data only as long as necessary to fulfill the educational purposes for which it was collected, maintain your study history, and satisfy statutory tax or legal requirements.
When an account is closed or deleted, assessment telemetry is either permanently destroyed or fully anonymized so that it can no longer be associated with any individual candidate.
14. Data Security
We apply rigorous technical and organizational safeguards to protect candidate data against unauthorized access, loss, or alteration:
Technical Safeguards
- •Encryption in Transit: All web traffic is strictly enforced over HTTPS utilizing TLS 1.3 encryption.
- •Encryption at Rest: Sensitive database storage, password digests, and backups are encrypted using AES-256.
- •Access Governance: Strict principle-of-least-privilege access controls, multi-factor authentication (MFA) for administrative staff, and automated vulnerability scanning.
15. International Transfers
PrepFord operates infrastructure that may process data on servers located outside your country of residence. Where personal data is transferred across international boundaries, we ensure appropriate cross-border transfer safeguards, such as Standard Contractual Clauses (SCCs) or adequacy decisions recognized by relevant regulatory authorities.
16. User Access, Correction, Deletion & Privacy Rights
Depending on your jurisdiction (including the European Economic Area, the United Kingdom, California, and Kenya under the Data Protection Act 2019), you may exercise specific statutory privacy rights:
Your Rights Include
- •Right of Access: Request confirmation of whether we process your data and receive an exported copy of your personal records.
- •Right to Rectification: Correct inaccurate or incomplete profile information.
- •Right to Erasure ('Right to be Forgotten'): Request deletion of your account and associated personal data.
- •Right to Restrict Processing: Limit how we process your information under specific contested circumstances.
- •Right to Data Portability: Receive your assessment history in a structured, machine-readable format.
- •Right to Object: Object to processing based on legitimate interests.
17. Children's & Minor Privacy
PrepFord is designed exclusively for adult nursing candidates and nursing students preparing for professional licensure. We do not knowingly market to or solicit personal data from individuals under the age of 18. If we learn that personal data from a child has been collected, we will take prompt steps to delete that information.
18. Third-Party Links
Our platform and blog articles may contain informational hyperlinks to external websites (such as regulatory state boards of nursing, NCSBN publications, or clinical guidelines). PrepFord is not responsible for the privacy practices, content, or policies of third-party websites. We encourage you to review their policies upon visiting.
19. Policy Updates
We may update this Privacy Policy periodically to reflect enhancements to our platform, evolving legal requirements, or adjustments in our data handling practices.
When material modifications occur, we will update the 'Last Updated' date at the top of this document and provide prominent notification via our website or email prior to the changes taking effect.
20. Contact Details & Privacy Inquiries
If you have questions, comments, or wish to exercise any of your statutory data protection rights, please contact our designated Data Protection team:
Email: privacy@prepford.com (or via our Contact Us portal at /contact)
Postal Address: PrepFord NCLEX Data Protection Office, Attn: Privacy Compliance Officer.
Have a specific privacy question?
Our Data Protection team is available to assist you with privacy inquiries or data access requests.