Norah's Privacy Policy

This policy covers the Norah website and the Norah application, where you sign in, arrange sessions and pay for them.

It applies to three groups of people:

• Clients: the people who come to Norah for coaching, psychotherapy or counseling.
• Specialists: the coaches, psychotherapists and counselors who provide those services through Norah.
• The Norah team: the coordinators and administrators who run the platform.

Norah operates the platform and decides what information it collects and why. Your specialist reaches your information through Norah, and only ever their own clients' information, in order to provide you their service.

When you have a Norah account, we hold:

• Your email address: it is how you sign in and how we reach you.
• Your name, and if you choose to give them, a title (Dr, Mr, Ms, Mrs, Mx) and, for specialists, professional credentials.
• A WhatsApp number, if you give us one.
• Your preferred language (English or Farsi) and your time zone, so session times and messages reach you correctly.
• Your country, when a specialist or coordinator adds you as a client.

Your password is not among them. Passwords are managed by Amazon Cognito, our sign-in service, and Norah never stores one. When you sign in normally you type it on Cognito's own page and it never reaches us at all. The one exception is accepting an invitation, where you choose your password on a Norah page: it passes through our server to Cognito to be set, and is neither saved nor written to any log on the way.

A specialist or coordinator can create a client record for you before you have an account, so that they can arrange sessions and send you an invitation. It holds your email address and the basic details above. When you sign in for the first time, that same record becomes your account, so nothing about your history is lost or duplicated.

Using the service produces information of its own:

• Sessions: who the session is with, when it starts, how long it lasts, and whether it is scheduled, completed, cancelled, or was a no-show.
• The link to the video room you and your specialist share.
• Session notes your specialist writes: a progress rating from 1 to 10, a summary, homework, what to focus on next, and which goals were discussed.
• Goals your specialist sets with you, and the steps under each one.
• Check-ins you submit (a mood rating from 1 to 10 and your written answers) and whether your specialist has marked them as seen.
• Your session credits, kept as a running record of every credit bought, used, refunded or corrected, so the balance can always be explained.
• Invitations, whether sent to you or by you: the email address invited, who invited it, and when the invitation expires.
• A tally of certain actions in fixed time windows, so the platform can slow down misuse. It is counted against your account, or, on the payment page where there is no account to count against, against the network address your browser connects from. Closed tallies are deleted about two hours later, by a sweep that runs off the volume of activity rather than on a clock, so in a quiet spell the last of them can sit until activity resumes.

Payments are processed by Stripe. Card details are typed into Stripe's own payment form, which runs inside their frame on our page. They do not reach Norah's servers, and we never hold a card number.

We also deliberately keep no card fingerprint or other payment-instrument identifier. It was considered and removed, because it would be a way of linking accounts together that we have no good reason to hold.

What we do keep for each payment:

• What was bought, the amount charged, the currency, the credits granted, and any discount applied.
• Stripe's own references for the checkout, the payment, the invoice and the receipt, so we can find the payment again.
• A simplified form of the email address used at checkout: lowercased, with any plus-address and dots removed. Its only purpose is to tell whether a person has bought from us before, so the first-purchase offer is applied once and not repeatedly under slightly different addresses.
• A copy of the invoice document, kept in private storage of our own so that your invoice stays available to you even if it is no longer available from Stripe.

Stripe handles the payment itself under its own privacy policy and its own responsibility, not as our subcontractor.

Your specialist or a coordinator can send you a payment link so that you can settle a session without having an account or signing in. The link contains a token, which is what proves the link is genuine.

We want to be exact about this one. That token is stored in our database in readable form, not scrambled, so that whoever created the link can be shown it again if they lose it. That was a deliberate decision and it has a cost: anyone with access to that table could open the payment page of any client holding a live link. The protection we put in its place is time: a payment link stops working seven days after it is issued, and it can be cancelled at any moment before that.

Seven days is the current setting, and it is the control that stands in for scrambling the token, so it is not a number we lengthen casually. The expired row itself stays in the table; it simply no longer opens anything.

For contrast, and because it makes the point above easier to trust: the token inside an invitation email is not stored at all. We keep only a one-way fingerprint of it, which cannot be turned back into the link.

What you work on with your specialist is the most personal information Norah holds, and it is handled differently from everything else.

• Your specialist, the one assigned to you, can read the notes, goals and check-ins that belong to your work together.
• You can see your own sessions, goals and check-ins, and the notes kept about your sessions are yours to ask for.
• No other specialist can reach any of it. Every query the platform makes for a specialist is restricted to their own clients, and that restriction is written into the database queries themselves, not just hidden in the screen.
• The Norah team cannot read session note content. Administrative screens exist for accounts, assignments, session times and payments, and they are built so that note content is never retrieved at all.
• Note content is never written into our logs.

Norah's Terms of Service draw a clear line between coaching on one hand and psychotherapy and counseling on the other, because they are different services with different professional frameworks. What gets written down can, in either case, say something about how you are feeling. We do not sort it into stricter and looser piles on that basis. All of it is handled as described above.

What is in place:

• Every connection to Norah is encrypted in transit.
• The database is not reachable from the internet. Only Norah's own application servers can connect to it, over a private network.
• The database and its backups are encrypted at rest with an encryption key that belongs to us and rotates automatically.
• Invoice documents sit in private storage with all public access blocked, encrypted with the same key. They are never given out as a public link; they are passed through Norah's own servers to the person entitled to them.
• Signing in is handled by Amazon Cognito. The tokens that keep you signed in are held in cookies your browser will not hand to any script, and they are never stored in our database or written to our logs.
• Every request to the application is checked against who you are before anything is read, and every database query is confined to that person's own data. The one deliberate exception is the payment link described in section 5, which is designed to work without signing in.

What we are not claiming, stated plainly:

Session notes, goals and check-ins are stored as ordinary structured data. They are covered by the encryption of the database described above, and by nothing beyond it: they are not separately encrypted field by field, so someone with legitimate access to the database could read them. Encrypting note content on its own is something we intend to add. It is not there today, and we would rather tell you that than lean on a word it has not earned.

No service can promise perfect security, and we are not going to be the first to try.

Norah runs entirely on Amazon Web Services. Your information is held in AWS data centres, which means it is stored and processed in the country those data centres are in, not necessarily the country you live in.

As of the date at the top of this page, the Norah service runs in AWS's Asia Pacific (Singapore) region, and this website is served from AWS in the United States and through its global delivery network.

That sentence describes where we run today, not a promise about where we will always run. We expect to add or change regions as Norah grows; moving closer to the people we serve is a reason we would do it. When it changes we will update that sentence and the date at the top of this page.

If you are in the European Economic Area or the United Kingdom, holding your information in a region outside it is a transfer to a third country. Not every country we use has been recognised by the European Commission as offering equivalent protection; Singapore has not. Where that is so, the transfer is made under the safeguards European law provides for exactly this situation, in the form of the European Commission's standard contractual clauses, alongside the technical protections described in section 7.

If you want to know which arrangements apply to your information at any given moment, ask us at privacy@norah.coach and we will tell you.

Norah is deliberately built on very few outside services. These are all of them:

• Amazon Web Services: hosting, the database, sign-in, file storage and the email we send. Essentially everything described on this page is held on AWS infrastructure, on our instructions.
• Stripe: payments, as described in section 4.
• Google: the video room your sessions take place in.
• Sanity: the writing tool our blog articles and the questions on our FAQ page are written in. It holds nothing about you: this website is assembled in advance, so the articles are collected when the site is built and your browser never contacts it.

The Google arrangement is worth spelling out, because it is narrower than it sounds. Norah creates each video room through Google's Meet interface as an empty room. We send Google no name, no email address, no session title, no time and no list of who will attend, and we create no calendar entry. When you join a call, Google necessarily handles the call itself (your connection, your audio and your video) under its own terms, as it would for any Meet call.

On this website only, the Farsi and English typefaces are fetched from Google Fonts and from the jsDelivr delivery network when a page loads, which means those services see the address your browser is connecting from. We ask them for a font file and receive nothing about you in return. Serving those files from our own site instead is on our list.

We do not sell personal information, and we do not give it to advertisers, data brokers, or anyone else for their own purposes.

This website sets no cookies at all. It carries no analytics, no advertising tags, no tracking pixels and no third-party trackers of any kind. For a privacy-first service that is a deliberate choice, so we would rather say it plainly than leave you to wonder.

The Norah application sets four cookies, all of them necessary for it to work:

• Two that keep you signed in: one short-lived, valid for an hour, and one that lets your browser get a fresh one for up to thirty days.
• One single-use cookie during sign-in, which is what stops someone else from completing a sign-in on your behalf.
• One that remembers whether you chose English or Farsi.

None of them profiles you and none follows you to other websites. The application carries no analytics either.

Stripe's payment code loads only at the moment you open the payment screen, and it may set cookies of its own that the payment needs in order to work.

Norah sends email only about things you are doing: confirming a booking and attaching the calendar entry, telling you a session was cancelled, reminding you a session is coming, sending a specialist their schedule, reminding you of a payment that is due, and inviting someone to join.

We send no marketing email and we keep no mailing list. If that ever changes, it will be something you choose to join, not something you have to leave.

European data protection law requires a specific legal basis for each purpose, rather than a general appeal to improving the service. Ours are:

• To give you the service you asked for: your account, arranging and running sessions, the video room, the notes, goals and check-ins that are part of the work, taking payment and issuing your invoice. The basis is performance of our contract with you.
• To keep the platform safe, correct and solvent: limiting abusive request volumes, investigating misuse, keeping short-lived server logs, fixing mistakes in records, and following up amounts that are owed. The basis is our legitimate interests, weighed against yours; where your interests would outweigh ours, we do not do it.
• To meet obligations we cannot decline: keeping payment records for tax and accounting, and answering a lawful order from an authority entitled to make one. The basis is legal obligation.

We do not currently rely on your consent for anything, because there is nothing here that needs it: no analytics, no advertising, no marketing email. If that changes we will ask you plainly, and you will be able to withdraw it as easily as you gave it.

Information that reveals something about your health carries an additional condition in European law beyond the bases above. Where a specialist provides psychotherapy or counseling, that work is carried out by a professional bound by professional confidentiality, which is the condition European law provides for exactly that situation. Norah's Terms distinguish coaching from psychotherapy and counseling, and what is written down during coaching may still touch on the same ground. How each of Norah's services should be classified in these terms is a question we are putting to legal advisers rather than answering ourselves; in the meantime, everything is handled to the stricter standard set out in section 6.

Your account and the history attached to it (your profile, your sessions, notes, goals, check-ins and credit record) are kept for as long as your account is open, because that history is the service.

• Payment and invoice records are kept longer than the rest of your account, because tax and accounting law requires records of what was paid and when.
• Invitations expire after seven days; the record that an invitation was sent is kept for audit.
• Payment links stop working seven days after they are issued.
• Server logs are kept for seven days and then deleted automatically. They are written so as never to contain note content, sign-in tokens or database credentials.
• Database backups are kept for thirty days in the live service and then deleted automatically.

One gap you should know about: Norah does not delete accounts automatically after a period of inactivity. There is no scheduled clean-up, so information stays until you ask us to remove it or we decide it is no longer needed. Setting and publishing a defined retention schedule is work we still owe you.

When we delete something from the live service, copies can survive until the storage holding them expires: up to thirty days in the database backups above, and up to ninety days for a superseded copy of an invoice document.

If you are in the European Economic Area or the United Kingdom, the law gives you the rights below. We apply them to everyone who uses Norah, wherever you are, because sorting people by passport would be both unpleasant and harder to run.

• Access: a copy of what we hold about you. Much of it you can already see when you sign in: your profile, your sessions, your goals, your check-ins and your payments. Ask us for anything beyond that.
• Correction: putting right anything that is wrong. Your name, title, credentials, WhatsApp number, language and time zone you can edit yourself. For anything else (your country, or a line in a session note) ask us, and we will correct it or record your disagreement alongside it.
• Deletion: removing your information. We will delete what we are not required to keep; payment records we must retain are the usual exception, and we will tell you what was kept and why.
• Restriction: telling us to stop using particular information while a dispute about it is settled.
• Objection: objecting to anything we do on the basis of our legitimate interests, in which case we stop unless we have grounds that override yours.
• Portability: a machine-readable copy of the information you gave us and that we hold to provide the service, for you or for another provider.
• Withdrawing consent, in the event we ever ask for it.

You also have the right to complain to a data protection authority. If you are in the European Economic Area that is the authority in the country you live or work in; in the United Kingdom it is the Information Commissioner's Office. You do not have to come to us first, though we would rather you did, so we have the chance to put it right.

How this works in practice, honestly: there is no button for most of it. A person handles each request. Write to privacy@norah.coach; we will confirm we have it, we may ask you to confirm who you are so that we do not hand your information to somebody else, and we aim to answer within one month, which is what the law allows. If a request turns out to be genuinely complicated we may need longer, and we will tell you so and why.

We do not sell personal information, and we do not share it for advertising that follows you across other sites. There is nothing to sell or share: Norah runs no advertising and no analytics.

If you live in California, or in another state with a comparable law, you have rights to know what is collected about you, to have it corrected, to have it deleted, and not to be treated worse for asking. Those are the rights set out in section 14, which we offer to everyone.

We have not built a separate state-by-state compliance programme, and we are not going to imply otherwise. What we can give you is an exact account of what we do and do not do, which is what this page is, and a person who will answer at privacy@norah.coach.

Nothing that affects you on Norah is decided by software alone. Matching a client with a specialist is done by a person, and it is meant to be.

Norah's services are intended for adults. We do not knowingly collect information about children. If you believe a child has given us information, tell us at privacy@norah.coach and we will remove it.

Norah will change, and this page will change with it. The date at the top tells you when it last did. If a change matters to you (a new region, a new company handling your information, a new purpose) we will tell you by email or in the application rather than quietly editing the page.

Write to privacy@norah.coach about anything on this page: a question, a correction, a copy of your information, a deletion, or a complaint. A person reads it.