Privacy Notice

This notice explains what personal data Nursel collects about you, why we collect it, who we share it with, how long we keep it, and what rights you have over it.

It applies to everyone who uses nursel.ai, including visitors, nursing professionals who register with us (“Candidates”), and staff of healthcare institutions and partners (“Institutional Users”).

We have written this notice to be read, not filed. If anything in it is unclear, write to us at info@nursel.ai and we will explain it.

Our Terms of Use also apply to your use of the platform.

Nursel is the controller of your personal data. This means we decide what data is collected and how it is used, and we are accountable for it.

We process personal data in accordance with the Personal Data Protection Law of the Sultanate of Oman, Royal Decree No. 6/2022 , and its Executive Regulations issued under Ministerial Decision No. 34/2024.

We collect only what we need to deliver the service. What we hold depends on how far you go through the process.

If you visit the website

If you register as a Candidate

If you are an Institutional User

Name, job title, employer, work email and phone number, and records of your activity on the platform and dealings with us.

Data needing extra care

• From you — when you register, upload documents, sit an assessment, contact us, or make a payment.
• From your device — technical data collected automatically when you use the website.
• From verification partners — the outcome of checks on the credentials you have asked us to verify.
• From a healthcare institution — where an institution nominates you for assessment, it shares your contact and professional details with us. In that case the institution will have told you, and this notice then explains what we do with the data.
• From referees — where you have named them and we contact them with your knowledge.

Under Omani law we must have a lawful basis for every use of your data. For most of what we do with Candidate data, that basis is your consent — which you can withdraw at any time.

We do not sell your personal data. We do not use your data to train third-party artificial intelligence models.

Assessments are proctored . Because this involves recording you, we treat it separately and ask for your consent before every session — not once at registration.

What is recorded

• Video from your camera, for the duration of the session.
• Audio from your microphone, for the duration of the session.
• Screen configuration — how many displays are connected, and whether sharing or casting is active.
• Browser session activity — when the assessment window loses focus, full-screen exits, and copy, paste, or capture attempts.

Nothing is recorded before the session begins or after it ends. We do not scan or access other applications, files, or websites on your device, and we do not access your device outside the assessment window.

Why

To confirm that you are the registered candidate, that you are sitting the assessment alone, and that you are working unaided. Healthcare institutions rely on our results to make hiring decisions affecting patient care, and this is how we keep those results credible — which protects honest candidates as much as it protects institutions.

You can refuse. If you decline consent, the session does not open and no attempt is used. You can also withdraw consent during a session, which ends it without a result.

Your responses are scored partly automatically. Your scores across the readiness dimensions are then combined into an overall readiness band using our published methodology.

Because this affects opportunities available to you, you have the right to know how it works and to challenge it:

• You may ask us to explain how your result was produced and what the dimensions and bands mean.
• You may ask a person to review your result, by writing to us within 7 days of receiving it.
• Where a result is voided on integrity grounds, a person always reviews the case before the void is confirmed.

A readiness result is our professional opinion at a point in time. It is not a judgement about you as a person, and it is not shared with an institution unless you have asked us to present you to that institution.

We share your data only where it is necessary, and only with the categories below.

Everyone acting for us is bound by contract to protect your data, to use it only for the purpose we give them, and to delete or return it when the work ends. We do not sell your data or share it for anyone else's marketing.

Because our candidates, partners, and the institutions they work with are in different countries, your data may be transferred outside the Sultanate of Oman — including to India , other GCC states , and countries where our technology providers operate.

Where we transfer your data outside Oman, we do so only where at least one of the following applies, and only with the safeguards required by Royal Decree No. 6/2022:

• you have given your consent to the transfer, which under the Executive Regulations is sufficient basis for it;
• the transfer is necessary to deliver a service you have asked for;
• the destination provides an adequate level of protection; or
• we have contractual protections in place with the recipient, requiring a standard of protection no lower than Omani law.

Transferring your data does not reduce your rights. This notice, and Omani law, continue to apply to it.

Session recordings are deleted on a fixed schedule. Most other records are kept for as long as we need them to deliver and stand behind our service — a verified credential may need to be re-evidenced years later, and a readiness result may need to be re-issued or audited. You can ask us to delete your data at any time under section 12.

Where a legal claim, investigation, or regulatory matter is open, we keep relevant data until it closes.

We review what we hold periodically and delete or anonymise records we no longer need. Your right to ask us to delete your data is set out in section 12 and applies to everything in the table above, other than financial records we are required by law to keep.

We use technical and organisational measures appropriate to the sensitivity of the data, including encryption in transit and at rest, access limited to staff who need it for their role, logged and reviewed access to session recordings, contractual obligations on every provider, and staff training and confidentiality undertakings.

No system is completely secure. If a breach occurs that is likely to affect you, we will notify you and MTCIT as required by Omani law, tell you what happened and what data was involved, and tell you what we are doing about it and what you should do.

Under Royal Decree No. 6/2022 you have the following rights over your personal data:

To exercise any right, write to info@nursel.ai . We will respond within 30 days , and will tell you if we need longer and why. There is no charge. We may need to confirm your identity first, to make sure we are not disclosing your data to someone else.

Withdrawing your consent, or asking us to delete your data, may mean we can no longer deliver the service — for example, we cannot produce a readiness result without your assessment data. We will tell you clearly before acting, so you can decide.

We use a small number of cookies and similar technologies. Cookies that are strictly necessary — keeping you signed in, keeping your session secure, remembering your preferences — are always on, because the site does not work without them.

Any cookie that is not strictly necessary, including analytics, is used only with your consent, which you can give or withdraw through the cookie banner or by clearing cookies in your browser. We do not use advertising cookies and we do not permit third parties to track you across other websites through our site.

Our services are for qualified nursing professionals and are not directed at anyone under 18. We do not knowingly collect data about children. If you believe we hold data about someone under 18, tell us and we will delete it.

We may update this notice. The version published on this page, identified by the “Last updated” date, is the version in force. Where a change materially affects how we use your data, we will notify registered users directly and, where the law requires it, ask for your consent again.

This notice is issued in English. Any Arabic translation is provided for convenience; in the event of any discrepancy, the English version prevails unless Omani law requires otherwise.