Privacy Policy

Who this policy covers

This policy describes personal information handled by Three Paths (“we”) through Nurses Right Now. It was last updated on October 22, 2026. It applies to nurses, people who refer nurses, and people at facilities and agencies who submit forms.

Contact us at ops@threepaths.co. Mailing address: [BUSINESS MAILING ADDRESS].

Information we collect

You give us identity and contact details (name, email, and, if you choose, phone), professional details (license type, license states, compact status, specialty, years in practice, shift, travel or permanent, start window, optional pay target), the places you pin, and the free-text description of a place. Facility and agency forms add organization, title, and staffing needs. Privacy requests add the state where you live and the type of request. Referrals add a colleague’s name and email, which we accept only with your statement that you have permission.

We collect technical data needed to run the site: a hashed IP address used for rate limits, the time of a submission, and a cookie that keeps an operations user signed in. We do not use advertising cookies in this version.

• We do not ask for Social Security numbers, dates of birth, immigration documents, bank accounts, immunizations, or precise GPS location.
• We do not want patient health information. Do not put it in a form. If a submission appears to contain it, we flag the record and do not forward the text.

Why we use it

We use the information to operate the matching service, show you a location fit score, prepare anonymous summaries you opted into, review partner requests, secure the site, keep records of consent, and answer privacy requests. Marketing email is sent only if you checked that box. Marketing texts are sent only if you checked the separate text box, and only by Three Paths.

If a Gemini API key is configured, the place description and the fit explanation you ask us to rewrite are sent to Google’s Gemini API for that purpose. We do not send your name, email, or phone in that request. If no key is set, that processing stays on our server. Google’s handling of API data is governed by its API terms. Do not put secrets or patient information in the place box.

When we share it

We share personal information with service providers who host the site, store the database, or, when we turn sending on, deliver email or text. They may use it only to provide the service to us.

We share a nurse’s contact details with a facility or agency when the nurse approves an introduction to that named organization. We share an anonymous summary when the nurse opted in. We share information if the law, a court, or a government request requires it, and to protect the security of the service.

Mobile numbers and text-message consent are not sold, rented, or shared with facilities, agencies, or other third parties for their own marketing.

We do not sell personal information to data brokers and we do not share it for cross-context behavioral advertising. A nurse-directed introduction is a disclosure the nurse asks us to make so they can interact with a hiring organization. The Do Not Sell or Share page is where you opt out of any sale or share, including one a future feature might create.

Retention

We keep form records until you ask us to delete them, or for 24 months after the last submission tied to the same email, whichever comes first, unless a longer period is required for security, fraud prevention, or a legal claim. Rate-limit entries are kept for about a day. Operations session cookies expire after 12 hours.

California and other state privacy rights

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you the right to know the categories and specific pieces of personal information we collected, the right to delete, the right to correct, the right to opt out of sale or sharing, and the right to limit the use of sensitive personal information. We do not knowingly collect sensitive personal information as that law defines it. We will not discriminate against you for exercising a right.

In the last 12 months we collect the categories described above: identifiers, professional information, and internet activity limited to security logs. We collect them from you. We disclose identifiers and professional information to service providers and, when you direct an introduction, to the hiring organization you approved. We do not sell personal information and we do not share it for cross-context advertising.

Residents of other US states with consumer privacy laws, including Colorado, Connecticut, Virginia, Texas, Oregon, and others that grant access, correction, deletion, and opt-out rights, may use the same privacy request form. If we deny a request, you may appeal by submitting the form again with the appeal option. We will explain the result.

An authorized agent may submit a request. We may ask the person the request is about to confirm it. We will verify a request by matching the email address to records we hold and, if needed, asking a follow-up question. We aim to respond within 45 days.

We treat a browser Global Privacy Control signal as a request to opt out of sale or sharing. Because this version does not sell or share for advertising, the signal does not change ad behavior. Submit the form if you also want the opt-out applied to a stored profile.

Children and changes

The service is not directed to children under 18, and we do not knowingly collect their information. If we learn we have, we will delete it.

We will post changes on this page with a new date. If a change materially expands how we use nurse contact details, we will ask before applying it to information we already hold.