Privacy Policy

1. Introduction

ShiftPilot ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our scheduling platform and services (collectively, the "Service"). By accessing or using ShiftPilot, you agree to the collection and use of information in accordance with this policy.

This Privacy Policy is written to meet the requirements of the Personal Information Protection and Electronic Documents Act (Canada) and, because our customers include health information custodians, the Personal Health Information Protection Act, 2004(Ontario) and comparable provincial and territorial legislation. Where the customer organization that has given you access to the Service is accountable for your personal information under that legislation, this Privacy Policy describes what we do as that organization's agent and service provider (see section 8).

1.1 No Patient Information

ShiftPilot schedules staff. It does not ask for patient information, none of its features needs it, and it is not built to hold it: no patient names, health numbers, records, images, reports or appointments. Our customers agree in our Terms of Service not to enter patient information anywhere in the Service, including in notes, uploads, messages, assistant conversations, calls and faxes. Where hospital staff contact a radiologist through a hospital line that ShiftPilot routes (section 10), patient identifiers are removed from transcripts before they are stored.

2. Information We Collect

2.1 Personal Information

We collect information that you provide directly to us, including:

• Name, email address, mobile telephone number and, if you add one, a profile photo
• Account credentials and authentication information
• Professional information related to your role: status, specialty, the sites you are credentialed for, and work rules and preferences
• Schedule information: assignments, availability, time off, swaps and give-aways, notes, and operational counts such as the number of studies read in a shift
• Communication preferences and correspondence
• Messages you send to the assistant described in section 9, by text, voice or picture, and what the assistant remembers about your scheduling preferences
• Feedback and problem reports you send us, including any screenshot you choose to attach
• Documents and spreadsheets that administrators import, such as rosters, schedules and site procedures

2.2 Automatically Collected Information

When you use our Service, we automatically collect certain information, including:

• Device information, including IP address, browser type, and operating system
• Usage data, including pages visited, features used, and time spent on the Service
• Log files and analytics data
• Cookies and similar tracking technologies

2.3 Third-Party Information

We receive information from other services only when you or your organization connect them:

• Calendars: if you connect Google Calendar or Microsoft Outlook, we write your shifts to that calendar and keep the access needed to update them. Calendar subscription (iCal) links contain only your shifts.
• Spreadsheets: an organization may keep its roster, availability or credentialing matrix in Google Sheets, which the Service reads and updates.
• Leave systems:an organization may let the Service read its members' leave from a system such as MedSIS, using an administrator's login that we store encrypted.
• Telephony: an organization may connect its existing business phone system so the Service can show who is available and route hospital text messages to the radiologist on shift.
• AI assistants you connect: if you connect an AI assistant (for example Claude or ChatGPT) to ShiftPilot, it reads and changes your scheduling information only as you ask it to, under the permissions you approved; you can revoke that connection at any time.

2.4 The ShiftPilot Mobile App

The ShiftPilot app for iPhone and Android uses the same account and scheduling information as the web application. It asks for device permissions only when you use the feature that needs them, and you can decline or withdraw each one in your device settings:

• Notifications: if you allow them, a push token for your device is stored with your account so we can deliver schedule reminders and updates.
• Microphone: used only while you are talking to Avery by voice or taking a hospital call in the app. Avery voice audio is streamed for that conversation and is not stored by ShiftPilot. A hospital call answered in the app may be recorded by the hospital line, as described in section 10.
• Camera and photos: used only when you choose a picture to send to Avery; the picture is sent with that message.
• Bluetooth: used only to pair with and talk to an Avery Pocket, an optional companion device.
• Location: used only on your phone to read the name of the Wi-Fi network you are connected to while you set up an Avery Pocket. We do not collect or store your location.

If you use an Avery Pocket, we keep its device identifier, firmware version and the account it is paired with. A Wi-Fi network name and password you enter for the Pocket are held by our gateway only until the Pocket receives them, and are then deleted from our systems. The Pocket streams your voice to the assistant while you talk to it and does not record otherwise.

The app contains no advertising, does not track you across other companies' apps or websites, and includes no third-party analytics or advertising software.

2.5 Website Visitors

If you use the contact form or the chat on shiftpilot.com, we keep what you send (for example your name, email, organization and message) so we can reply. Website chat messages are answered by the AI provider named in section 10.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, maintain, and improve our Service
• To create and manage your account and user profile
• To generate, manage, and optimize work schedules
• To facilitate communication between users and administrators
• To sync schedule information with integrated calendar services
• To route hospital calls, texts and faxes to the person on shift, where the organization has enabled hospital lines
• To answer questions and carry out confirmed tasks through the assistant described in section 9
• To send administrative information, updates, and notifications
• To respond to your inquiries, comments, and support requests
• To detect, prevent, and address technical issues and security threats
• To comply with legal obligations and enforce our terms of service
• To analyze usage patterns and improve user experience

4. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information in the following circumstances:

4.1 Within Your Organization

Schedule information, assignments, and related data may be visible to authorized administrators and relevant personnel within your organization as necessary to perform scheduling functions.

4.2 Service Providers

We share information with the service providers listed in section 10, who perform services on our behalf such as hosting, messaging, AI processing and error monitoring. They may use it only to provide those services to us.

4.3 Legal Requirements

We may disclose your information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or comply with a legal process.

4.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction, subject to the same privacy protections.

5. Security Safeguards

We maintain administrative, technical and physical safeguards that are appropriate to the sensitivity of the information we hold, as required by the Personal Information Protection and Electronic Documents Act (Canada) ("PIPEDA"), Principle 7 (Safeguards) of Schedule 1 to that Act, and section 12 of the Personal Health Information Protection Act, 2004(Ontario) ("PHIPA"). Those safeguards include the following.

5.1 Encryption

• All data in transit between your device and the Service, and between the Service and our infrastructure providers, is encrypted using Transport Layer Security (TLS 1.2 or higher).
• All Customer Data at rest, including database records, file storage, search indexes and backup copies, is encrypted using 256-bit AES.
• Account passwords are never stored in plain text. They are hashed using an adaptive, salted one-way algorithm (bcrypt).

5.2 Access Control

• Access to Customer Data within the Service is governed by role-based permissions assigned by your organization's administrators. Schedule members see their own information and the information their organization has chosen to share with them; administrative functions are restricted to designated administrators; hospital site logins see only the sites to which they are assigned.
• Every request to our backend is authenticated and is scoped to the requesting user's organization. No query or mutation returns data belonging to another organization.
• Access by ShiftPilot personnel to production systems is limited to named individuals who require it to operate and support the Service, is protected by multi-factor authentication at the infrastructure-provider level, and is used only to the extent necessary to provide the Service, resolve an incident or comply with a legal obligation.

5.3 Audit and Monitoring

• Changes to schedules, assignments, user roles and organization settings are recorded in an immutable audit log that identifies the actor, the time and the change, and that log is available to your administrators within the Service.
• Every notification the Service sends (email, SMS or WhatsApp) is logged with its delivery outcome.
• Application errors and security-relevant events are monitored continuously and reviewed by our engineering team.

5.4 Infrastructure

The Service is operated on infrastructure provided by Vercel, Inc. and Convex, Inc., the latter running on Amazon Web Services. Each of those providers maintains a current SOC 2 Type II attestation and contractual obligations to us regarding confidentiality and security. ShiftPilot itself has not obtained an independent SOC 2 report; we will state clearly when that changes. Production data is stored in data centres located in the United States; see section 16 (International Data Transfers). Schedule generation and the assistant's voice gateway run on Railway (United States). Limited working copies used to review assistant conversations and fix errors are processed on computers that ShiftPilot manages in Canada, under the same access restrictions.

5.5 Security Incident Response

If we become aware of any unauthorized access to, or loss, theft or unauthorized use or disclosure of, Customer Data in our custody or control (a "Security Incident"), we will (a) notify the affected customer's designated contact without undue delay and in any event within seventy-two (72) hours of confirming the Security Incident, (b) provide the information reasonably required by the customer to meet its own notification obligations to affected individuals and to the Information and Privacy Commissioner of Ontario or other applicable regulator, and (c) take reasonable steps to contain, investigate and remediate the Security Incident. Nothing in this section limits any shorter notification period required by applicable law or by a written agreement with a customer.

No method of transmission over the Internet or of electronic storage is completely secure. We do not represent that the Service is immune from compromise, and our obligations in respect of a Security Incident are as set out in this Privacy Policy and in any written agreement between us and the customer.

6. Backup, Business Continuity and Recovery

We maintain the following backup program for Customer Data. The measures described in this section are commitments, not aspirations, and are reflected in section 12 of our Terms of Service.

6.1 Layers of Protection

• Continuous replication. Every write to the production database is durably replicated across multiple availability zones by our database provider before it is acknowledged. A single hardware or zone failure does not result in data loss.
• Daily full backups. A complete export of every production table is taken automatically once every twenty-four (24) hours and stored, encrypted at rest, in a system separate from the production database and separate from the database provider. Each daily export is retained for ninety (90) days.
• Schedule version history. Independently of the backups above, every publication, import, generation or manual edit of a schedule creates a point-in-time version of that schedule within the Service. Versions are retained for the life of the customer account and may be restored by an administrator from within the Service without engineering involvement.
• Application code and configuration. All application code is kept in version control with full history, and every production deployment is immutable and may be rolled back to any earlier deployment.

6.2 Recovery Objectives

• Recovery Point Objective (RPO). For a full restoration of the production database from a daily backup, no more than twenty-four (24) hours of data. For schedule data restored from version history, no data loss beyond the specific change being reversed.
• Recovery Time Objective (RTO).Restoration of a schedule from version history: minutes, performed by the customer's administrator. Full restoration of the production database from a daily backup: four (4) hours from the decision to restore.

6.3 Testing

The integrity of the daily export is verified automatically on each run. We perform a restoration exercise of a daily backup into a non-production environment at least once every six (6) months and record the outcome.

6.4 Backup Copies and Deletion

Backup copies are subject to the same encryption, access controls and confidentiality obligations as production data. When Customer Data is deleted from production systems under section 7 (Data Retention), copies of that data persist in backups only until those backups expire under section 6.1, after which they are unrecoverable. Backup copies are used solely for recovery and are not accessed for any other purpose.

6.5 Customer Export

Independently of our backups, administrators may at any time export their organization's schedules from the Service in spreadsheet form, and may request a complete machine-readable export of their organization's data by contacting us. We encourage customers to retain their own copies of information that is critical to their operations.

7. Data Retention

We retain personal information only for as long as is necessary to fulfil the purposes for which it was collected, to provide the Service to the customer organization, and to meet our legal and contractual obligations, consistent with Principle 5 (Limiting Use, Disclosure and Retention) of Schedule 1 to PIPEDA. Specifically:

• Account and profile informationis retained for the duration of the customer organization's subscription.
• Schedules, assignments, availability, version history and audit logs are retained for the duration of the subscription because they constitute the customer's operational record.
• Notification and message logs are retained for the duration of the subscription to support delivery verification and dispute resolution.
• Call and voicemail recordings on hospital lines are deleted after thirty (30) days; redacted transcripts follow the message logs above.
• Device push tokens are deleted when you sign out of the device or delete your account.
• Following termination of a subscription, Customer Data is retained for ninety (90) days so that the customer may export it, and is then deleted from production systems within a further thirty (30) days. Backup copies expire in accordance with section 6.4. A customer may request earlier deletion in writing.
• Aggregated or de-identified information that cannot reasonably be used to identify an individual may be retained without time limit.

Where a longer retention period is required by applicable law, a court order or a written agreement with the customer, that longer period governs.

8. Health Privacy Legislation and Our Role

8.1 Applicable Legislation

Our customers are principally hospitals, imaging groups and physician practices in Canada. In providing the Service we act in a manner consistent with PIPEDA and, where a customer is a health information custodian or equivalent, with the health privacy legislation that applies to that customer, including PHIPA (Ontario), the Health Information Act (Alberta), the Health Information Privacy and Management Act (Yukon), the Health Information Act (Northwest Territories) and any comparable provincial or territorial statute.

8.2 ShiftPilot as Agent and Service Provider

As between ShiftPilot and a customer, the customer is the organization accountable for the personal information it places in the Service and, where applicable, the health information custodian. ShiftPilot acts as the customer's agent within the meaning of section 17 of PHIPA (and as an information manager, service provider or processor under comparable legislation) and as such:

• we collect, use and disclose personal information in our custody only for the purpose of providing the Service to the customer and in accordance with the customer's instructions, and not for any purpose of our own except as expressly permitted by law;
• we do not sell personal information, use it for advertising, or use it to train machine-learning models;
• we notify the customer at the first reasonable opportunity if personal information in our custody is stolen, lost or accessed by unauthorized persons, as required by section 17(3) of PHIPA and section 5.5 of this Privacy Policy;
• we will enter into a written agency, data processing or information-manager agreement with any customer that requires one to satisfy its obligations under applicable legislation, on request.

8.3 Nature of the Information Processed

The Service is a workforce-scheduling platform. The information it processes consists principally of the personal information of the customer's physicians, staff and administrators (names, contact details, credentials, availability, assignments and related communications) together with operational information about the customer's sites. The Service is not designed to receive patient records, images or reports, and customers agree in our Terms of Service not to enter individually identifying patient information into it. Where a customer records aggregate operational figures (for example, the number of studies read during a shift), those figures contain no patient identifiers.

8.4 Openness and Accountability

We have designated an individual who is accountable for our compliance with this Privacy Policy and applicable privacy legislation and who may be reached at the address in section 18. Individuals may challenge our compliance by contacting that person, and, if unsatisfied, may complain to the Office of the Privacy Commissioner of Canada or to the Information and Privacy Commissioner of the province or territory in which they reside.

9. Automated Assistant and AI Processing

The Service includes an assistant ("Avery") that answers questions and carries out scheduling tasks in response to messages sent through the web application, the mobile app, SMS or WhatsApp. In the mobile app, Avery runs only after the user has expressly allowed their conversations to be sent to our AI provider, and that permission can be withdrawn at any time under More → Avery. When a user interacts with the assistant, the content of that user's messages, together with the scheduling information reasonably needed to respond, is transmitted to a large-language-model provider (OpenAI), directly or through an API gateway operated by Vercel, Inc. The assistant may also search documents the organization has added (such as site procedures) and run calculations over a read-only copy of the organization's scheduling data. The following terms apply to that processing:

• OpenAI does not use content sent through its API to train its models; it keeps conversation state and safety logs for up to thirty (30) days and then deletes them;
• to find and fix wrong answers, assistant conversations are reviewed by ShiftPilot engineers and by an AI model from Anthropic, PBC, and short excerpts with personal details removed may be kept as test cases; we do not use assistant conversations to train AI models;
• any change the assistant proposes to a schedule, an availability record or a setting takes effect only after the user expressly confirms it; the assistant does not act on its own initiative;
• transcripts of assistant conversations are retained within the Service as part of the customer's operational record and are visible to the customer's administrators;
• a customer may disable the assistant, or any channel through which it is reached, for its organization or for individual users, under section 13 (Configuration Choices and Opting Out);
• when a user talks to Avery by voice in the mobile app or through an Avery Pocket, their audio is streamed to the model provider for the duration of that conversation only;
• the assistant remembers scheduling preferences a user tells it (for example, preferred sites or how they like replies written); a user can ask it what it remembers and tell it to forget any of it;
• a user's assistant conversations, and what the assistant remembers about them, are deleted when they delete their account (section 11.1).

The assistant helps with scheduling only. It does not give medical advice and has no access to patient information.

10. Subprocessors

We engage the following third parties to process Customer Data on our behalf. Each is bound by written terms that require it to protect the information at a standard no less protective than this Privacy Policy and to use it only to provide its service to us.

• Vercel, Inc.(United States): application hosting, edge network, file storage, AI API gateway, isolated sandboxes for the assistant's calculations, bot protection and cookie-free website analytics.
• Railway Corporation (United States): hosting of the schedule-generation service and of the gateway for Avery voice conversations and Avery Pocket devices.
• Upstash, Inc. (United States): short-lived caching for the web application.
• 650 Industries, Inc. (Expo) (United States): delivery of mobile app push notifications and app updates, through Apple Push Notification service and Google Firebase Cloud Messaging.
• Convex, Inc. (United States), operating on Amazon Web Services: primary database, file storage and scheduled functions.
• GitHub, Inc. (United States): source-code repository and encrypted storage of daily database backups.
• Twilio Inc.(United States): delivery of SMS and WhatsApp messages (WhatsApp messages also pass through Meta's WhatsApp Business Platform), and, only where the customer has enabled hospital phone lines, call routing, in-app calling, message forwarding and the storage of call and voicemail recordings.
• Resend, Inc. (United States): delivery of email.
• Google LLC (United States): Google Sheets, Google Drive and Google Calendar integrations, only where the customer or user has connected them.
• Microsoft Corporation (United States): Outlook calendar integration, only where a user has connected it.
• OpenAI, L.L.C. (United States), accessed directly and through the Vercel AI gateway: large-language-model inference, document search and real-time voice for the assistant described in section 9, the website chat, and transcription and summarization of recorded hospital phone-line calls where a customer has enabled that feature (see below).
• Anthropic, PBC (United States): AI review of assistant conversations to find and fix errors (section 9).
• Functional Software, Inc. (Sentry) (United States): application error monitoring for the web applications, including a replay of a small sample of browser sessions and of sessions where an error occurs, with all on-screen text masked.
• Telnyx LLC (United States): sending and receiving faxes on a hospital fax line, only where the customer has enabled it.
• ClickUp (Mango Technologies, Inc.) (United States): tracking of support requests and product feedback submitted by users.

Hospital phone lines and call recording

Where a customer enables hospital phone lines, ShiftPilot answers the customer's hospital-facing telephone numbers through Twilio: calls are routed to the radiologist the schedule places on shift, text messages from hospital staff are forwarded to that radiologist's telephone and their replies are returned through the same number. Callers are told at the start of each call that it may be recorded. Call and voicemail audio is stored by Twilio in the United States for no more than thirty (30) days and is then deleted. Transcripts are produced by OpenAI and are stored only after patient identifiers (names, dates of birth, health card, record and accession numbers, telephone numbers and addresses) have been removed; the unredacted text is never stored. Recordings, transcripts and message history are available only to the customer's administrators, and the customer may disable recording for any line at any time. Faxes received on a hospital fax line (through Telnyx) are delivered to the customer's administrators and kept with that line's message history. Hospital lines carry operational contact between hospital staff and radiologists; customers instruct callers and senders not to include patient identifiers (section 1.1).

We will give customers at least thirty (30) days' notice, by updating this section and by email to the customer's designated contact, before engaging a new subprocessor that will process Customer Data. A customer that objects on reasonable privacy grounds may raise the objection with us under section 13.

11. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information, including:

• Access: Request access to your personal information
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information
• Portability: Request transfer of your data to another service
• Objection: Object to certain processing activities
• Withdrawal: Withdraw consent where processing is based on consent

To exercise these rights, please contact us using the information provided in the "Contact Us" section below. We will respond to your request within a reasonable timeframe and in accordance with applicable law.

11.1 Deleting Your Account

You can delete your ShiftPilot account at any time in the mobile app under More → Delete account, which takes effect immediately, or by request on our account deletion page, which we complete within 30 days. Deletion removes your login and the personal data attached to it: assistant conversations and memory, notification settings and device tokens, calendar connections, and your profile photo and preferences. Scheduling records that belong to your organization (the shifts you were assigned or worked, availability, time off, swaps and related billing) remain with your organization, which is notified so it can update its roster; audit and delivery logs are kept for the periods in section 7.

12. Cookies and Tracking Technologies

The web applications use cookies that are needed to keep you signed in, protect forms from automated abuse and remember settings such as your theme. Our website analytics (Vercel Web Analytics) count page views without cookies, and error monitoring (section 10) records technical details when something goes wrong. We use no advertising cookies and do not track you across other websites. You can instruct your browser to refuse cookies, but you will then not be able to sign in.

13. Configuration Choices and Opting Out

Every processing activity described in this Privacy Policy other than those strictly necessary to operate an account is configurable by the customer. A customer organization may, for the organization as a whole or for individual users:

• disable any notification channel (email, SMS or WhatsApp) or any category of automated message;
• disable the assistant described in section 9, or restrict it to particular channels or roles;
• decline or disconnect any integration (Google Sheets, Google Drive, Google Calendar, Microsoft Outlook, MedSIS, hospital phone and fax lines) at any time, whereupon we cease exchanging data with that service;
• decline the use of error-monitoring session replay for its users;
• request that particular data fields not be collected or be deleted, or request a shorter retention period than that set out in section 7;
• request a copy of, or the deletion of, any backup export under section 6, to the extent technically feasible.

Individual users may withdraw from SMS and WhatsApp messages at any time by replying STOP, and may adjust their own notification preferences within the Service. In the mobile app, a user may also withdraw consent to AI processing (More → Avery), disconnect calendars and devices, turn off device permissions in the phone's settings, and delete their account (section 11.1). Requests to opt out of any other processing may be made by the customer's administrator in writing to the address in section 18. We will confirm receipt within two (2) business days and give effect to the request within ten (10) business days, or explain in writing why the request cannot be accommodated (for example, because the processing is necessary to provide a feature the customer has asked us to provide).

13.1 Text messaging (SMS)

Users receive scheduling text messages only after entering their own mobile number and switching text reminders on in the Service (see our SMS messaging program). No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent will not be shared with any third parties, excluding the subprocessors in section 10 that deliver the messages (such as Twilio Inc.). Reply STOP to opt out or HELP for help; message and data rates may apply.

14. Third-Party Services

Our Service may contain links to third-party websites or integrate with third-party services, such as Google Calendar, Microsoft Outlook or an AI assistant you connect to your account. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access through our Service.

15. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us immediately, and we will take steps to delete such information.

16. International Data Transfers

Our production systems and the subprocessors listed in section 10 are located in the United States. Personal information placed in the Service is therefore stored and processed outside Canada, where it is subject to the laws of that jurisdiction, including laws that may permit access by courts, law-enforcement and national-security authorities. We protect information transferred outside Canada through the contractual, technical and organizational safeguards described in sections 5 and 10, which are intended to provide a comparable level of protection to that required under Canadian law. Customers that are health information custodians remain responsible for determining that this arrangement is permitted under the legislation applicable to them; we will provide the information reasonably required for that assessment on request.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

18. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at: