Legal
Privacy Policy
We collect only what we need to run ShiftScout well, store it carefully, and give you control over it.
Last updated: November 1, 2026
1. Overview
This privacy policy explains how ShiftScout, Inc. ('ShiftScout,' 'we,' 'us') collects, uses, and protects information when you use our mobile app and website. We respect that healthcare credentials are sensitive and we treat them accordingly.
2. Authentication data
When you create an account we collect your name, email address, phone number, and a securely hashed password. We may also collect identifiers from sign-in providers (Apple, Google) when you choose to use them. We never see your social provider password.
3. Credential & document storage
Credential documents — licenses, DEA registrations, certifications, malpractice coverage — are stored encrypted at rest using server-side encryption, and in transit via TLS. Access is gated by short-lived signed URLs scoped to your account. Documents are shared with employers only when you explicitly initiate or accept a share action.
4. Analytics & product usage
We collect anonymized usage analytics — screens visited, features used, app crash reports — to improve product reliability and design. We do not associate analytics with sensitive credential content.
6. Storage & infrastructure providers
ShiftScout is built on managed cloud infrastructure including Supabase for database and file storage. These providers act as data processors under our written agreements and are subject to industry-standard security controls.
7. Third-party integrations
When you connect optional services (e.g., CME providers, malpractice partners, lodging partners), we share only the minimum information needed to facilitate the connection — typically your name, email, and contract type — and only with your consent.
8. Data retention
We retain account data while your account is active. Credential documents are retained while needed for active applications or contracts. After account deletion, we remove identifiable data within 30 days, except where law requires longer retention (e.g., financial records).
9. Security practices
Production access is restricted to authorized personnel and logged. We follow secure development practices, perform regular dependency updates, and conduct internal reviews of access controls. No system is perfectly secure, but we treat your records as we would our own.
10. Your rights
You may access, export, correct, or delete your data at any time from account settings. For requests we cannot fulfill in-app, email privacy@hqshiftscout.com.
11. Account deletion
Account deletion is available in-app under Settings → Account → Delete account. The process is irreversible. We will remove identifiable data within 30 days and confirm completion by email.
12. Contact
Questions about this policy can be sent to privacy@hqshiftscout.com.