Effective date: Date of publication Last updated: Date of publication

ShiftPretty LLC (“ShiftPretty,” “we,” “us” or “our”) respects the privacy of the people and organizations that use our websites, request information, participate in a demonstration or trial, use the ShiftPretty platform, interact with ShiftPretty AI, apply for opportunities or otherwise communicate with us. This Privacy Notice explains what personal information we handle, why we handle it, how we disclose and protect it, and the choices and rights that may be available.

This Notice applies to ShiftPretty websites and services that link to it. A customer organization may provide additional notices about information it controls through ShiftPretty. If there is a conflict concerning customer-controlled Protected Health Information (“PHI”), the applicable Business Associate Agreement (“BAA”) and customer instructions govern.

Our roles and phased service model

Our role depends on the interaction:

• We generally act for our own business purposes when we process website, sales, marketing, security, account-administration, recruitment and direct-business-communication information.
• When an organization uses ShiftPretty to process information on its behalf, the organization generally determines the purpose of that processing and ShiftPretty acts as its service provider or processor under contract.
• Phase 1 websites, demonstrations and trials are not authorized to receive PHI. Do not enter PHI, live patient records or Texas Medicaid/EVV data into those environments.
• In an expressly approved Phase 2 environment, ShiftPretty may process PHI on behalf of an eligible covered entity or business associate under an effective BAA. PHI access is enabled only after the contractual, security and onboarding requirements are complete.
• Texas Medicaid/EVV data remains outside the authorized scope unless an Order Form expressly states otherwise.

Information we collect

Depending on the service and relationship, we may collect:

Contact and professional information. Name, business email, telephone number, organization, job title, professional role, region and communication preferences.

Account and identity information. Username, authentication identifiers, organization membership, role, permissions, account status and security-verification information. Passwords should be stored only in protected, non-readable form.

Organization and workforce information. Organization type, operational needs, staff profile, availability, credentials, training status, scheduling information and other information configured by a customer, subject to the approved service scope.

Customer content. Information customers and authorized users submit to the platform. Phase 1 is limited to sample and non-PHI data. Approved Phase 2 customers may submit PHI only through authorized workflows and environments under the BAA.

AI interaction information. Prompts, selections, feedback and outputs associated with ShiftPretty AI. The interface will identify whether PHI is permitted. Public and Phase 1 AI experiences must not receive PHI.

Device, usage and security information. IP address, browser and device type, operating system, referring page, pages viewed, date/time, approximate location derived from IP, log events, authentication activity, cookie identifiers and security signals.

Location information. Approximate or precise location only when a supported feature requires it, the customer has enabled it, and the user or organization has provided the required permission. The product must state the purpose and control before collection.

Communications and support information. Messages, support requests, call/meeting details, survey responses and feedback. Do not send PHI, passwords, access tokens or urgent care information through public forms or ordinary email.

Commercial information. Plan, Order Form, invoicing, transaction status and customer relationship information. Payment-card information should be handled by the disclosed payment provider and not stored directly by ShiftPretty unless specifically stated.

Recruitment and careworker information. Application, work-history, qualification, preference and eligibility information if ShiftPretty offers a job or careworker journey. Separate notices may apply. ShiftPretty must not use AI to make an unreviewed final employment or shift-eligibility decision.

Sources

We may obtain information directly from you; from your organization or an authorized platform user; from integrations you or a customer enables; from service providers; from professional/public sources where permitted; and automatically from devices and website technologies.

Why we use information

We use personal information to:

• Provide, configure, secure and support the service;
• Authenticate users, administer permissions and prevent unauthorized activity;
• Schedule demonstrations and evaluate trial or pilot requests;
• Operate permitted scheduling, workforce, documentation, reporting and care-support workflows;
• Generate AI-assisted outputs for the disclosed purpose and enable human review;
• Communicate about accounts, service changes, security and support;
• Process subscriptions and maintain business records;
• Measure website and product performance in accordance with applicable choices;
• Improve usability, reliability, safety and functionality;
• Protect people, systems, rights and property; prevent fraud and abuse;
• Comply with contracts, legal obligations and valid requests; and
• Send marketing where permitted and honor opt-out choices.

Where GDPR or similar law applies, our legal bases may include performing a contract, taking requested pre-contract steps, legitimate interests that are not overridden by individual rights, legal obligations, protection of vital interests, and consent where required. A customer determines the basis for information it controls.

AI processing

ShiftPretty AI is limited to approved administrative and care-support purposes. It does not provide diagnosis, treatment, emergency response or autonomous consequential decisions. Qualified people must review outputs before using them for care, safety, staffing, eligibility or other material action.

ShiftPretty does not use PHI to train general-purpose models. Before publication, the product owner must state whether permitted non-PHI prompts, outputs or feedback are used to improve general models, identify the model providers, disclose retention, and describe available customer controls. Any model provider that processes Phase 2 PHI must be within the approved data flow, subject to an appropriate BAA and prohibited from unauthorized training or retention.

How we disclose information

We may disclose information:

• To the customer organization that administers the relevant account or workflow;
• To hosting, identity, security, communication, analytics, support, payment, integration and AI service providers under appropriate contracts;
• At the direction of a customer or user, including enabled integrations;
• To professional advisers and auditors with confidentiality obligations;
• When required by law or reasonably necessary to protect rights, safety, security and integrity;
• In connection with a financing, merger, acquisition, restructuring or sale, subject to appropriate safeguards; and
• With consent or as otherwise disclosed at collection.

We will maintain a current subprocessor list for the production service. We do not sell PHI. ShiftPretty’s position for other personal data is that it does not sell personal data or share it for cross-context behavioral advertising unless a future approved notice expressly states otherwise and provides required choices.

Cookies and similar technologies

We use cookies and similar technologies for security, requested functions, preferences and measured analytics. Nonessential technologies will be controlled according to applicable consent and opt-out requirements. See the Cookie Notice and use “Cookie Preferences” to update choices. Where applicable, we will process recognized opt-out preference signals such as Global Privacy Control.

Retention

We retain information according to its purpose, contract, legal obligations, security needs and approved retention schedule. Customer-controlled data is retained and deleted under the customer agreement. Phase 2 PHI retention, return and destruction follow the BAA and customer instructions. Backup copies may persist for a limited, documented cycle and remain protected until overwritten. The final Notice must link to or reflect approved retention periods for leads, trials, customer data, AI interactions, security logs, support records and backups.

Security

We use administrative, technical and physical safeguards designed to protect information. Safeguards vary by service scope and risk. No system is completely secure. See our Security page for evidence-approved information and the process for reporting a vulnerability or suspected incident.

Your rights and choices

Depending on location and relationship, you may have rights to confirm processing; access or obtain a portable copy; correct; delete; restrict or object; withdraw consent; opt out of sale, targeted advertising or qualifying profiling; and appeal a denied request. You may opt out of marketing email through the message link or by contacting us.

Submit a request through the privacy request form or privacy@shiftpretty.com. We may verify identity and authority before acting. Authorized agents may submit requests where permitted. We will respond within the period required by applicable law—generally no later than 45 days for authenticated Texas consumer requests, subject to permitted extensions.

If information was submitted by a care organization, contact that organization first. ShiftPretty will assist the organization as required by contract and law. These channels are not for emergencies or urgent care.

Texas residents

Where the Texas Data Privacy and Security Act applies, Texas consumers may request access, correction, deletion and portability, and may opt out of targeted advertising, sale or qualifying profiling. Consumers may appeal a decision using the same privacy channel with “Privacy Appeal” in the subject. ShiftPretty will not discriminate for exercising applicable rights. ShiftPretty applies this baseline without relying on an unconfirmed small-business exemption.

California and other U.S. residents

Where applicable law provides additional rights, ShiftPretty will honor them. The final notice must include any required California category table, notice at collection, sale/sharing statement, sensitive-information limitation and request methods based on the completed data and tracking inventory.

International transfers

ShiftPretty is based in the United States. If information is transferred from another country, we will use a recognized legal mechanism where required. The final notice must identify relevant hosting locations, transfer mechanism, EU/UK representative or data protection officer if applicable.

Children and dependent data

The public website and self-service account process are not directed to children. ShiftPretty may process information about dependents or care recipients only on behalf of an authorized customer and within the approved environment. A customer is responsible for authority, notices and consents unless the contract states otherwise. Direct senior/patient AI experiences must not be used by minors unless specifically designed, assessed and authorized.

Changes

We may update this Notice. We will post the revised date and provide additional notice when required. Material changes do not retroactively expand use of customer-controlled PHI beyond the BAA and customer instructions.

Contact

ShiftPretty LLC 245 Waters Ridge Dr Lavon, TX 75166 United States Email: privacy@shiftpretty.com Web: /contact or the dedicated privacy request form