Privacy Policy

1. Information We Collect

We collect information that is necessary to provide the scheduling service to your organization:

Account Information

• Name and email address (provided by your organization’s administrator)
• Phone number (if provided, for SMS notifications)
• Password (stored in hashed form; we cannot view your password)
• Role and organizational affiliation

Scheduling Data

• Schedule assignments, rotations, and shift information
• Time-off requests and availability
• Shift swap requests
• Skills, certifications, and position type assignments

Usage Data

• Login timestamps and session information
• Actions taken within the Service (for audit logging)

2. How We Use Your Information

• To provide and operate the scheduling service
• To send schedule-related notifications via email or SMS (with your consent)
• To authenticate your identity and manage your account
• To generate schedules using our automated scheduling algorithms
• To maintain audit logs for accountability and compliance
• To improve and maintain the Service

3. SMS Communications

If you opt in to SMS notifications, we will use your phone number to send schedule-related text messages. Specifically:

• We send SMS messages only to users who have explicitly opted in via the login page checkbox
• Your phone number is used solely for Service-related notifications and is never sold or shared with third parties for marketing purposes
• SMS messages are sent through Twilio, our third-party messaging provider, which processes your phone number to deliver messages
• Message frequency varies; message and data rates may apply
• You may opt out at any time by unchecking the SMS consent box on the login page or replying STOP to any message
• We log SMS delivery status for troubleshooting purposes

4. How We Share Your Information

We do not sell your personal information. We share data only in the following limited circumstances:

• Within your organization: Schedule assignments and contact information are visible to administrators and other users within your organization as needed for scheduling purposes
• Service providers: We use third-party services to operate the platform, including cloud hosting (Vercel), database services (Neon), email delivery (Resend), and SMS messaging (Twilio). These providers process data only as needed to deliver their services
• Legal requirements: We may disclose information if required by law, legal process, or government request

5. Data Security

We implement industry-standard security measures to protect your data, including encrypted connections (HTTPS/TLS), hashed passwords using bcrypt, secure session management with JWT tokens, and access controls that restrict data visibility by role and organization. While no system is completely secure, we take reasonable precautions to protect your information.

6. Data Retention

We retain your account information and scheduling data for as long as your organization maintains an active account with the Service. When a user account is deactivated by an administrator, the account data is retained for historical scheduling records but is no longer accessible for login. Organizations may request deletion of their data by contacting us.

7. Your Rights

You have the right to:

• Access the personal information we hold about you (through your account or by request)
• Request correction of inaccurate information (contact your organization’s administrator)
• Opt out of SMS notifications at any time
• Request deletion of your account data (through your organization’s administrator or by contacting us directly)

8. Cookies and Local Storage

The Service uses essential cookies for authentication and session management. We also use browser local storage for user preferences such as theme settings. We do not use tracking cookies or third-party analytics cookies.

9. Children’s Privacy

The Service is designed for use by healthcare professionals and is not directed at individuals under the age of 18. We do not knowingly collect information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes by posting the updated policy on this page with a new “Last updated” date. Continued use of the Service after changes are posted constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at support@synesthesiacrna.com.

12. SMS Messaging

If you opt in to SMS messaging at /sms-opt-in or via your account, we collect and store your mobile phone number, the date and time of consent, and the device information used to give consent (IP address and browser user agent) for compliance with carrier and TCPA requirements. We use your number solely to send scheduling-related notifications described in our SMS program (schedule publishes, swaps, time-off decisions, board-runner changes, coverage requests). We do not sell or share your phone number with third parties for marketing. You can opt out at any time by replying STOP.