Privacy Notice

Version: v4 · Last updated: October 14, 2026 · Replaces v3 of the same date (sections 2, 3 and 7: in pilot mode, de-identified questions are kept for up to six months to improve the Policy Assistant).

This Privacy Notice for Shiftmark (“we”, “us”, or “our”) describes how and why we collect, store, use, and share (“process”) your personal information when you use our services (the “Services”), including when you:

• download and use our mobile application (Shiftmark);
• use our facility web portal at app.shiftmark.ca;
• visit our website at shiftmark.ca; or
• engage with us in other related ways, including support, beta testing, or events.

Questions or concerns? Reading this notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you have questions, contact us at privacy@shiftmark.ca.

Summary of key points

• What we process. Your identity and contact details, your professional credential and the documents that verify it, the shifts you post or work, your location when you confirm arrival and departure, payment and invoicing records, what you write in the app (shift notes and the topic of Policy Assistant questions), and technical data from your device. Details in section 1.
• Sensitive information. We process your professional licence and credential documents and your precise location at shift check-in and check-out. We do not process information about racial or ethnic origin, religion, sexual orientation, or health conditions of our users. The Services are designed so that personal health information about a facility’s residents is not collected — see section 2.
• The Policy Assistant. Answers are generated from documents the facility uploaded. In standard mode only a short topic phrase derived from your question is used and the words you typed are never stored, logged or sent to any third party. In pilot mode, at a facility that has accepted the Policy Assistant Pilot Agreement, your question is de-identified by an automated privacy pass and then processed in full by the providers in section 3; we never store the words you typed, and we keep the de-identified question for up to six months to improve the Policy Assistant. Sections 2, 3 and 7.
• Automated decisions. Some shift-status changes (for example, a missed arrival) are made automatically on a timer. You can ask for a person to review any of them. Section 4.
• Who we share with. The service providers listed in section 6, the facilities you work with, and no one else. We do not sell personal information and we do not use it for advertising.
• Your rights. Access, correction, export and deletion — from within the app or by contacting us. Section 10.

1. What information do we collect?

Information you give us

• Identity and contact: name, email address, phone number, and the identity we receive if you sign in with Google or Apple.
• Professional credential (healthcare professionals): your regulatory body and licence number (RN/RPN), or your PSW school and year of graduation, and the documents or screenshots you upload so we can verify them. Your verification status and the date it was checked.
• Profile: a short biography, your home location and how far you are willing to travel (set by you in the app), notification preferences, and your preferred language.
• Facility details (facility staff): the facility’s name, address, unit names and contacts, your role at the facility, and who you invite as members or employees.
• Shifts: shifts you post (title, unit, hours, rate, instructions) or apply to, assignments, cancellations, and arrival and departure confirmations.
• What you write in the app:
  • Shift notes — short operational handover notes for the next person on shift (for example, that a lift is out of service). See section 2.
  • Policy Assistant questions — see section 3.
  • Reviews and reports — ratings and comments between professionals and facilities, and reports about a review.
• Education: course enrolments, progress, and quiz attempts.
• Payment and invoicing: invoices issued to facilities, the amounts earned per shift, and the platform fee. Banking, tax, and identity-verification details for payouts are given directly to Stripe, our payments provider; we do not store your full card or bank details.
• Support and beta testing: what you send us through our support and beta forms, and your email address if you join our beta mailing list.

Information collected automatically

• Location at check-in and check-out. When you confirm arrival at or departure from a shift, the app records your device’s GPS position at that moment. This is the proof that a shift was worked. We do not track your location at any other time.
• Device and sign-in data. A push-notification token for your device; a device identifier and a public key if you enable sign-in restore on a new phone (the private key never leaves your device); the app version you use.
• Log and diagnostic data. IP address, request timestamps, the actions you take in the Services, and crash and error reports. Error reports never include the text of questions or notes.
• Website. Our website sets no cookies. The beta install page sends an anonymous count of page views and install-button clicks; it does not identify you.

Sensitive information

We process two kinds of information that may be considered sensitive: your professional licence and credential documents, and your precise location at shift check-in and check-out. We do not collect information about your racial or ethnic origin, religious beliefs, sexual orientation, or health. Information about a facility’s residents is addressed in section 2.

Google API

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

All personal information you provide to us must be true, complete, and accurate, and you must notify us of any changes.

2. Information about residents

Shiftmark’s Services are designed so that personal health information about a facility’s residents is not collected. Each facility remains the custodian of its residents’ records; Shiftmark is not a place to keep or discuss them. In practice:

• Shift notes are for the place, not the person. The app tells you so every time you write one and warns when a note looks like it is about a resident. It never edits what you wrote.
• Policy Assistant questions, in standard mode, are checked on your phone before they are sent, and again on our servers. Anything that identifies a resident — a name with an honorific, a room or bed number, a health card number, a date of birth — is removed on your phone, and if our servers still detect it the question is refused. Only a short phrase describing the topic of your question is used; the words you typed are never stored, logged, or sent to any third party. Your history shows the topic, not the sentence.
• In pilot mode — only at a facility that has accepted the Policy Assistant Pilot Agreement and switched to it — your question is de-identified by an automated privacy pass and then processed in full, as section 3 describes. The words you typed are still never stored or logged by us. We keep the de-identified version of your question for up to six months, only to improve the Policy Assistant (section 3); your history shows what was answered and which documents were cited.
• Documents a facility uploads for the Policy Assistant are checked at upload for the shape of a resident record (a chart, a medication administration record, a care plan) and refused if they match; the file is deleted.
• A shift title that names a resident is refused when the shift is posted.

If you believe resident information has entered the Services despite these measures, contact us at privacy@shiftmark.ca and we will remove it.

3. The Policy Assistant

Facilities may upload their policy and procedure documents. Staff who are on shift at that facility can ask questions and receive answers drawn only from those documents, with citations. To provide this:

• the facility’s documents are split into passages and converted into numerical representations by Voyage AI, so that relevant passages can be found;
• in standard mode, the topic phrase derived from your question, together with the relevant passages, is sent to Anthropic to generate the answer;
• the facility’s documents, the topic phrase, the relevant passages and the generated answer may be sent to TypeSafe, whose models check whether passages are relevant and whether an answer is supported by the passages it cites, and recover the section headings of documents that lack them.

Pilot mode. A facility that has accepted the Policy Assistant Pilot Agreement, and switched the Policy Assistant to pilot mode in the portal or the app, has asked us to process its staff’s questions in full, as its agent and electronic service provider under Ontario’s Personal Health Information Protection Act. In pilot mode:

• your question, as typed, is sent to TypeSafe, whose model finds the identifiers in it (names, room and bed numbers, dates, phone numbers, record numbers) and reports where they are; we replace them with placeholders such as “[RESIDENT]” on our servers;
• the de-identified question is sent to Voyage AI to find the relevant passages, and to Anthropic, which chooses among those passages and writes the answer;
• the privacy pass is automated and not perfect: an identifier it misses reaches Voyage AI and Anthropic too. The Pilot Agreement discloses this to the facility, and what each provider’s terms say about how long it keeps what it receives;
• during the pilot we keep the de-identified question, with the kinds of identifiers removed, for up to six months, only to measure and improve the Policy Assistant; it is deleted automatically, and at once if the facility switches back to standard mode. It is not linked to your name in what we test with, and never used to train a model or shared with a partner;
• the facility may switch back to standard mode at any time.

In both modes, none of these providers receives your name. We use them under commercial API terms; Anthropic and TypeSafe do not use what they receive to train their models, and we have opted out of Voyage AI’s training licence. We record the topic or the cited sections of each question, the answer given, which documents it cited, the kinds of identifiers the privacy pass removed (never the identifiers themselves), and who asked, so the facility can see what its staff needed to know. Answers are drawn from the facility’s own documents and can be wrong or incomplete; they are not a substitute for the facility’s policies, your professional judgment, or emergency procedures.

4. How do we process your information?

We process your personal information to:

• create and secure your account — sign-in, password reset, sign-in restore on a new device, and fraud prevention;
• verify professional credentials — so facilities can rely on who is working their shifts;
• match professionals with shifts — nearby-shift search uses your home location and travel radius; facilities see the credential and verification status of professionals who apply;
• prove a shift was worked — arrival and departure confirmations, including the GPS position recorded at that moment;
• invoice facilities and pay professionals — through Stripe; see section 6;
• send you notifications — push notifications, and email when a push cannot be delivered;
• deliver required education and record completion;
• provide the Policy Assistant and shift notes, as described above;
• support you and improve the Services using aggregate, de-identified usage information; and
• comply with law, including Ontario healthcare regulation and Canadian tax law.

Automated decisions. The following shift-status changes are made automatically, on a timer, without a person reviewing them first: a shift is marked a no-show if arrival is not confirmed within 15 minutes of its start; a shift is marked completed 15 minutes after its scheduled end if departure was not confirmed; and an unfilled shift expires once its start time has passed. A no-show affects whether you are paid for that shift and is visible to the facility. If you believe any automated change is wrong, contact support@shiftmark.ca and a person will review it.

We do not sell personal information, we do not use it for advertising, and we do not use it to train artificial-intelligence models.

5. What legal bases do we rely on?

We process your personal information only when we have a valid legal reason to do so under applicable Canadian law — with your consent, to provide the Services you have asked for, to comply with law, or to protect our rights and yours.

We may process your information if you have given us express consent for a specific purpose, or where your consent can reasonably be implied from your use of the Services. You can withdraw your consent at any time (section 10). In some exceptional cases we may be legally permitted to process information without consent, including:

• if collection is clearly in the interests of an individual and consent cannot be obtained in a timely way;
• for investigations and fraud detection and prevention;
• for business transactions, provided certain conditions are met;
• if it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim;
• for identifying injured, ill, or deceased persons and communicating with next of kin;
• if we have reasonable grounds to believe an individual has been, is, or may be a victim of financial abuse;
• if it is reasonable to expect that collection with consent would compromise the availability or accuracy of the information, and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province;
• if disclosure is required to comply with a subpoena, warrant, court order, or rules of court relating to the production of records;
• if it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which it was produced;
• if the information is publicly available and specified by regulation.

We may disclose de-identified information for approved research or statistics projects, subject to ethics oversight and confidentiality commitments.

6. When and with whom do we share your personal information?

Other users of the Services. Facilities you apply to see your name, email address, credential type, licence number, verification status, and your average rating. Facility members see the shift notes written at their facility and the topics of Policy Assistant questions asked there. Professionals see the facility’s name, address, unit, hours, and rate, and its average rating. Ratings and reviews are visible to the party they are about.

Service providers. We share information with the following providers only as necessary to operate the Services. Each processes it on our instructions and under contract.

Provider	Purpose	What it receives
Supabase	Database, sign-in, file storage	All account data and uploaded files
Google Cloud	Application hosting, scheduled tasks, secret storage	All data processed by our servers
Cloudflare	Network edge, web hosting, web forms	Request metadata; web-form submissions
Upstash	Request de-duplication, rate limiting, sign-in challenges	Request and device identifiers
Stripe	Invoicing facilities, paying professionals, identity verification for payouts	Name, email, banking and tax details you give Stripe; invoice line items
Resend	Transactional email; the beta mailing list	Email address, name, the content of emails we send you
Expo	Push notifications	Device push token, notification content
Mapbox	Address geocoding	Facility addresses
Sentry	Crash and error reporting	Technical diagnostics; never the text of questions or notes
Anthropic	Policy Assistant answers	The topic phrase and document passages; in pilot mode, the de-identified question (section 3)
Voyage AI	Policy Assistant document search	Document passages and the topic phrase; in pilot mode, the de-identified question (section 3)
TypeSafe	Policy Assistant privacy pass, quality checks and document structure	Document text, the topic phrase and generated answers; in pilot mode, the question as typed (section 3)
Google (Sign-In, Play), Apple (Sign in with Apple, TestFlight, App Store)	Sign-in and app distribution	Sign-in identity; app-store account

Where your information is stored. Our providers store and process information in Canada and the United States. Information held outside Canada may be subject to the laws of that jurisdiction, including lawful access by its authorities.

Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company.

Legal requirements. We may disclose information where required by law, subpoena, warrant, or court order, or where necessary to protect the rights, property, or safety of Shiftmark, our users, or others.

7. How long do we keep your information?

We keep personal information only as long as necessary for the purposes in this notice, unless a longer period is required or permitted by law.

• Account deletion. When you delete your account, your login is removed immediately and your email address and phone number are replaced with anonymous placeholders at once. Within 7 days we permanently delete the records that exist only for you (notifications, device tokens, sign-in restore keys, credential documents and photos, pending shift applications, saved preferences) and anonymise your name, biography, home location, and any location readings captured at shift check-in, so that nothing left in our systems identifies you.
• Policy Assistant questions are kept for 24 months, then deleted automatically. In pilot mode the de-identified question itself is kept for no more than six months, then deleted automatically, and deleted at once if the facility leaves pilot mode. De-identified counts (how many questions, by facility, month, and outcome) are kept indefinitely. A record tied to an incident or complaint may be held beyond 24 months until the matter is closed.
• Shift notes are kept for 12 months, then deleted automatically. De-identified counts by facility, month, and category are kept indefinitely. A note tied to an incident or complaint may be held beyond 12 months until the matter is closed.
• Records we are required to keep. Records of shifts worked, payments, and invoices are retained for six years after the end of the year they relate to, as required by the Income Tax Act and the Excise Tax Act (Canada). Training and credential-attestation records are retained for as long as the facility that relied on them is required to keep them. After account deletion these records are kept with your identity removed.
• Service providers. Stripe retains payout and identity-verification records under its own retention rules; Resend retains email delivery logs; invoices already issued to facilities keep the name they were issued with. We do not delete these on your behalf.
• Backups. Information may persist in encrypted backups for a limited period after deletion and is not restored except to recover from a failure.

8. How do we keep your information safe?

We have implemented appropriate and reasonable technical and organisational security measures designed to protect the personal information we process, including encryption in transit and at rest, row-level access controls in our database, short-lived signed links for uploaded documents, and single-use codes for arrival and departure confirmations. However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise that unauthorised third parties will never defeat our security. You should access the Services only within a secure environment and keep your sign-in details private.

9. Do we collect information from minors?

We do not knowingly collect data from or market to anyone under 18 years of age. By using the Services you represent that you are at least 18. If we learn that personal information from a person under 18 has been collected, we will deactivate the account and take reasonable measures to promptly delete it. If you become aware of any such data, contact us at privacy@shiftmark.ca.

10. What are your privacy rights?

Under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial law, you have the right to request access to and a copy of your personal information, to request correction or deletion, to withdraw consent, and to challenge our compliance with this notice. We will respond to a request within 30 days.

• Export. From the app’s settings you can download a copy of your data at any time, including your profile, credentials, shifts, shift notes, and the topics of your Policy Assistant questions.
• Correct. Update your profile in the app, or contact us for anything you cannot change yourself.
• Delete. Delete your account from the app’s settings. See section 7 for what happens next and what we are required to keep.
• Withdraw consent. You may withdraw consent at any time by contacting us. This does not affect the lawfulness of processing before withdrawal, and may mean we can no longer provide some or all of the Services.
• Marketing email. You can unsubscribe from our beta and product emails using the link in each email. We may still send service messages necessary to administer your account.
• Automated decisions. You can ask for human review of any automated shift-status change (section 4).

You may also submit a request through our data subject access request form or by emailing privacy@shiftmark.ca. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada.

11. Controls for do-not-track features

Most web browsers and some mobile operating systems include a Do-Not-Track (“DNT”) setting. No uniform standard for recognising DNT signals has been finalised, and we do not currently respond to them. Our website does not track you across other sites in any case. If a standard we must follow is adopted, we will describe our practice in a revised version of this notice.

12. Do we make updates to this notice?

Yes. The updated version will be indicated by the “Last updated” date at the top of this notice. If we make material changes, we will notify you by posting a notice in the app or by sending you a notification. We encourage you to review this notice periodically.

13. How can you contact us about this notice?

Email: privacy@shiftmark.ca

Post: Shiftmark 255 Shaver Road Jerseyville, Ontario L0R 1R0 Canada