Privacy Policy

ShiftCare Pro ("ShiftCare Pro", "we", "us", or "our") is a care workforce management platform operated by Nupress Technologies. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you visit our website, create an account, or use the ShiftCare Pro web and mobile applications (together, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this Policy, please do not use the Service.

1. Who this Policy covers

ShiftCare Pro is a business-to-business platform. We handle personal information for three groups of people:

• Organization administrators — the owners, managers, and staff who register an organization, configure it, and manage billing.
• Care team members (employees) — staff whose profiles, schedules, and attendance are managed by their organization through the Service.
• Website visitors — anyone browsing our marketing pages.

Where an organization uses ShiftCare Pro to manage its workforce, that organization is the data controller of its team members' information, and ShiftCare Pro acts as a data processor on the organization's behalf. If you are a care team member, your employer's privacy notice also applies to you, and requests about your data may need to be directed to your employer in the first instance.

2. Information we collect

Information you provide to us

• Account information — name, email address, phone number, password, and profile photo when you create an account or accept an invitation.
• Organization information — organization name, business address, contact details, and settings provided during onboarding.
• Employee records — job title, role and permissions, employment details, availability, qualifications, and pay-related information entered by your organization for scheduling and payroll purposes.
• Billing information — subscription plan, billing contact, and payment history. Card payments are processed by Stripe; we do not store full card numbers on our systems.
• Communications — messages you send to our support team and feedback you provide.

Information collected automatically

• Attendance and location data — when your organization enables geofenced clock-in and clock-out, the mobile app records your device's location at the moment you clock in or out to confirm you are at the assigned care location. We do not continuously track your location in the background.
• Verification events — where your organization enables biometric verification for attendance, verification happens on your device (for example, fingerprint or face unlock provided by your phone's operating system). We receive only the result of the check (verified or not verified), never your fingerprint or facial data.
• Usage and device data — log data such as IP address, browser and device type, operating system, pages viewed, and actions taken in the Service, used for security, debugging, and product improvement.
• Cookies and similar technologies — we use cookies and local storage to keep you signed in, remember preferences (such as dark mode), and understand how the Service is used. You can control cookies through your browser settings, though the Service may not function properly without essential cookies.

Information from third parties

• Address lookups — when you type an address, we use Google Maps Places to suggest and validate addresses. Your address query is shared with Google to provide suggestions.
• Payment processors — Stripe provides us with payment status, receipt details, and limited card metadata (such as brand and last four digits) needed to manage your subscription.

3. How we use your information

We use personal information to:

• Provide, operate, and maintain the Service, including scheduling, attendance tracking, payroll support, and team management;
• Create and administer accounts, organizations, and role-based permissions;
• Process subscription payments, send invoices and receipts, and manage billing;
• Verify attendance at care locations through geofenced clock-in and clock-out;
• Send service communications such as shift assignments, schedule changes, reminders, and security notices, including push notifications where you have enabled them;
• Provide customer support and respond to enquiries;
• Monitor, secure, and improve the Service, including detecting fraud and abuse and debugging issues;
• Comply with legal obligations, including employment, tax, and care-sector record-keeping requirements that apply to our customers.

We do not sell personal information, and we do not use care team members' data for advertising.

4. Legal bases for processing

Where data protection law (including the Kenya Data Protection Act, 2019 and, where applicable, the EU/UK GDPR) requires a legal basis, we rely on:

• Contract — to provide the Service you or your organization signed up for;
• Legitimate interests — to secure and improve the Service, prevent abuse, and communicate about your account;
• Legal obligation — to keep records required by law;
• Consent — for optional features such as push notifications and location access, which you can withdraw at any time in your device settings.

5. How we share information

We share personal information only as described below:

• Within your organization — your profile, schedule, and attendance information is visible to administrators and managers of your organization according to the roles and permissions your organization configures.
• Service providers — we use trusted vendors to run the Service, including Supabase (database, authentication, and hosting), Stripe (payment processing), Google (maps and address services), and push notification providers. These providers process data only on our instructions and under contractual safeguards.
• Legal requirements — we may disclose information where required by law, regulation, legal process, or to protect the rights, safety, or property of ShiftCare Pro, our users, or the public.
• Business transfers — if we are involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy.

6. Data retention

We retain personal information for as long as an account or organization remains active and as needed to provide the Service. Organizations control the retention of their team members' records within the platform. When an organization closes its account, we delete or anonymize its data within a reasonable period, except where we must retain records to comply with legal, tax, or accounting obligations, resolve disputes, or enforce agreements.

7. Security

We take security seriously. Measures include encryption of data in transit, encrypted storage, role-based access control, tenant isolation between organizations, and least-privilege access for our staff. No method of transmission or storage is completely secure, so we cannot guarantee absolute security; if we become aware of a breach affecting your personal information, we will notify affected users and regulators as required by law.

8. Your rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete information;
• Request deletion of your information;
• Object to or restrict certain processing;
• Receive a portable copy of information you provided;
• Withdraw consent where processing is based on consent;
• Lodge a complaint with your data protection authority (in Kenya, the Office of the Data Protection Commissioner).

If you are a care team member, some requests (for example, correcting your employment record) are controlled by your organization, and we will refer your request to them where appropriate. To exercise your rights, contact us at privacy@shiftcarepro.com.

9. International transfers

Our service providers may store or process information in countries other than your own. Where information is transferred internationally, we take steps to ensure it receives an adequate level of protection, including contractual data protection commitments with our providers.

10. Children's privacy

The Service is a workplace tool intended for adults. It is not directed at children under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

11. Changes to this Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Service or by email before the changes take effect. The "Last updated" date at the top of this page shows when this Policy was last revised.

12. Contact us

If you have questions about this Privacy Policy or our data practices, contact us at:

• Email: privacy@shiftcarepro.com
• Support: support@shiftcarepro.com