Privacy Policy

1. Who controls your information

Most information in the Service is entered by a hospital or medical organization (an “Organization”) about its own staff and schedules. For that information, the Organization decides what is collected and how it is used, and we process it on the Organization’s behalf. If you are a provider or staff member and have questions about schedule data your Organization keeps, please contact your Organization’s administrator first. We are responsible for information we collect directly, such as account sign-in details, contact-form submissions, and website usage data.

2. Information we collect

Account information

When you sign in, we collect your email address. We use passwordless sign-in: we email you a one-time code, so we never collect or store a password. If your Organization uses single sign-on (SSO), we receive your email address and basic identity details from your Organization’s identity provider. You may also add your name to your profile.

Organization and scheduling data

Administrators and members of an Organization may enter:

• Organization details such as its name, departments (groups), services, and credentials (titles).
• Provider records: name, short name, credential, phone number, group memberships, and notes.
• Weekly availability, vacation and time-off dates, and scheduling preferences.
• Shift assignments, recurring shifts, draft and published schedules, and scheduling rules.
• Membership and role information (admin, member, or viewer) and invitations sent to colleagues.

The Service is built for staff scheduling. It is not designed to store patient information or other protected health information, and you should not enter any into it.

Activity and audit records

To help Organizations keep schedules accountable, we record who created or changed shift assignments and scheduling rules, and when. Organization administrators can see when members last signed in or were active.

Information you send us

If you use our contact form or request a new Organization, we collect what you provide, such as your name, work email, organization, role, phone number, and message.

Usage and device information

Like most websites, our servers and hosting provider automatically receive technical information such as your IP address, browser type, device type, pages visited, and timestamps. We use privacy-friendly website analytics and performance monitoring to understand overall traffic and page speed; these tools do not use advertising cookies or build cross-site profiles.

3. Cookies and local storage

We use essential cookies to keep you signed in. Your browser’s local storage also remembers a few interface preferences, such as light or dark theme and which Organization you last viewed. On our mobile apps, your sign-in session is kept in your device’s secure storage. We do not use advertising or third-party tracking cookies.

4. How we use information

• To provide the Service: signing you in, showing schedules, building and publishing them, and showing who is on call.
• To send service emails, such as sign-in codes, invitations to join an Organization, and replies to your requests.
• To power AI-assisted features that turn plain-language scheduling rules into structured rules.
• To keep the Service secure: preventing abuse, enforcing rate limits, and investigating problems.
• To understand how the Service is used so we can maintain and improve it.
• To comply with legal obligations and enforce our terms.

We do not sell your personal information, and we do not use it for advertising.

5. AI-assisted features

When someone in your Organization uses the AI scheduling assistant, the text they type, together with the context needed to interpret it (such as provider names and credentials, services, groups, existing rules, and the dates being scheduled), is sent to our AI provider, Anthropic, to generate a suggested rule. Suggestions are only saved if a user reviews and applies them. Anthropic processes this data to provide the service to us and, under its commercial terms, does not use it to train its models. Please don’t include information in AI requests that isn’t needed for scheduling.

6. How we share information

We share information only as described here:

• Within your Organization: schedules, provider names and contact details are visible to other members of the Organizations you belong to, according to their role.
• With service providers who run the Service for us: Supabase (database, authentication, and hosting of data), Vercel (website hosting, analytics, and performance monitoring), Anthropic (AI features), and Resend (email delivery). They may use the data only to provide services to us.
• With your Organization's identity provider, if you sign in through single sign-on.
• When required by law, or to protect the rights, safety, and security of our users, the public, or OnCallGenie.
• As part of a merger, acquisition, or sale of assets, in which case this policy will continue to apply to your information.

7. Data security

Information is encrypted in transit. Each Organization’s data is isolated at the database level, so members can only reach the Organizations they belong to, and administrative actions are limited to administrators. Sign-in uses one-time codes or SSO rather than passwords. No system is perfectly secure, but we work to protect your information and will notify affected users and Organizations of a breach as required by law.

8. Data retention

We keep information for as long as the account or Organization is active, or as needed to provide the Service. Past schedules are kept so historical records stay accurate: when a provider is removed, their upcoming shifts are deleted, but past shifts and the name attached to them are retained. When an Organization is deleted, its data is deleted. Contact-form messages and support correspondence are kept as long as needed to respond and for our records. We may keep limited information longer where the law requires it.

9. Your choices and rights

You can update your profile name in the Service, and you can leave an Organization at any time. Depending on where you live, you may have the right to request access to, correction of, or deletion of your personal information, or to object to certain processing. To make a request, email us at support@oncallgenie.com. If your request concerns data an Organization controls, we may refer it to that Organization or help it respond. We won’t discriminate against you for exercising your rights.

10. Children

The Service is intended for healthcare professionals and staff and is not directed to children under 16. We do not knowingly collect personal information from children.

11. International users

We and our service providers are based in, and process information in, the United States and other countries. If you use the Service from outside the United States, your information may be transferred to and processed in countries with different data protection laws than your own.

12. Changes to this policy

We may update this policy from time to time. When we do, we will change the “Last updated” date above, and if the changes are significant we will provide additional notice, such as in the Service or by email.

13. Contact us

OnCallGenie LLC is responsible for the information described in this policy. Questions or requests about this policy or your information? Email support@oncallgenie.com or use our contact form.