ShiftMedixPrivacy Policy
Effective date: April 12, 2026 · Last updated: April 12, 2026
ShiftMedix, Inc. · Raleigh, NC 27601, United States
1. Who We Are
ShiftMedix, Inc. ("ShiftMedix," "we," "us," or "our") is a software-as-a-service company headquartered in Raleigh, North Carolina. We build and operate an automated provider scheduling platform designed for healthcare organizations — including physician groups, hospital medicine programs, primary care practices, and surgery and anesthesiology groups.
ShiftMedix is the data controller for the personal data described in this policy. That means we determine why and how your data is processed.
2. Data We Collect
We collect only what we need to run the platform and support your team. Here is exactly what that is:
We do not collect patient names, medical records, diagnoses, or any patient-identifiable information. We do not collect financial information such as credit card numbers (billing is handled by our payment processor directly).
3. How We Use Your Data
We use your data only for the following purposes:
Generate schedules, process swap and leave requests, send schedule notifications, and enforce coverage rules. This is the core purpose of ShiftMedix.
Respond to your questions, troubleshoot issues, and communicate with your organization's administrators.
Monitor for unauthorized access, detect abuse, investigate security incidents, and enforce our Terms of Service.
Analyze anonymized or aggregated usage patterns to understand how features are used and where we should invest development effort.
Send product updates, maintenance notices, and important policy changes. We do not send marketing emails without your consent.
Retain records as required by applicable law and respond to lawful requests from government authorities.
5. Data Storage & Security
All ShiftMedix data is stored on Amazon Web Services (AWS) infrastructure located in the United States. AWS maintains SOC 2 Type II, ISO 27001, and HIPAA-eligible certifications for its infrastructure.
Our security practices include:
- ✓Encryption in transit using TLS 1.2+ for all data moving between your browser/app and our servers
- ✓Encryption at rest for database storage
- ✓Access controls limiting data access to employees who need it to do their job
- ✓Regular security reviews and vulnerability assessments
- ✓Incident response procedures in case of a data breach
International transfers: If you are located outside the United States (e.g., in the EU or India), your data will be transferred to and processed in the US. We rely on appropriate safeguards — including Standard Contractual Clauses for EU/EEA users and comparable mechanisms for other jurisdictions — to protect that transfer.
6. How Long We Keep Your Data
We keep your data for as long as your organization's account is active and for a reasonable period afterward to support offboarding, audits, and legal compliance.
When your data is no longer needed, we delete or anonymize it in a secure manner.
7. Your Rights
Depending on where you are located, you have specific legal rights over your personal data. We honor these rights regardless of your location — just contact us.
- ✓Access a copy of your data
- ✓Correct inaccurate data
- ✓Request erasure ("right to be forgotten")
- ✓Restrict processing of your data
- ✓Data portability (receive your data in a machine-readable format)
- ✓Object to processing based on legitimate interest
- ✓Lodge a complaint with your local supervisory authority
- ✓Know what personal information we collect and why
- ✓Access the specific pieces of data we hold about you
- ✓Delete your personal information
- ✓Correct inaccurate information
- ✓Opt out of the sale of personal information (we don't sell — this is already guaranteed)
- ✓Non-discrimination for exercising these rights
- ✓Access a summary of your personal data
- ✓Correct or update your data
- ✓Erase your data (where applicable)
- ✓Know the identities of parties your data is shared with
- ✓Grievance redressal within a reasonable timeframe
- ✓Nominate another person to exercise rights on your behalf
Email us at info@shiftmedix.com with the subject line "Privacy Rights Request." We will respond within 30 days (or sooner, as required by applicable law). We may need to verify your identity before processing the request.
If you are a provider whose data is managed by your employing healthcare organization (the "controller"), your organization may need to process certain requests on your behalf. We will direct you accordingly.
9. Children's Privacy
ShiftMedix is a platform designed for healthcare professionals and is intended exclusively for users who are 18 years of age or older. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected data from a minor, we will delete it promptly.
10. Changes to This Policy
We may update this Privacy Policy from time to time as our practices evolve or as required by law. When we make material changes, we will:
- →Post the updated policy on this page with a new "Last updated" date
- →Send an email notification to account administrators at least 30 days before the change takes effect
- →Where required by law (e.g., GDPR), obtain your consent before the change applies to you
Continued use of the platform after the effective date of an updated policy constitutes acceptance of the changes.
11. Contact Us
If you have any questions, concerns, or requests related to this Privacy Policy or your personal data, please reach out:
EU/EEA users may also lodge a complaint with your local data protection supervisory authority. A list of EU supervisory authorities is available at edpb.europa.eu.