1.  Who We Are

ShiftRx, Inc. is a Delaware corporation that provides Holly, an AI-powered scheduling and workforce operations platform, to healthcare organizations, restaurants, and other businesses. This Privacy Policy describes how we collect, use, and protect personal data in connection with Holly.

2.  Data We Collect

We collect information you provide directly or that is submitted on your behalf by your employer (our direct customer), including:

• Staff and employee contact information: full legal name, preferred name, phone number, email address, job title, and role responsibilities

• Scheduling data: shift preferences, availability, scheduling history, personal time-off requests

• Operational data: standard operating procedures, organizational preferences, scheduling rules, and operational constraints

• Communications: messages sent through WhatsApp, SMS, or other supported channels

Holly is a workforce scheduling and coordination platform. It is designed and scoped to avoid contact with protected health information (PHI) as defined under HIPAA. Holly does not collect clinical, diagnostic, or medical records data. We do not collect other sensitive categories of personal data (e.g., financial account numbers, Social Security numbers) through Holly.

3.  How We Use Your Data

We use your data to:

• Provide and improve the Holly scheduling and workforce operations platform

• Communicate shift information, confirmations, and updates via WhatsApp, SMS, or other supported channels

• Support your employer’s workforce management operations

• Train and improve our AI systems using aggregated, anonymized data that cannot identify you individually

We do not sell your personal data to third parties.

4.  Data Sharing

We may share your data with:

• Your employer (our direct customer), who controls how Holly is deployed within your workplace

• Service providers who support our infrastructure (e.g., hosting, messaging platforms such as Twilio and WhatsApp), under confidentiality and data processing obligations

• Legal authorities as required by law, including in response to valid legal process or regulatory requests

5. SMS and WhatsApp Messaging

Holly communicates with employees of our customer organizations via SMS, WhatsApp, and other supported messaging channels to coordinate shifts, schedules, and workforce operations.

Consent. Employees opt in to receive messages from Holly through their employer's onboarding process. By providing your mobile number to your employer for use with the Holly platform, you consent to receive workforce coordination messages from Holly.

Message Frequency. Message frequency varies based on shift activity and operational needs, and may include multiple messages per week.

Message and Data Rates. Message and data rates may apply. ShiftRx does not charge for messages, but your mobile carrier may charge for messages sent or received based on your plan.

Opt-Out. You can opt out of SMS messages at any time by replying STOP to any message from Holly. After replying STOP, you will receive a confirmation message and will not receive further SMS messages from Holly unless you opt back in by replying START or contacting your employer. Opting out of SMS will not affect your employment or your access to other services.

Help. Reply HELP to any message from Holly to receive support contact information.

Mobile Information Non-Sharing. Mobile phone numbers and SMS consent information collected for Holly messaging are not shared, sold, rented, or transferred to third parties for marketing or promotional purposes. We share mobile information only with service providers (such as Twilio) strictly for the purpose of delivering messages on behalf of your employer, and as otherwise described in Section 4 (Data Sharing).

Supported Carriers. Carriers are not liable for delayed or undelivered messages.

6. Data Retention

We retain your personal data for as long as your employer maintains an active account with ShiftRx. Upon termination of our agreement with your employer, data is returned to the employer or deleted within 30 days, at the employer’s election.

We will keep personal data only for as long as is necessary to:

• Respond to questions, complaints, or claims made by you or on your behalf

• Demonstrate that we treated you fairly and in compliance with applicable law

• Fulfill records retention requirements under applicable law

When it is no longer necessary to retain personal data, we will delete or anonymize it. You may also request deletion of your individual data at any time (see Part 2 and Section 6).

7.  Your Rights & Data Deletion

You have the right to request access to, correction of, or deletion of your personal data at any time. To submit a request, please email support@shiftrx.io with the subject line “Data Deletion Request” or “Data Access Request.” We will respond within 30 days.

California residents have additional rights under the CCPA — please see Section 7. Residents of other states (including Colorado, Connecticut, Oregon, Texas, Utah, and Virginia) may also have rights under applicable state privacy laws; please contact us at support@shiftrx.io for more information.

8. California Privacy Rights (CCPA)

This section applies to individuals in California and is intended to satisfy ShiftRx’s obligations under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (CCPA/CPRA).

Personal Information We Collect

In the preceding 12 months, we have collected the following categories of personal information: