1.  Who We Are

ShiftRx, Inc. is a Delaware corporation that provides Holly, an AI-powered scheduling and workforce operations platform, to healthcare organizations, restaurants, and other businesses. This Privacy Policy describes how we collect, use, and protect personal data in connection with Holly.

2.  Data We Collect

We collect information you provide directly or that is submitted on your behalf by your employer (our direct customer), including:

• Staff and employee contact information: full legal name, preferred name, phone number, email address, job title, and role responsibilities

• Scheduling data: shift preferences, availability, scheduling history, personal time-off requests

• Operational data: standard operating procedures, organizational preferences, scheduling rules, and operational constraints

• Communications: messages sent through WhatsApp, SMS, or other supported channels

Holly is a workforce scheduling and coordination platform. It is designed and scoped to avoid contact with protected health information (PHI) as defined under HIPAA. Holly does not collect clinical, diagnostic, or medical records data. We do not collect other sensitive categories of personal data (e.g., financial account numbers, Social Security numbers) through Holly.

3.  How We Use Your Data

We use your data to:

• Provide and improve the Holly scheduling and workforce operations platform

• Communicate shift information, confirmations, and updates via WhatsApp, SMS, or other supported channels

• Support your employer’s workforce management operations

• Train and improve our AI systems using aggregated, anonymized data that cannot identify you individually

We do not sell your personal data to third parties.

4.  Data Sharing

We may share your data with:

• Your employer (our direct customer), who controls how Holly is deployed within your workplace

• Service providers who support our infrastructure (e.g., hosting, messaging platforms such as Twilio and WhatsApp), under confidentiality and data processing obligations

• Legal authorities as required by law, including in response to valid legal process or regulatory requests

5.  Data Retention

We retain your personal data for as long as your employer maintains an active account with ShiftRx. Upon termination of our agreement with your employer, data is returned to the employer or deleted within 30 days, at the employer’s election.

We will keep personal data only for as long as is necessary to:

• Respond to questions, complaints, or claims made by you or on your behalf

• Demonstrate that we treated you fairly and in compliance with applicable law

• Fulfill records retention requirements under applicable law

When it is no longer necessary to retain personal data, we will delete or anonymize it. You may also request deletion of your individual data at any time (see Part 2 and Section 6).

6.  Your Rights & Data Deletion

You have the right to request access to, correction of, or deletion of your personal data at any time. To submit a request, please email support@shiftrx.io with the subject line “Data Deletion Request” or “Data Access Request.” We will respond within 30 days.

California residents have additional rights under the CCPA — please see Section 7. Residents of other states (including Colorado, Connecticut, Oregon, Texas, Utah, and Virginia) may also have rights under applicable state privacy laws; please contact us at support@shiftrx.io for more information.

7.  California Privacy Rights (CCPA)

This section applies to individuals in California and is intended to satisfy ShiftRx’s obligations under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (CCPA/CPRA).

Personal Information We Collect

In the preceding 12 months, we have collected the following categories of personal information: