Legal

Privacy Policy

Effective date: September 29, 2026 · Last updated: September 29, 2026

MD Shift (“MD Shift,” “we,” “us,” or “our”) provides shift trading and on-call coverage tools for doctors and hospitals through our website at mdshift.net and our iOS app (together, the “Service”). This Privacy Policy explains what information we collect, how we use it, and the choices you have.

By creating an account or otherwise using the Service, you agree to this Policy. If you do not agree, please do not use the Service.

1. Who this applies to

• Real accounts — doctors, hospital staff, and admins who sign up or sign in. Account and scheduling data sync to our servers.
• Explore mode — optional sample data on your device so you can try the product before creating a live roster. Explore mode does not upload that sample data to our cloud.

2. Information we collect

Depending on how you use MD Shift, we may collect:

Account and contact information

• Name
• Email address
• Account credentials (passwords are handled by our auth provider; we do not store plaintext passwords)
• Sign-in provider identifiers if you use Google or Sign in with Apple

Professional and profile information

• Role (doctor or hospital)
• Specialty and credential type (for example MD / DO)
• National Provider Identifier (NPI)
• State license number and state, and DEA number, when you enter them
• Hospital or organization name and related profile fields

We do not collect uploads of credential documents (license scans, DEA certificates, malpractice certificates, or board certificates).

When you enter an NPI, the app and the website look that number up at the CMS NPI Registry (npiregistry.cms.hhs.gov). We store the NPI you entered and the name and specialty the registry returns, so we can compare them with what you typed. License numbers and DEA numbers are stored so our team can review them. We do not send those numbers to a license board or to a DEA registry.

Scheduling and product content

• Shifts, coverage requests, approvals, assignments, trades, and related status history
• Rates, rate floors, and related pay / scheduling settings you configure
• Roster and preference settings used to run coverage

Technical information

• Account / user IDs needed to operate the Service
• Basic device and browser information typical of secure web and app access (for example IP address in server logs)

We do not collect, for App Privacy purposes:

• Precise or coarse location
• Phone contacts / address book
• Advertising identifiers (IDFA) or advertising tracking profiles
• HealthKit or clinical health-record data
• Payment card numbers in the app (paid features, if enabled later, would use a payment provider)

Optional device features such as Face ID / Touch ID, when used to unlock the app, stay on your device and are not collected by MD Shift.

3. How we use information

• Provide, operate, and secure the Service (accounts, scheduling, trades, approvals)
• Check an NPI against the national registry, and hold license and DEA numbers for our team to review
• Send transactional email such as sign-up and email-change verification codes
• Respond to support requests you send us
• Improve reliability and fix issues
• Comply with law and protect against abuse or fraud

We do not sell your personal information. We do not use advertising or analytics SDKs today, and we do not use your data for cross-app tracking.

4. How we share information

We share information only as needed to run the Service:

• Within your coverage network — a hospital can see the name, credential, specialty, and verification status of doctors on its roster. Doctors who share a hospital or a trade can see that same limited card for each other. NPI, license number, DEA number, and email stay with the person who entered them and with MD Shift admins who review applications.
• Service providers that process data on our behalf, including:
  • Supabase — account hosting, authentication, and the database
  • Resend — sign-in and email-change messages (6-digit codes)
  • Apple and Google — only if you choose those sign-in options
  • Stripe — only if paid plans are turned on later. We would not store card numbers in the app. Paid plans are not on today.
  • esm.sh — the website loads its database library from this content network. That request can include your IP address and browser type. Your account data is sent to Supabase, not stored in that library file.
  • CMS NPI Registry — the NPI number you ask us to look up, as described above
• Legal / safety — if required by law, regulation, legal process, or to protect rights, safety, and security

5. Data retention

We retain account and scheduling information for as long as your account is active and as needed to provide the Service, resolve disputes, enforce agreements, and meet legal obligations. You may ask us to delete your account, or to send you a copy of it, by emailing erdunn706@gmail.com. We will delete the account data we host unless we have to keep a record to meet a legal duty or to finish a dispute.

6. Security

We use industry-standard safeguards appropriate to a cloud-hosted application, including encrypted transport (HTTPS), access controls, and authentication features such as email verification codes and optional authenticator-based multi-factor authentication. No method of transmission or storage is 100% secure; please use a strong unique password and protect your devices.

7. Your choices and rights

• Access or update profile information in the app or website
• Enable or disable optional MFA where available
• Request account deletion or a copy of your data by contacting us
• Leave Explore at any time (sample data remains local)

Depending on where you live, you may have additional rights under applicable privacy laws (for example access, correction, deletion, or portability). To exercise those rights, contact us using the email below.

8. Children’s privacy

MD Shift is designed for licensed clinicians and healthcare organizations. It is not directed to children under 13 (or the age required by local law), and we do not knowingly collect personal information from children.

9. International users

We may process information in the United States and other countries where our providers operate. If you use the Service from another country, you understand that your information may be transferred to and processed in those locations.

10. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated version at this URL and revise the “Last updated” date. Continued use of the Service after changes become effective constitutes acceptance of the updated Policy.

11. Contact

Questions about privacy or this Policy:
erdunn706@gmail.com
MD Shift · https://mdshift.net

This page is provided for transparency with users and app stores. It is not legal advice. If your organization needs a custom BAA or enterprise terms, contact us before sharing protected health information beyond what this product is designed to handle.