Privacy Policy

Shift Medical Limited (NZBN 9429053812056) (“Shift Medical”, “we”, “us”) operates shiftmedical.co.nz and the Shift iPhone app, a platform connecting healthcare practices with doctors and nurses for locum and permanent work. We are committed to protecting your privacy in accordance with the Privacy Act 2020 (NZ).

1. Who this policy covers

This policy applies to practice users (practice managers and staff), clinician users (doctors and nurses), and visitors to our website. It covers the website and the Shift iPhone app.

2. What we collect

Clinicians: name, mobile number and email address; date of birth; your home suburb (not a street address) and the regions you want to work in; professional registration details (e.g. MCNZ or Nursing Council registration number, annual practising certificate and its expiry date); qualifications, scope of practice, skills and work history; indemnity details; your rates and availability; bank account and GST number for invoicing; and profile information you choose to provide, including a profile photo.

Clinician documents: the documents you upload for verification, such as your annual practising certificate, indemnity certificate, photo ID, resuscitation certificate and CV. A nurse may also upload evidence of union membership where the union provides their indemnity cover.

Date of birth and union membership: your date of birth is used only to match you to the professional register. Neither your date of birth nor a union membership document is shown to practices.

Referees: the name, role, organisation and contact details of the referees you give us. Please make sure your referees know you have given us their details.

Practices: practice name, address, contact details, staff user details, shift and roster information, and billing details.

All users: account credentials, messages sent through the platform, your notification choices, and records of platform activity (shifts and positions posted, applied for, and completed).

Declarations and signatures: when you accept our terms, make a fitness to practise declaration, or sign a document on Shift, we keep a record of it: what you agreed to, the time, your typed name, your drawn signature if you add one, and the IP address and browser or device details used. We keep the signed copy of the document.

Competition entrants: where we run a prize draw or competition, we collect the name, email address, role and region you give us on the entry form, together with a record of your consent and the time you gave it. We use this to administer the draw and to contact the winner. We keep entries for 12 months after the draw closes and then delete them.

We do not collect or store patient health information. Any clinical records remain within the practice’s own systems.

3. How we use your information

• To operate the platform: matching, shift and position posting, applications, messaging, document signing, notifications, and invoicing.
• To verify clinician credentials. Verification status and relevant professional details are visible to practices you engage with (see section 5).
• To send the notifications you have chosen: in the app or your browser, by email, and by text message where you have turned that on.
• To communicate service updates and support responses.
• If you opt in, to send you occasional Shift news and product updates. You can opt out at any time.
• To improve the platform.

We do not sell personal information. We do not share your information with third parties except as described in this policy or with your consent.

4. Credential verification

By registering as a clinician you authorise us to verify your professional registration against publicly available registers (e.g. the Medical Council of New Zealand and Nursing Council of New Zealand registers).

5. What practices can see

Your professional profile: practices you apply to, message or work with can see your professional profile (such as your name, role, scope, qualifications and experience), your verification status, and the type, status and expiry date of your verified credentials.

Copies of your documents: where document sharing is available, and unless you turn off “Share key credentials automatically” in your settings, a practice can download copies of your annual practising certificate, resuscitation certificate and indemnity certificate from the first time you apply for its work or message it. We tell you when this happens. Your photo ID and CV are shared with a practice only if you choose to share them with that practice. You can withdraw a practice’s access at any time. A copy the practice has already downloaded stays with that practice, which is responsible for it under the Privacy Act 2020. We keep a record of every download.

Referees: a referee’s contact details are shown to practices only where you have confirmed that the referee agrees to be contacted.

Calendar links: if you subscribe to your Shift bookings from a calendar app, that app fetches them through a private link. Anyone who has the link can see those bookings, so keep it to yourself.

6. Where your data is stored and who helps us run Shift

Platform data is hosted with Supabase in Sydney, Australia. Our website is hosted on Vercel (Vercel Inc.). Email is delivered by Google Workspace (Google LLC) and by Resend (Resend, Inc., which delivers via Amazon Web Services).

We also use:

• Sentry (Functional Software, Inc.), hosted in Germany, for website error reports. Form contents, email addresses and document links are removed before a report is sent, and a report identifies you only by an internal account number.
• Twilio (Twilio Inc.) to send text messages, where you have turned text alerts on.
• Apple (Apple Inc.) to deliver notifications to the iPhone app and to show maps in the app, and your browser’s own notification service if you turn on browser notifications.
• Anthropic (Anthropic, PBC) to answer questions you put to Ask Shift, our help assistant, where it is available. We send your question and the page you are on, not your name, email address or account records. Please do not put patient details in a question.
• OpenFreeMap for the map on our website and Google Fonts (Google LLC) for typefaces. Your browser fetches these directly, so those services receive your IP address.

These providers may process data outside New Zealand; we take reasonable steps to ensure comparable safeguards apply as required by the Privacy Act 2020.

7. The Shift iPhone app

The app handles the same information as the website, and the following as well.

• Notifications: if you turn notifications on, we store a token that identifies your iPhone so that we can send them. We delete it when you sign out, when your account is deleted, or when Apple tells us it is no longer valid. A notification from the app never contains the text of a message. Your iPhone’s Show Previews setting controls what appears on your lock screen.
• Face ID: the app lock is optional and is off unless you turn it on. Your iPhone does the matching. Shift never receives your face or fingerprint data.
• Location: if you allow it, the app uses your location while you are using it, to centre the map on you and to estimate drive times. This happens on your iPhone. We do not receive or store your location.
• Camera and photos: used only when you choose to photograph or pick a document or a profile photo. The app receives only the image you choose.
• Calendar: when you ask the app to add a booked shift to your calendar, it adds that event. The app cannot read your calendar.

8. Cookies, usage records and IP addresses

We use only essential cookies required for login and platform function. We do not use third-party advertising or tracking cookies, and we do not use third-party analytics services.

We keep our own records of how Shift is used, such as the steps reached during sign-up, how you arrived at Shift (for example from a campaign link), applications and bookings, and which job listings were shown to you. We use these to run and improve the platform and to tell a practice how many clinicians its listing reached. Practices see totals only.

We record IP addresses for a short period to limit automated abuse of our forms. We also keep the IP address and browser or device details with the record when you accept our terms, make a declaration, sign a document or enter a competition, as evidence of that action, for as long as we keep the record.

9. Retention and deleting your account

We keep personal information only as long as needed for the purposes above or as required by law. Shift and invoicing records are retained for 7 years in line with tax record-keeping requirements.

You can ask us to delete your account from the app (Delete my account) or by emailing privacy@shiftmedical.co.nz. We first check that nothing is still open, such as an upcoming booking or a disputed invoice, and then complete the deletion within 30 days.

When we delete an account we remove your profile details, documents, photo, availability, favourites, notification settings and sign-in. We keep invoices and the shifts they relate to, messages, signed documents, bookings and verification records, because they are also the practice’s records or the law requires us to keep them. On those records you appear as “Deleted account”, except on invoices and signed documents, which keep the details they were issued with.

10. Your rights

Under the Privacy Act 2020 you may request access to, and correction of, your personal information. Contact privacy@shiftmedical.co.nz. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner (privacy.org.nz).

11. Security

We use industry-standard measures including encrypted connections (HTTPS), role-based access controls, and row-level security on our database. No system is completely secure; notify us immediately of any suspected breach.

12. Contact

Privacy Officer, Shift Medical Limited, Christchurch, New Zealand. privacy@shiftmedical.co.nz