OvaShiftOvaShift
Log inGet started
Last updated: June 29, 2026

Privacy Policy

OvaShift is committed to protecting your personal information. This Policy explains what data we collect, how we use it, and your rights.

1. Who We Are

OvaShift Inc. is the data controller for personal data collected through the Platform. Our registered address is 528 Chelmsford Street, Floor 2, Lowell, MA 01851. Contact our Privacy Officer at privacy@ovashift.com.

2. Data We Collect

2.1 Information You Provide

  • Identity & contact: Full name, email address, phone number, date of birth, profile photo.
  • Professional credentials (Workers): Nursing license numbers, certification documents, state board verification data, background check results, I-9 employment eligibility documents, Social Security Number (for payroll and tax purposes).
  • Facility information: Organization name, NPI number, billing address, authorized representative details, tax identification number.
  • Payment information: Bank account details for ACH payroll (Workers); credit card or ACH details for billing (Facilities). Card data is processed by Stripe and never stored on our servers.
  • Communications: Messages you send through the Platform, support tickets, and survey responses.

2.2 Automatically Collected Data

  • Usage data: Pages visited, features used, shift activity, timestamps.
  • Device & log data: IP address, browser type, operating system, device identifiers.
  • Location data: GPS location during clock-in/clock-out events (with your permission).
  • Cookies & tracking: See our Cookie Policy.

3. How We Use Your Data

  • Platform operation: Matching Workers with Facilities, managing shift bookings, processing timesheets and payroll.
  • Credential verification: Verifying licenses with state nursing boards (Nursys), running background checks (Checkr), and confirming employment eligibility.
  • Payments: Processing payroll for Workers and invoicing Facilities via our payroll provider and Stripe.
  • Communications: Sending shift confirmations, alerts, payroll notices, and service updates via email, SMS, and push notifications.
  • Safety & compliance: Detecting fraud, investigating abuse, and complying with legal obligations.
  • Product improvement: Analyzing aggregated usage data to improve our matching algorithms and user experience.
  • Marketing: Sending promotional content only with your explicit consent (you can opt out at any time).

4. Legal Basis for Processing (GDPR)

If you are in the European Economic Area, we process your data on the following bases:

  • Contract performance: Processing necessary to fulfill our agreement with you (e.g., payroll, shift matching).
  • Legal obligation: Compliance with employment, tax, and healthcare regulations.
  • Legitimate interests: Fraud prevention, platform security, and service improvement.
  • Consent: Marketing communications and optional analytics.

5. Sharing Your Data

We share your data only as described below:

  • Facilities: Workers' names, professional credentials, ratings, and shift history are shared with Facilities for staffing decisions.
  • Workers: Facilities' names, addresses, ratings, and shift details are shared with Workers.
  • Payroll provider: Worker payroll data is shared with our embedded payroll infrastructure provider for payroll processing and tax filing.
  • Payment processor: Stripe processes payment card data under Stripe's own privacy policy.
  • Background check: Checkr processes background check data under Checkr's own privacy policy.
  • License verification: Nursys verifies nursing license data.
  • Communications providers: Twilio (SMS) and SendGrid (email) transmit notifications on our behalf.
  • Legal requirements: We may disclose data when required by law, court order, or to protect our legal rights.

We do not sell your personal data to third parties for advertising purposes.

6. Data Retention

  • Active account data is retained for as long as your account is open.
  • Payroll and tax records are retained for 7 years as required by IRS regulations.
  • Background check results are retained for the period required by state law (typically 7 years).
  • Shift and timesheet records are retained for 5 years.
  • After account closure, we retain only the minimum data required by law.

7. Your Rights

Depending on your jurisdiction, you may have the following rights:

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Request correction of inaccurate data.
  • Deletion: Request deletion of your data, subject to legal retention obligations.
  • Portability: Receive your data in a machine-readable format.
  • Opt-out of marketing: Unsubscribe from promotional communications at any time.
  • California residents (CCPA): You have the right to know, delete, opt-out of sale, and non-discrimination. We do not sell personal information.

To exercise any right, email privacy@ovashift.com. We will respond within 30 days.

8. Security

We use industry-standard security measures including TLS encryption in transit, AES-256 encryption at rest, access controls, and regular security audits. However, no system is completely secure. If we become aware of a data breach that affects your rights, we will notify you as required by law.

9. Children

The Platform is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe we have collected such data, please contact us immediately.

10. Changes

We may update this Policy periodically. We will notify you of material changes by email at least 14 days in advance. The latest version is always available at ovashift.com/legal/privacy.

11. Contact

Privacy Officer · OvaShift Inc. · privacy@ovashift.com · 528 Chelmsford Street, Floor 2, Lowell, MA 01851