Privacy notice

Only what we need to plan and pay for shifts:

• Your name, email address and (optional) phone number.
• Your job title and an optional profile photo you choose to upload.
• Your shifts, the availability you tell us, and shift confirmations/declines.
• App notifications and a record of key actions (audit log) for accountability.
• A “last seen” time so admins can see who is active — this is not location tracking.

We deliberately do not store National Insurance numbers, bank or payment details, identity or right-to-work documents, DBS certificates, health or medical data, or any information about care-home residents. We do not track your location. When you decline a shift we only keep a neutral category, never medical or personal reasons.

• Contract / legitimate interests: managing rotas, shifts and hours for our working relationship with you.
• Consent: your optional profile photo and optional email/sound notifications — you can withdraw these any time in the app.
• Legal obligation: keeping limited records where the law requires.

• Past availability marks: about 14 days, then automatically deleted.
• Draft shifts never published: about 30 days.
• In-app notifications: 90 days.
• Office audit trail (who changed what, and when): up to 6 years, as our business record.
• Your account, shift history and consent records: for as long as you work with us and a limited period afterwards for our legal and business records. When you leave, your access is removed promptly.

We use a small number of trusted providers, and store data in the UK/EU where possible:

• Kinde — secure login and identity.
• MongoDB Atlas — the app database (EU/Ireland region).
• Vercel — app hosting.
• Resend — sending you email notifications.
• cron-job.org — triggering scheduled reminders.

You can ask us to access, correct, delete or restrict your data, object to processing, or receive a copy to take elsewhere. You can update your name, phone, photo and notification settings yourself in the app. To exercise any right, contact us below.

Data protection queries: privacy@zanhealthcare.co.uk. General queries: hello@zanhealthcare.co.uk.

If you are unhappy with how we handle your data you can complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk. Our ICO registration: [ICO registration reference — add after paying the data-protection fee].