Privacy Policy

This app is for clinic volunteers and administrators — providers, medical assistants, and the people who build the schedule. It is not a patient-facing service.

Your name and account email address, plus any additional email addresses you choose for shift notifications. A mobile phone number is optional unless you choose a feature that needs it.

The clinic or clinics you belong to and your role at each.

Your shift assignments, whether you confirmed them, and any availability or time-off you choose to enter.

Whether you agreed to receive text messages about your shifts, the exact wording you were shown, and the date you agreed. Text messages are not switched on yet. The answer you give when you create your account is a preference we record for later, not an enrolment: nothing may be texted to you until you agree for a particular clinic, and that agreement covers only that clinic.

A notification token for each device you turn push notifications on for, along with that device’s platform and name, so we know where to send them. A token is removed when you turn notifications off for that device, when the device stops accepting them, and when you delete your account. It is not an advertising identifier and is never used as one.

No patient information of any kind. This app schedules staff. It does not touch medical records, appointments, or anything about the people the clinic treats.

No location tracking. The app does not know or record where you are.

No advertising identifiers, and no third-party analytics or advertising trackers.

The text message program is not running yet. It is waiting on the carrier registration that US business messaging requires, and until that clears no text message is sent to anyone, whatever they agreed to.

When it does start, the messages will be about the shifts you are scheduled for — reminders, changes, cancellations, and a notice when you are taken off a shift. Consent is per clinic: a clinic may text you only if you agreed to hear from that clinic, and agreeing for one enrols you at no other. Message frequency will vary with how often you are scheduled. Message and data rates may apply.

Reply STOP to any message to stop receiving them, and HELP for help. You can also ask us to stop at any time, before or after the program starts, by writing to whitetulip.clinic.md@gmail.com or by telling an administrator at your clinic.

We do not sell, rent, or share your phone number with anyone for marketing. Your number will go only to the messaging provider that delivers the message on our behalf, and to nobody else.

Mobile opt-in data and consent records are never shared with third parties for their own purposes.

Other volunteers at your clinic can see your name, your role, and which shifts you are on. They cannot see your email address or phone number.

Administrators at your clinic can see the same, plus whether you have confirmed each shift and any availability or days off you entered. The app does not show them your email address or phone number either — those are readable only by you.

Administrators at other clinics cannot see you at all. Clinics are kept entirely separate.

Expo, which delivers push notifications. It receives the device token and the message itself — the date, time and location of the shift — in order to hand it to Apple or Google for delivery. It acts on our instructions and may not use any of it for its own purposes.

Google Firebase hosts the app, stores its data, and handles sign-in. Data is stored in the United States. Firebase also sends the few account emails the app relies on, such as a password reset link.

Resend delivers our email reminders. It receives each email destination you choose and the message itself — the date, time and location of the shift.

When text messages start, a messaging provider will deliver them and will receive only the number and the message itself.

These providers act on our instructions. None of them may use your information for their own purposes.

We keep your account information for as long as you volunteer with a participating clinic.

If you delete your account, we remove your name, account email, notification email addresses, phone number, device tokens, and settings.

Two things survive deletion. We keep a record that you consented to text messages, containing a one-way hashed version of your phone number rather than the number itself, because federal telemarketing law requires consent and opt-out records to be retained for five years. We also keep the clinic’s own record of which shifts were staffed, with your identity replaced by an anonymous identifier.

You can see the account details we hold about you in Settings, and change or clear your availability and days off whenever you like. To correct your name, email address, or phone number, write to us and we will change it.

Under Notifications in the app, you choose whether we email you or send push notifications. You can add or remove email destinations, allow push on each device, remove registered devices, or turn either channel off. These changes do not alter your shifts.

You decide separately, for each clinic you belong to, whether that clinic may text you about your shifts there, and you can change your mind at any time by writing to us. Nothing is sent in the meantime, because the program has not started.

You can leave a clinic or delete your account entirely from the app.

Access is enforced on our servers, not merely hidden in the app. A person can only read the clinics they belong to, and only administrators can change a schedule.

Data is encrypted in transit and at rest by our hosting provider.

This app is for clinic volunteers and is not directed to children under 13. We do not knowingly collect information from them.

If we change this policy in a way that affects how we handle your information, we will tell you in the app before the change takes effect.

Questions about this policy, or about information we hold about you: whitetulip.clinic.md@gmail.com or (657) 246-6619.

Whitetulip Health Foundation Inc., 271 US-46 #H215, Fairfield, NJ 07004.