Your privacy,
handled with care.

01Who we are

ShiftNua is operated by RetailX Ireland Ltd, trading as ShiftNua Technologies, a company registered in Ireland (company number 792326), with its registered office at 27 Effernock Lane, Trim, Co. Meath, C15 W5XH, Ireland (“ShiftNua”, “we”, “us”).

We are the data controller for the personal data described in this policy, which applies to our website (shiftnua.com), the ShiftNua mobile and web applications, and our related services (together, the “Services”).

02Information we collect

Information you give us

• Account details: name, email address, phone number, password (stored only as a secure hash), profile photo and your role (facility or healthcare professional).
• Healthcare professionals: date of birth, profession, qualifications, professional registration details (for example NMBI or another nursing council), years of experience, employment history, availability, preferred locations, home city and country, and documents you upload such as photo ID, registration certificates, training certificates and your CV.
• Facilities: organisation name, facility type, address and postal code, contact people, company registration details, licences and registration documents, billing contacts, purchase-order preferences and the GPS location of your work entrance.
• Shifts and work records: shifts posted, applications, offers, confirmations, ratings and reviews, timesheets, break records, overtime reasons, attendance disputes and messages exchanged through ShiftNua.
• Support: anything you send us by email or through the app.

Information collected automatically

• Location at check-in and check-out: when a professional checks in or finishes a shift, the app reads the device’s precise GPS position once to confirm they are at the facility. We do not track location in the background.
• Device and usage data: device type, operating system, app version, push-notification token, IP address, log and security events (for example sign-in attempts).
• Website: the website stores your light/dark theme choice in your browser’s local storage. We do not use advertising or tracking cookies.

Information from others

• Stripe tells us the status of payments, invoices and payout accounts (for example “paid”, “payouts enabled”), but not your full card or bank numbers.
• Facilities and professionals provide information about each other, such as timesheet approvals and ratings.
• Public registers: we may check professional registers (such as the NMBI register) to verify registration.

03How we use your information

We use personal data only for the purposes below, each with a lawful basis under the EU General Data Protection Regulation (GDPR):

Identity documents and professional registration details are used for verification and safety only. We do not use automated decision-making that produces legal effects without human review — account approvals are made by our team.

04Who we share it with

• Facilities and professionals on ShiftNua: when you apply for or are offered a shift, the facility sees your profile, qualifications, ratings and CV. Your phone number is shared only once a placement is confirmed. Professionals see facility details, shift details and the work location.
• Stripe (payments, invoicing, worker payout accounts) — Stripe also acts as an independent controller for its own verification and anti-money-laundering checks.
• Google Firebase (push notifications) and Google Maps Platform (maps, address search, directions).
• Resend (sending service emails such as verification codes).
• Cloudflare and our hosting providers (secure network delivery, hosting and storage).
• Professional advisers (accountants, lawyers, auditors) and authorities where required by law, or to protect the safety of patients, users or the public.

Our service providers process data only on our instructions under data-processing agreements. We never sell personal data or share it for third-party advertising.

05International transfers

Some of our providers are based, or have support teams, outside the European Economic Area (for example in the United States). Where data leaves the EEA we rely on an adequacy decision (such as the EU–U.S. Data Privacy Framework) or the European Commission’s Standard Contractual Clauses, together with additional safeguards where needed.

06How long we keep it

• Account and profile data: while your account is open, and up to 2 years after closure in case of disputes.
• Verification documents: while you are active on ShiftNua and up to 2 years afterwards, unless a longer period is legally required.
• Timesheets, invoices, payment and payout records: 6 years after the end of the financial year they relate to, as required by Irish tax and company law.
• GPS check-in points: kept with the related timesheet; we keep only the check-in/out record, not a location history.
• Security logs: up to 12 months.

When data is no longer needed we delete or anonymise it.

07How we protect it

We use encryption in transit (HTTPS/TLS), hashed passwords, short-lived sign-in tokens, role-based access, rate limiting, audit logs and private storage for uploaded documents, which are available only to the account owner and authorised ShiftNua reviewers. No system is perfectly secure; if a breach affects your rights we will notify you and the Data Protection Commission as required by law.

08Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate or incomplete data (much of it you can edit in the app);
• erase your data, subject to legal record-keeping duties;
• restrict or object to processing based on our legitimate interests;
• data portability — receive data you gave us in a machine-readable format;
• withdraw consent at any time where we rely on consent.

To use these rights email [email protected]. We reply within one month. You also have the right to complain to the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland — www.dataprotection.ie.

09Age requirement

ShiftNua is for adults only. Healthcare professionals must be at least 18 years old, and we verify age using photo ID. We do not knowingly collect data from children.

10App permissions

• Location (while using the app): to confirm you are at the facility when checking in or out, and to show directions. You can refuse, but verified check-in will not work.
• Notifications: to alert you to new shifts, offers, messages and payments. You can turn them off in your device settings.
• Photos / files: only when you choose a document or profile photo to upload.

11Changes to this policy

We may update this policy as ShiftNua develops. We will show the new date at the top of this page and, for significant changes, notify you in the app or by email before they take effect.

12Contact us