1. Scope of This Privacy Policy

This Privacy Policy applies when you use BeeShift’s website, mobile applications, caregiver and provider portals, communications, verification workflows, and on-demand shift coverage services (collectively, the “Platform”).

BeeShift serves caregivers, care providers, facilities, prospective users, partners, and website visitors. This Policy applies to personal information BeeShift controls. Information independently collected or controlled by a care provider, government agency, credentialing source, background-check service, payment processor, or other third party may also be subject to that organization’s own privacy practices.

2. Information We Collect

• Account and contact information: name, email address, telephone number, mailing address, login credentials, role, account preferences, and related account information.
• Provider information: facility or business name, service locations, authorized users, operational contacts, shift requirements, facility-readiness information, and information necessary to administer provider accounts and coordinate coverage.
• Caregiver profile information: work history, experience, professional role, availability, work preferences, travel preferences, service areas, profile information, and information relevant to shift eligibility and matching.
• Credentials and qualification information: professional licenses, registrations or certifications, including HCA, CNA, NAR, LPN, RN or other applicable credentials; CPR and First Aid documentation; training records; Nurse Delegation or other qualification information where applicable; expiration dates; TB or other required screening documentation; and verification status.
• Identity and sensitive identification information: BeeShift may collect identity-verification information and, where required for an authorized verification, screening, tax, regulatory, or compliance purpose, government-issued identifiers such as a Social Security number, taxpayer identification number, driver’s license information, or other identification information. BeeShift limits the use and disclosure of this information to legitimate business, verification, compliance, security, and legal purposes.
• Background-check and eligibility information: information necessary to request, conduct, document, or verify required background checks and eligibility through authorized government systems, screening services, or other lawful sources. Depending on the applicable process, BeeShift may receive verification status, eligibility information, dates, identifiers, or other information BeeShift is legally authorized to receive and maintain.
• Shift and Platform activity: shifts posted, shift responses and acceptance, status changes, cancellations, replacement activity, timestamps, Smart Check-In/Out records, arrival and completion confirmations, hours or shift records, support activity, and other records generated through use of the Platform.
• Location information: when permission is granted or a Platform feature requires it, BeeShift may process approximate or precise location information for Smart Match™, travel-distance calculations, nearby shift recommendations, navigation or arrival functions, Smart Check-In/Out, shift coordination, fraud prevention, safety, and other location-dependent Platform features.
• Facility and shift-readiness information: information provided by a provider to help an authorized caregiver prepare for a shift, which may include entry and parking instructions, emergency procedures and contacts, documentation workflows, shift-change procedures, meal routines, medication-process instructions, house rules, safety information, and other shift-critical instructions.
• Resident-related shift information: after an authorized caregiver accepts or is assigned to a shift, the Platform may make available limited information reasonably necessary to safely prepare for and perform that shift. Depending on the care setting and provider instructions, this may include mobility or transfer needs, diet or allergy information, ADL assistance needs, communication or behavioral considerations, fall-risk information, toileting routines, or other relevant care instructions. Providers are responsible for entering and sharing this information lawfully and only through Platform areas designed and authorized for that purpose.
• Payment and transaction information: Platform fees, transaction status, payment identifiers, receipts, refunds, payout or payment-related records, and related transaction information. Payment-card information may be collected and processed directly by BeeShift’s payment processor rather than stored by BeeShift.
• Device and usage information: IP address, browser type, device type, operating system, application or website activity, log information, cookies, diagnostic information, and similar technical information.
• Communications: provider-caregiver messages, emails, text messages, support requests, feedback, notices, and other communications sent through or to BeeShift.

3. How We Collect Information

• Directly from you when you create or update an account, complete onboarding, submit a form, upload credentials or documents, post or accept a shift, complete a Pre-Shift Briefing, use Smart Check-In/Out, send a message, contact support, or otherwise use the Platform.
• From providers and other authorized Platform users when they create shifts, manage facilities, prepare Facility Readiness Profiles, provide shift instructions, document shift activity, or otherwise coordinate coverage.
• From government agencies, professional registries, credentialing sources, background-check systems, and other lawful sources used to verify identity, credentials, qualifications, or eligibility.
• From payment, communications, hosting, security, analytics, and other technology providers supporting BeeShift operations.
• Automatically from your browser, device, application, or interaction with the Platform.

4. How BeeShift Uses Information

• Create, authenticate, administer, and secure caregiver and provider accounts.
• Operate BeeShift’s on-demand caregiver shift coverage network and provide Platform features.
• Power Smart Match™ using relevant factors such as credentials, qualifications, availability, location, travel preferences, facility readiness, prior authorized shift experience, and work preferences.
• Verify identity, credentials, qualifications, background-check requirements, and continued eligibility for Platform access.
• Determine when verification requirements have been satisfied and when access to eligible shifts or protected Platform functions may be unlocked.
• Prepare caregivers for accepted shifts through Facility Readiness Profiles and Pre-Shift Briefings.
• Coordinate shifts and maintain time-stamped records of events such as posting, acceptance, On My Way status, arrival, check-in, check-out, cancellation, replacement, and completion.
• Enable authorized communications between providers and caregivers.
• Send Buzz alerts, shift notifications, account notices, verification reminders, safety notices, support messages, and other service communications.
• Process BeeShift fees and related transactions, maintain receipts and transaction records, prevent fraud, and resolve payment or account disputes.
• Provide customer support, investigate incidents, enforce Platform rules, and protect caregivers, providers, residents, BeeShift, and others.
• Maintain, troubleshoot, secure, analyze, and improve Platform performance, reliability, safety, matching, and user experience.
• Comply with applicable laws, licensing or registration requirements, regulatory obligations, lawful governmental requests, court orders, and legal processes.
• Create aggregated or de-identified information that does not reasonably identify an individual.

5. How We Disclose Information

BeeShift does not sell or rent personal information as part of its business model. BeeShift discloses personal information only when reasonably necessary to operate or secure the Platform, provide requested services, coordinate authorized shift coverage, comply with law, protect users or others, or as otherwise described in this Policy.

• Providers and caregivers: information reasonably necessary to evaluate, match, accept, coordinate, prepare for, perform, document, or support an authorized shift may be shared between relevant Platform participants.
• Verification and credentialing sources: information may be exchanged with government systems, professional registries, screening services, or other authorized sources when necessary to verify identity, credentials, background-check requirements, or eligibility.
• Service providers: vendors supporting website or application hosting, communications, payment processing, analytics, security, identity or credential verification, customer support, and other Platform operations may process information on BeeShift’s behalf or as otherwise permitted by law.
• Government and regulatory authorities: BeeShift may disclose information when necessary to satisfy licensing, registration, inspection, reporting, background-check, legal, or regulatory obligations.
• Legal and safety disclosures: BeeShift may disclose information when it reasonably believes disclosure is required by law, legal process, or regulatory obligation, or is reasonably necessary to protect rights, safety, security, or prevent fraud or abuse.
• Business transactions: information may be transferred in connection with a merger, financing, acquisition, reorganization, sale of assets, or similar business transaction, subject to applicable protections.
• At your direction: BeeShift may disclose information when you request, direct, or authorize the disclosure.

6. Verification, Background Checks, and Government Systems

BeeShift may use government systems, professional registries, credentialing sources, and authorized third-party services to support caregiver verification and background-check requirements. The particular sources and processes used may vary according to caregiver role, care setting, jurisdiction, and applicable law.

BeeShift verification may include identity, professional credentials, required training or certifications, background-check requirements, expiration dates, and other qualifications relevant to Platform eligibility. Completion of any single verification step does not necessarily mean that a caregiver has satisfied all BeeShift requirements.

Information submitted directly to a government agency or independent third-party service may also be governed by that organization’s privacy policy and legal requirements.

7. Verification Gating and Marketplace Privacy

BeeShift uses verification controls to protect providers, caregivers, residents, and sensitive facility information. Caregivers who have not completed required verification may have limited access to shift opportunities or Platform functions.

Where BeeShift provides a Marketplace Preview before full verification, the preview is designed to limit disclosure of sensitive provider and facility information. It may show general information such as city or service area, caregiver role, shift date and time, compensation or rate information, and generalized travel information. Provider or facility identity, street address, direct contact information, sensitive instructions, resident-related information, and other protected shift details may remain unavailable until applicable verification and authorization requirements are satisfied.

8. Location Data, Smart Match™, and Smart Check-In/Out

If you grant location permission, BeeShift may use location information to identify relevant shifts, estimate travel distance, rank opportunities, support Smart Match™, assist with shift coordination, and support location-dependent functions such as Smart Check-In/Out.

Location permission is not itself a professional credential or caregiver qualification. Where supported, caregivers who do not grant device location permission may be able to provide a city, ZIP code, service area, or preferred travel radius instead, although certain location-dependent features may be limited.

BeeShift may maintain time-stamped records associated with shift events such as acceptance, On My Way status, arrival, check-in, check-out, and completion to support shift documentation, safety, dispute resolution, compliance, and Platform integrity.

BeeShift does not use location information to infer sensitive personal characteristics unrelated to providing, securing, or administering the Platform.

9. Facility Readiness and Resident Information

BeeShift’s Facility Readiness Profile and Pre-Shift Briefing features are designed to help caregivers safely enter and work in unfamiliar care environments. Providers should include only information reasonably necessary to prepare an authorized caregiver for the applicable facility or shift.

Resident or patient medical information must not be placed in public Marketplace listings, open shift descriptions, general contact forms, profile fields, or other areas not specifically designed and authorized for protected shift information.

Where resident-related information is necessary for an accepted shift, BeeShift may restrict access based on account status, verification, shift acceptance or assignment, role, and other authorization controls. Access to information through the Platform does not authorize a user to copy, photograph, publish, disclose, or use that information for purposes unrelated to the authorized shift.

10. Washington Consumer Health Data

Washington’s My Health My Data Act, Chapter 19.373 RCW, regulates certain consumer health data that is not otherwise exempt from the Act. Depending on the information involved and the legal capacity in which BeeShift receives or processes it, certain information may require additional protections under Washington law.

Where the Washington My Health My Data Act applies to BeeShift and covered consumer health data, BeeShift will provide the notices, consents, rights, access restrictions, security protections, processor requirements, and other protections required by applicable law.

If BeeShift is required to maintain a Consumer Health Data Privacy Policy under Chapter 19.373 RCW, BeeShift will provide that policy as a separate and distinct notice as required by Washington law.

11. HIPAA and Health Information

BeeShift provides technology and services supporting on-demand caregiver shift coverage. Use of the Platform does not, by itself, determine whether BeeShift is a health care provider, health plan, HIPAA covered entity, or business associate. HIPAA obligations depend on the information involved, the parties’ relationships, the services being performed, and applicable law.

Providers are responsible for determining what resident or patient information they may lawfully enter into or disclose through the Platform. Where BeeShift enters into a Business Associate Agreement or other applicable data-protection agreement governing particular information or services, that agreement will govern the covered information to the extent applicable.

12. Sensitive Information and Social Security Numbers

BeeShift recognizes that Social Security numbers, taxpayer identification numbers, government identification numbers, background-check information, and similar identifiers require heightened protection.

BeeShift seeks to collect such information only when reasonably necessary for an authorized business, verification, screening, tax, regulatory, security, or legal purpose. BeeShift does not use Social Security numbers for public-facing profile identification, Marketplace display, advertising, or unrelated marketing purposes.

Access to sensitive identification information is limited according to operational need, authorization, applicable law, and the capabilities of the systems used to process that information. BeeShift may use authorized government systems or service providers to perform functions involving sensitive identification information.

13. Data Retention

BeeShift retains personal information for as long as reasonably necessary for the purposes described in this Policy, including maintaining accounts; documenting verification, screening, credential, shift, transaction, and communication history; satisfying licensing, regulatory, tax, insurance, or compliance requirements; resolving disputes; preventing fraud; enforcing agreements; and meeting legal obligations.

Retention periods vary according to the type of information, the purpose for which it was collected, applicable contractual requirements, and applicable law. Certain verification, screening, qualification, shift, or compliance records may be retained for legally required periods even after an account is closed or a user stops using the Platform.

BeeShift may retain aggregated or de-identified information where it no longer reasonably identifies an individual.

14. Security

BeeShift uses administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, acquisition, loss, misuse, alteration, or disclosure. Safeguards may include access controls, account authentication, infrastructure and hosting security controls, monitoring, software and security updates, vulnerability management, logging, and other measures appropriate to the information and systems involved.

BeeShift’s public website and Platform may rely on different technology providers and infrastructure. Security protections therefore vary according to the particular system, service, and information being processed.

No internet service, transmission method, or storage system can be guaranteed to be completely secure. Users are responsible for protecting their account credentials and should promptly notify BeeShift if they suspect unauthorized account access or misuse.

BeeShift will investigate security incidents and provide notifications to affected individuals, regulators, or others when required by applicable law.

15. Your Choices and Privacy Rights

You may request access to, correction of, or deletion of personal information BeeShift controls, subject to identity verification, legal exceptions, regulatory and record-retention obligations, security considerations, and the rights of others. Certain account information may also be updated directly through the Platform where those controls are available.

You may control certain device permissions, including location permissions, through your device settings. Disabling a permission may limit Platform features that depend on that information.

Washington residents may have additional rights under applicable Washington privacy laws, including rights relating to covered consumer health data where Chapter 19.373 RCW applies. BeeShift will not unlawfully discriminate against a person for exercising an applicable privacy right.

16. Cookies and Analytics

BeeShift may use cookies, local storage, analytics, diagnostic tools, and similar technologies to operate the Platform, remember preferences, understand usage, improve performance, troubleshoot problems, prevent fraud, and protect accounts. Browser or device settings may allow you to restrict certain technologies, although doing so may affect Platform functionality.

17. Children’s Privacy

BeeShift is designed for adult caregivers, care providers, business users, and other authorized adults. The Platform is not intended for use by children under 18 as caregivers or provider account holders.

BeeShift does not knowingly permit children under 13 to register for general Platform accounts. If BeeShift learns that personal information from a child was collected inappropriately, BeeShift will take reasonable steps to address the information as required by applicable law.

18. Changes to This Privacy Policy

BeeShift may update this Privacy Policy as the Platform grows, features change, operations evolve, or legal and regulatory requirements change. The effective date displayed at the top of this Policy will identify the current version.

Where required by applicable law, BeeShift will provide additional notice or obtain consent before materially different processing begins.

19. Contact BeeShift

Questions, privacy requests, or concerns about this Privacy Policy may be sent to info@beeshift.health