Staff Schedule — Privacy Policy

1. About this policy

Staff Schedule is an internal workforce app for staff of [Midco Care] to view their rota, see published unallocated shifts, and request shifts. This policy explains what personal data the app processes, why, and your rights. It applies only to the Staff Schedule mobile app; our general website privacy policy covers other services.

2. Who can use the app

The app is for our employees and engaged care workers only. It is not intended for children or members of the public. Access requires a valid work or registered email address and a one-time login code.

3. What we collect and process

• Email address — to sign you in via a one-time passcode (OTP) and to send shift-related notifications.
• Name — your name as held in our staffing records, shown in the app.
• Shift and scheduling data — your assigned shifts, shift requests you submit, and their status.
• Push notification token — a Firebase Cloud Messaging (FCM) token so we can send you notifications about shifts and request outcomes.
• Authentication token — after sign-in, a secure login token is stored on your device's encrypted storage so you stay signed in. It is not shared with third parties.
• Basic technical/diagnostic data — limited information needed to operate the service reliably (e.g. app version, server request logs).

The app does not collect your location, contacts, photos, microphone, or advertising identifiers, and contains no advertising.

4. Why we process it (purposes & lawful basis)

We process this data to authenticate you, show your rota, let you request shifts, and notify you of changes. Under UK GDPR our lawful bases are performance of your employment/engagement contract and our legitimate interests in operating an efficient staff scheduling service. Login-code emails are sent to operate the authentication you request.

5. Who we share it with (processors)

We do not sell your data. We share it only with service providers who process it on our behalf:

• Google (Firebase Cloud Messaging) — to deliver push notifications.
• Microsoft (Microsoft Graph) — to send your one-time login-code emails.
• Our hosting infrastructure — the app's backend and database are operated for us at rota.midco-care.co.uk.

These providers may process data outside the UK; where they do, appropriate safeguards (e.g. UK/EU standard contractual clauses) apply.

6. Storage and security

Data is transmitted over encrypted connections (HTTPS). The on-device login token is held in your device's secure storage. Server-side data is access-controlled and held on our managed infrastructure.

7. Retention

We keep your scheduling data for as long as you are an active member of staff and as required for our records. When your account is deactivated, your device registration and login codes are removed and your access is revoked. We retain other records only as long as necessary for legal and operational purposes.

8. Account and data deletion

To request access to, correction of, or deletion of your personal data — or removal of your app account — contact [support@midco-care.co.uk]. When you leave or are made inactive, your app access and device/login data are removed automatically.

9. Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict, or object to processing of your personal data, and to data portability. To exercise these, contact us at [support@midco-care.co.uk]. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

10. Changes

We may update this policy; and, where appropriate, notify staff.

11. Contact

Midco Care — [support@midco-care.co.uk]