What we collect
Account sign-up: first name, email, healthcare role, metro, adult eligibility confirmation, consent, and referral or campaign source. Members may also provide date of birth, gender and dating preferences, general location, private healthcare affiliation, availability, photos, messages, and account settings. For institutional-email verification, we retain the approved domain, a masked address, and one-way fingerprints needed to validate the short-lived code—not the full work or school email address.
How it is used
We use account data to provide access, check eligibility, find reciprocal matches, apply privacy settings, operate messaging, prevent abuse, manage subscriptions, and send service updates. Profile photos are re-encoded to remove embedded metadata, then screened for explicit content and accidental patient, badge, schedule, document, screen, and workplace disclosures before public display. The screen stores a decision category rather than detected image text; it may make mistakes, and flagged photos stay private until replaced or resolved. Optional general marketing and NursingNotes student offers use separate consent scopes. Authorized growth staff can export only unsuppressed, consented contact fields such as name, account email, city, profession, lifecycle status, and campaign attribution; the export excludes dating preferences, workplace names, birth dates, precise location, photos, and messages. Public marketing pages use the Meta Pixel to measure a page view and a standard Website Lead event after a new account sign-up succeeds. It does not receive form answers or private member activity. We do not sell dating data or place advertising pixels on private member surfaces.
Who sees what
Eligible members see your first name, age, approved profile content, and selected general details. Employer records, full availability, email, date of birth, verification evidence, and private feedback are not profile fields. Staff access is role-limited and audited. Reported message evidence can be reviewed by the safety team.
Service providers
Hosting, verification, email, payment, and—when configured—automated photo-screening providers process the limited data needed for their function. A photo-screening provider receives a private uploaded photo only to return safety and privacy signals before display; it is not used for advertising or public profiling. Identity documents are handled by the verification provider. Card details are entered at Stripe, not stored by Between Shifts. Provider contracts, retention schedules, and international transfer disclosures must be finalized before launch.
Retention and deletion
You can export your own account data, pause discovery, or request deletion from Settings. Deletion removes profile data, photos, availability, likes, and message content attributable to the deleted account; narrowly necessary payment or safety records may be retained under the final approved retention policy. Manual evidence should be deleted within 30 days after review.
Your choices
General marketing and NursingNotes student offers can each be turned off. Turning off NursingNotes consent suppresses pending NursingNotes promotions, and requesting the benefit stops the introductory offer series. Availability is optional. Public employer display is not enabled. External integrations require opt-in. Contact us through the privacy request form to ask about access, correction, deletion, or an applicable privacy right.