Privacy Policy

1. Information We Collect

We collect only the information reasonably necessary to provide scheduling and administrative functionality.

a. Personal Information

Depending on how you use the Service, we may collect:

• Name
• Email address
• Phone number (optional)
• Role and designation (for example, doctor, administrator, or department coordinator)
• Hospital or organization name
• Account identifiers and authentication information

If you choose to sign in or sign up using Google, we may receive information from your Google Account as described in Section 3 below.

b. Scheduling and Administrative Data

• Duty schedules and shift assignments
• Availability, preferences, and leave information
• Department or unit configuration data
• Information associated with scheduling, assignments, and administrative workflows

c. Technical Information

• Device type
• Operating system
• App version
• Log information such as IP address and timestamps
• Technical information relating to authentication, security, and service reliability

d. Cookies and Similar Technologies

We currently use only cookies that are strictly necessary to operate the Service, such as keeping you signed in and protecting against cross-site request forgery. We do not currently use cookies for analytics, advertising, or cross-site tracking. If we introduce optional cookies in the future, we will present a consent banner allowing you to accept or decline them before they are set, as required by applicable law. You can also control cookies through your browser settings.

2. Legal Basis for Processing (EU/UK Users)

Where the GDPR or UK GDPR applies, we process personal information on the following bases:

• Contract: to provide the Service you have signed up for (account creation, scheduling functionality).
• Legitimate interest: to secure the Service, diagnose technical issues, and improve usability.
• Consent: for optional features such as Google Calendar Sync, which you may withdraw at any time by disconnecting the feature.

3. Google Account and Google Sign-In Data

PlanMyRounds allows users to create and access their PlanMyRounds account using Google Sign-In.

When you choose to sign in or sign up with Google, PlanMyRounds may receive information made available by Google for authentication, such as:

• Your name
• Your email address
• Your Google Account identifier
• Basic profile information made available through the Google authentication process

We use this information to authenticate you, create and maintain your PlanMyRounds account, associate your Google sign-in with your PlanMyRounds account, and provide account and authentication functionality.

We do not use Google Account information for advertising or to build advertising profiles.

4. Google Calendar Data

PlanMyRounds provides an optional Google Calendar Sync feature that allows users to synchronize their PlanMyRounds duties with a Google Calendar. Google Calendar access is requested only when you choose to connect Google Calendar.

What Google Calendar access allows

When you connect Google Calendar, PlanMyRounds may create, update, and delete calendar events corresponding to your PlanMyRounds duties. For example:

• When a PMR duty is created or assigned to you, PlanMyRounds may create a corresponding Google Calendar event.
• When details of a PMR duty change, PlanMyRounds may update the corresponding Google Calendar event.
• When a PMR duty is cancelled, PlanMyRounds may delete the corresponding Google Calendar event.

PlanMyRounds does not use Google Calendar access to read or analyze unrelated calendar events, determine your personal availability, analyze your existing calendar to make scheduling recommendations, build a profile of your personal activities, provide advertising or targeted marketing, or sell or rent your Google Calendar data.

Calendar data and selected calendars

You may choose which Google Calendar should receive your PlanMyRounds duties where the Service provides that option. PlanMyRounds uses the calendar access granted by you only for the purpose of synchronizing your PlanMyRounds duties.

5. How We Use Information

We use information collected through the Service to:

• Create and manage user accounts
• Authenticate users
• Generate and manage duty rosters and schedules
• Enable coordination between doctors and administrators
• Synchronize PMR duties with a connected Google Calendar when you choose to use Calendar Sync
• Maintain, update, and delete corresponding calendar events when PMR duties change
• Provide customer support and respond to user requests
• Maintain the security and reliability of the Service
• Diagnose technical problems and improve performance and usability

We do not use your information for advertising or behavioral profiling.

6. Google User Data: Limited Use

PlanMyRounds' use of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. Information obtained through Google APIs is used only to provide the user-facing features described in this Privacy Policy.

We do not sell Google user data; use it for advertising; transfer it to advertising platforms or data brokers; use it to determine creditworthiness or for lending; or use it for purposes unrelated to the features for which you granted access.

7. Information We Do Not Collect

PlanMyRounds does not collect, process, or store patient data, medical records, clinical notes, diagnoses, treatments, prescriptions, or other patient health information. PlanMyRounds is not a clinical or medical decision-making tool. The scheduling information managed by PlanMyRounds relates to workforce scheduling and administrative operations, not clinical care.

We ask hospital administrators and users not to enter patient-identifying information into free-text fields such as shift notes or comments. If you believe patient information has inadvertently been entered into the Service, contact us using Section 15 below so we can assist with removal.

EMR and other system integrations: Where an institution enables an integration with its EMR or other internal system, that integration is limited to pushing or pulling duty, shift, and roster data. PlanMyRounds does not read, access, store, or otherwise process clinical or patient data through such integrations.

8. Data Sharing

We do not sell or rent user data.

We may share information with trusted service providers necessary to operate the Service, such as cloud hosting, database, authentication, infrastructure, security, and other technology providers. These providers process information only as necessary to provide services to PlanMyRounds and are bound by confidentiality and data-protection obligations.

Google user data is not shared with third parties except where necessary to provide the functionality you granted access to, for security purposes, or to comply with applicable law. We do not sell Google user data or transfer it to advertising platforms, data brokers, or other data monetization services.

Institutional customers: Hospitals and departments using PlanMyRounds may request a Data Processing Agreement (DPA) governing our handling of their staff's data. Contact us at the address in Section 15 to request one.

9. International and Cross-Border Data Transfers

Your information may be stored and processed in countries other than your own, including where our cloud hosting providers operate infrastructure. Where we transfer personal data across borders, we use appropriate safeguards, such as contractual protections with our service providers, and we comply with applicable cross-border transfer restrictions under Indian, EU/UK, and other relevant law. We do not transfer personal data to countries restricted by the Government of India under the DPDP Act.

10. Data Storage and Security

We use appropriate technical and organizational safeguards designed to protect information against unauthorized access, loss, misuse, alteration, or disclosure, including:

• Secure transmission of information
• Access controls and restricted access to production systems
• Secure storage of authentication and authorization information
• Monitoring and logging for security and operational purposes
• Reasonable measures to protect connected third-party account credentials and authorization information

Google OAuth credentials and authorization information used to maintain a connected Google Calendar are protected using appropriate security measures and used only to provide the requested Calendar Sync functionality.

No system is completely secure, but we take reasonable and industry-appropriate measures to protect the information we process.

11. Data Breach Notification

If we become aware of a personal data breach that poses a risk to your rights or a real risk of significant harm, we will notify affected users and, where legally required, the relevant regulator (including the Data Protection Board of India under the DPDP Act, the Office of the Privacy Commissioner of Canada under PIPEDA, or the applicable EU/UK supervisory authority) without undue delay and in accordance with applicable law.

12. Data Retention

We retain information only for as long as reasonably necessary to provide the Service, maintain an active account, comply with legal obligations, resolve disputes, enforce agreements, and maintain security. Where a specific retention period applies to a category of data (for example, authentication logs or calendar authorization tokens), we retain it only for the duration necessary to that purpose and delete or anonymize it afterward.

Google Calendar data: Information associated with a connected Google Calendar is retained only as necessary to provide the Calendar Sync functionality. When you disconnect Google Calendar, PlanMyRounds will stop using the connection for synchronization and will remove associated authorization information in accordance with our retention procedures. Calendar events previously created in your Google Calendar may remain there after disconnecting unless separately deleted through the Service or Google Calendar directly. When a PMR duty is cancelled, PlanMyRounds may delete the corresponding Google Calendar event as part of the synchronization feature.

13. Your Rights

If you are located in India, as a Data Principal under the DPDP Act, you have the right to:

• Obtain a summary of the personal data we process about you and the processing activities carried out
• Request correction, completion, or updating of your personal data
• Request erasure of your personal data, subject to legitimate retention requirements
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity
• Lodge a grievance with us, and if unresolved, with the Data Protection Board of India

If you are located in Canada, under PIPEDA you have the right to access your personal information, challenge its accuracy, and request correction. You may also file a complaint with the Office of the Privacy Commissioner of Canada if you believe we have not handled your information appropriately.

If you are located in the EU/UK, under GDPR/UK GDPR you have the right to access, correct, erase, restrict, or port your personal data, object to certain processing, and withdraw consent at any time. You may lodge a complaint with your local supervisory authority.

If you are a California resident, we do not sell or share your personal information for cross-context behavioral advertising. You have the right to know what categories of personal information we collect and disclose (see Section 1), and to request deletion of your information.

To exercise any of these rights, contact us using Section 15 below.

14. Account Deletion and Data Removal

You may request deletion of your PlanMyRounds account and associated data at any time. For detailed instructions, visit the PlanMyRounds Account Deletion page.

When an account deletion request is processed:

• Account access is disabled
• Personal information is deleted or anonymized within a reasonable timeframe
• Scheduling and administrative data associated with the account is deleted or anonymized, subject to legitimate retention requirements
• Stored authorization information associated with connected third-party services is removed in accordance with our retention and deletion procedures

Some information may be retained where necessary to comply with legal obligations, resolve disputes, prevent fraud or abuse, or maintain security.

15. Grievance Officer and Privacy Contact

In accordance with the DPDP Act, 2023, and to serve as the accountable contact for privacy matters under PIPEDA and GDPR, we have designated the following individual as our Grievance Officer and Privacy Contact:

Sunil Nakka, Founder
Email: sunil@planmyrounds.com

You may contact the Grievance Officer with any questions or complaints about this Privacy Policy, our data practices, Google Account or Google Calendar integration, or to exercise any of the rights described in Section 13. We will acknowledge and respond to requests within the timeframes required by applicable law.

16. Disconnecting Google Calendar

You may disconnect Google Calendar from PlanMyRounds at any time through the Calendar Sync settings in the Service. When you disconnect:

• PlanMyRounds will no longer use the Google Calendar connection to synchronize your PMR duties
• Associated Google authorization information will be removed in accordance with our retention procedures
• Future PMR duty changes will no longer be synchronized to Google Calendar

You may also revoke PlanMyRounds' access through your Google Account's security and third-party application settings. Disconnecting or revoking access does not necessarily delete calendar events previously created by PlanMyRounds; those events may need to be deleted separately through PlanMyRounds or Google Calendar.

17. Children's Privacy

PlanMyRounds is intended for professional use and is not designed for individuals under 18 years of age. We do not knowingly collect personal information from children under 18.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the Service, our data practices, or applicable legal and regulatory requirements. When we make changes, we will post the updated Privacy Policy on this page and update the "Last updated" date.

19. Contact Us

If you have questions about this Privacy Policy, our data practices, Google Account or Google Calendar integration, or your rights regarding your information, please contact us at:

support@planmyrounds.com
or sunil@planmyrounds.com (Grievance Officer / Privacy Contact)