Privacy Policy

Draft for attorney review. This document has not been reviewed by a lawyer and is not legal advice. Bracketed items such as [Company Legal Name] are placeholders to be completed before publication.

Last updated: October 25, 2026

This Privacy Policy explains how [Company Legal Name] ("Rota", "we", "us") handles personal information in the Rota residency scheduling service (the "Service"). Rota is used by hospitals, universities and residency programs (each an "Institution") to publish call and shift schedules, handle swaps and time-off requests, and generate schedules.

1. Our role: the Institution controls the data

Rota provides the Service to Institutions under an agreement (the "Customer Agreement"). For the schedule and roster data in the Service, the Institution is the controller (it decides why and how the data is used) and Rota is a service provider or processor acting on the Institution's instructions. If you are a resident, fellow, chief or coordinator, your Institution decides who can see your information and how long it is kept. Questions about your Institution's use of the Service should go to your program or GME office; we will help them answer.

Rota acts on its own behalf only for a small amount of account and operational data (for example, sign-in records, security logs and support messages), described below.

2. Information we handle

Category	Examples	Source
Account and roster data	Name, work email address, role (resident, chief, admin, viewer), PGY level, program tags, whether the person is active	The Institution (chief or coordinator) or the person when they sign in
Schedule data	Shift and call assignments, services, shift types, published and draft schedules	The Institution
Requests	Swap and coverage requests, the people involved, status history, optional notes	Residents and chiefs
Time off	Type (PTO or sick), start and end dates, and an optional free-text reason	Residents and chiefs
Scheduling preferences	Days a person would like off, shifts they want or want to avoid	Residents
Notifications	In-app and email notifications about requests and schedules, and whether email was delivered	Generated by the Service
Calendar feed tokens	A random secret that lets a personal calendar app subscribe to your shifts	Generated by the Service
Technical and security data	Sign-in times, IP address and browser information in hosting and authentication logs, rate-limit records for sign-in links	Generated by the Service and our hosting providers
Support and feedback	Messages you send us or submit in the app	You

What we do not want in Rota: the Service is not designed to hold patient information or medical records. Do not enter patient names, medical record numbers, diagnoses or any other patient information in notes or reasons. You do not need to give a medical reason for a sick call; "sick" is enough. See our HIPAA position below.

3. How we use information

We use personal information to:

provide the Service: show schedules, route requests to the right people, apply approved changes, generate schedule options and send notifications;
authenticate users and keep the Service secure (for example, rate-limiting sign-in links and investigating misuse);
provide support and respond to the Institution's instructions;
produce aggregate, de-identified reports for the Institution (for example, how quickly swaps are resolved, or how evenly call is distributed);
improve the Service using aggregated or de-identified usage information;
comply with law and enforce our agreements.

We do not sell personal information, use it for targeted advertising, or share it with data brokers. We do not use customer data to train third-party AI models.

4. Who can see your information inside Rota

Access is enforced in the database (row-level security), not only in the app:

Everyone on your program roster can see the published schedule, the roster (names, roles, PGY) and who is away on which dates.
Only you, the other person in a swap, and your program's chiefs can see a swap or coverage request and its notes.
Only you and your program's chiefs can see a time-off request and its reason.
Only you and your chiefs can see your scheduling preferences.
Chiefs and program admins can see draft schedules and manage the roster.
Rota platform staff can see program-level counts and chief contact details needed to set up programs. Rota staff access other data only to provide support, at the Institution's request, or for security and legal reasons.

5. Service providers (subprocessors)

We use a small number of providers to run the Service. They process data only to provide their services to us, under their data protection terms. The current list, with locations and links, is in our subprocessor list and includes Vercel (application hosting), Supabase (database and authentication) and Resend (email delivery). Data is hosted in the United States.

We may also disclose information if required by law, to protect the rights and safety of users or the public, or as part of a merger or acquisition (subject to this policy).

6. Cookies

Rota uses only cookies needed to run the Service: a sign-in session cookie and a cookie that remembers which program you last selected. We do not use advertising or cross-site tracking cookies.

7. Retention and deletion

Data is kept for as long as the Institution's Customer Agreement is in effect, unless the Institution deletes it sooner.
When the agreement ends, the Institution can export its data. We delete customer data within [30] days after the end of the export period, except where law requires us to keep it. Backups expire on their normal cycle (currently up to [7] days after deletion once daily backups are enabled).
Sign-in rate-limit records are deleted after 1 day. Hosting and authentication logs are kept for the providers' standard log retention periods.
If you leave your program, your chief can deactivate you. Your past shifts stay in the program's schedule history, which the Institution controls.

8. Security

We use encryption in transit (HTTPS/TLS) and our providers encrypt data at rest (AES-256). Access is limited by role and enforced in the database. Sign-in uses one-time email links. See the Data & Security Summary for details, including current limitations.

9. Your choices and rights

You can turn off email notifications on your My account page (in-app notifications continue).
You can reset your calendar feed link at any time, which disconnects old subscriptions.
Depending on where you live, you may have rights to access, correct, delete or receive a copy of your personal information. Because the Institution controls roster and schedule data, we will usually pass your request to your Institution and help them respond. You can contact us at [Contact Email].
We will not discriminate against you for exercising your rights.

10. HIPAA

Rota is a workforce scheduling tool. Schedules, time-off records and swap requests are kept by the Institution in its role as an employer and training sponsor, and are generally not "protected health information" under HIPAA. Rota is not designed to receive patient information and does not sign Business Associate Agreements for the current Service. Users must not enter patient information into the Service.

11. Children

The Service is for working professionals and is not directed to children under 16.

12. International users

The Service is hosted in the United States and intended for U.S. Institutions.

13. Changes

We will post updates here and change the "Last updated" date. If changes are material, we will notify Institutions in advance.

14. Contact

[Company Legal Name], [Address]. Email: [Contact Email].