StaffCare

Privacy Policy — StaffCare mobile app

Applies to the StaffCare employee check-in app for iOS and Android. Version 1.0 · Effective date: to be set on publication.

StaffCare is a workforce attendance app used by hospital staff. It is provided to you by your employer, not sold to you. This policy explains what the app handles, what leaves your phone, and what stays on it.

In short. The app records when you check in and out, and where you were at that moment. It shows you your own record and your team's roster. It has no advertising, no analytics, no tracking, and no access to your camera, photos, contacts or microphone. Your fingerprint or face is never sent anywhere.

Who is responsible for your data

Your hospital is the data controller. It decides what employee records exist, what they contain, and how long they are kept. StaffCare operates the software on the hospital's behalf as its processor.

This matters for your rights: requests to see, correct, export or delete your data go to your hospital's administrator, not to StaffCare. We cannot alter a hospital's records on an employee's instruction, because we have no way to verify an employment relationship we are not party to. If you contact us directly we will refer you to your hospital.

Your account — how access works

This is an organisation-managed workforce app, not a consumer social app. The account model differs from a typical app in ways worth stating plainly:

You cannot create an account in the app. Your hospital creates your record and issues your credentials.
You cannot delete your account in the app. Attendance and leave records are the hospital's employment records; an employee cannot unilaterally erase them, in the same way you cannot delete a signed timesheet.
You sign in with a Hospital Code, an Employee Code and a one-time Activation Code issued to you by your administrator. After that you set a numeric PIN, and may optionally enable your device's fingerprint or face unlock.
No email address and no password are used to sign in. There is no password field anywhere in the app, and no password reset flow in it.
Your hospital manages and revokes access. When employment ends, or access should be withdrawn for any other reason, your administrator deactivates the account through the web portal. This prevents any further sign-in or check-in from the app.

What the app sends off your device

Everything below goes to StaffCare's server so your hospital can maintain its attendance records. Nothing here is sold, and nothing is shared for advertising.

Identifiers and credentials

Your hospital code, employee code and — during first-time setup only — your one-time activation code.
Your numeric PIN, when you set it and each time you check in or out. The server verifies it.
A session token issued after sign-in.
A device identifier generated by the app — a random value created once on first launch. It is not your advertising ID, not your hardware serial, and not shared with anyone else. It is sent with every request so your hospital can tie a check-in to a registered handset and detect one account checking in from several phones.

Location

Your latitude, longitude and the reading's accuracy, captured only when you check in or out — at the moment you press the button, and in the geofence pre-check immediately before it.
Never in the background. The app requests only foreground location (When In Use on iOS, ACCESS_FINE_LOCATION and ACCESS_COARSE_LOCATION on Android). It does not request background location permission, and it holds no background location capability. Close the app and it collects nothing.
The phone never decides whether you are on site. It reports a position and the server applies the hospital's geofence.

Device integrity signals, sent with each check-in

Whether the operating system reports the location as mocked.
Whether the device appears rooted or jailbroken.
The GPS accuracy in metres, and the difference between your device clock and the time of the reading.

These exist to stop attendance fraud — a fake-GPS app reporting you at work from home. They describe the device's configuration, not you.

What you submit

Leave and permission requests: the type of leave, the dates and times, and an optional reason you type. Leave types include sick leave and maternity leave, so a request can reveal health-related information. Only submit what your hospital requires.
Shift-exchange requests: the colleague, the two dates, and an optional reason.
Which method you used to confirm your identity at check-in — face, fingerprint or PIN. This is a label only. See the biometrics section.

What the app shows you that you did not supply

The app displays information drawn from your hospital's records. You do not enter it and cannot change it in the app; your administrator maintains it. Because it is transmitted to your device and held there, it is covered here.

Your own record: your name, employee code, job title, department, work phone number, the email address your hospital holds for you, employment type, start date and role.
Your colleagues' names and departments, together with their rostered shift and lunch times and a live status such as "Working" or "On leave". This appears on the Today board and the team timetable, so that someone covering a ward knows who is on and when their cover breaks.

Deliberately not shown. A colleague's leave never says what kind it is — annual and sick both read simply as "On leave". Team views carry no pay, no contact details and no personal data beyond a name, a department and a rostered time.

What is stored on your phone

Held in the device's encrypted store — the Keychain on iOS, Keystore-backed storage on Android — and never written to ordinary app preferences:

Stored	Why	Cleared
Session token, employee code, employee ID, your name, your role	Keeps you signed in	On sign-out
Your check-in PIN	Lets the unlock screen and check-in work with no signal	On sign-out
Whether biometric unlock is on, and which method	Decides whether to offer face or fingerprint	On sign-out
Your hospital's ID, code, name, server address and brand colour	Returns you to the right hospital on next launch	Only when you switch hospitals
The device identifier	Keeps this handset's identity stable	On uninstall (iOS may retain it in the Keychain)
Check-ins made while offline, including their coordinates	So a check-in in a basement is not lost	Once synced; kept across sign-out until then
The most recent team timetable, including colleagues' names	So you can see your next shift with no signal	On sign-out

Your PIN is stored on the device whether or not you enable biometric unlock — it is the offline fallback, and clearing it would lock you out of your own app with no signal.

Face ID, Touch ID and fingerprint

Your biometric never leaves your phone, and StaffCare never receives it. Face and fingerprint data are held by iOS and Android in hardware the app cannot read. When you unlock with one, the operating system tells the app only whether the check succeeded — a yes or a no. That yes releases the PIN already stored on your device.

StaffCare stores no biometric template, transmits none, and could not reconstruct one. The only thing recorded on the server is a label saying whether you used face, fingerprint or PIN.

If your device has no enrolled biometric, or the check fails, the prompt falls back to your device passcode or to typing the PIN. Your passcode is likewise handled entirely by the operating system.

What the app does not do

No camera and no photo access. The app never takes or uploads a photograph, and requests no camera or photo-library permission. Staff photos are uploaded by administrators through the web dashboard.
No analytics or advertising SDK of any kind, and no advertising identifier.
No access to contacts, microphone, calendar, call logs or SMS.
No background location, and no background activity tracking.
No push notification service. Notifications are shown inside the app when you open it.
No sale of personal information, and no sharing for cross-context behavioural advertising.

Crash diagnostics

The app can report crashes to Sentry, but only if a reporting key is compiled into the build. Builds published to the App Store and Google Play carry no such key, so no crash data is transmitted at all. If that changes, this section is what changes with it.

Where crash reporting is enabled, it is configured to send:

No user identity and no IP address.
No screenshots, no view hierarchy and no session replay — any of which could capture a PIN pad or an activation code.
No tap-by-tap interaction breadcrumbs, and no performance tracing.
Error messages and stack traces with PINs, passwords, activation codes, reset codes and session tokens redacted before the report leaves the device.

Who else processes this data

Provider	Purpose	Where
Hetzner	Server and database hosting	Germany
Sentry	Crash diagnostics, only when a key is configured — not in current store builds	Per Sentry's terms
Object storage for encrypted backups	Disaster recovery	Set by the deployment

Email is not part of the app's data path. StaffCare uses Brevo to deliver password-reset messages for the web dashboard. The mobile app has no password and no reset flow, so using it never causes an email to be sent.

There are no other third parties. No data broker, advertiser or analytics provider receives anything.

How long data is kept

Attendance, leave and schedule records are your hospital's employment records. It sets how long they are retained, and it can delete them.
Encrypted backups are held on a rolling schedule — daily copies for 14 days, weekly for 8 weeks, and monthly for up to a year — so a record may persist in a backup for a period after it is deleted.
On your phone, everything in the table above is removed when you sign out, except the device identifier and any check-in still waiting to sync. Uninstalling removes the app's storage.
When your hospital deactivates your account, the app can no longer sign in or check in. Your historical records remain the hospital's, under its retention policy.

Children

StaffCare is a workplace tool issued to employees. It is not directed at children and is not intended for anyone under 16.

Security

All traffic is encrypted in transit over HTTPS.
PINs and passwords are stored only as one-way hashes; they cannot be read back, by us or by your hospital.
Credentials on your device are held in the platform's encrypted store, protected by the device's own hardware.
Each hospital's data is isolated, and every request is bound to a single hospital.

Changes to this policy

If this policy changes materially, the version and date above will change with it, and your hospital will be notified so it can inform staff.

Contact

Questions about this policy, or about how StaffCare handles data on a hospital's behalf: admin@staffcareapp.com.

To see, correct or delete your own records, contact your hospital's administrator. They control the data; we cannot act on it for them.