Legal

Privacy Policy

Last updated: 27 July 2026

Shift Medical Limited (NZBN 9429053812056) (“Shift Medical”, “we”, “us”) operates shiftmedical.co.nz, a platform connecting healthcare practices with locum doctors and nurses. We are committed to protecting your privacy in accordance with the Privacy Act 2020 (NZ).

1. Who this policy covers

This policy applies to practice users (practice managers and staff), clinician users (doctors and nurses), and visitors to our website.

2. What we collect

Clinicians: name, contact details, professional registration details (e.g. MCNZ or Nursing Council registration number, annual practising certificate), qualifications, scope of practice, work history relevant to verification, indemnity insurance details, bank details for practice payment purposes, and profile information you choose to provide.

Practices: practice name, address, contact details, staff user details, shift and roster information, and billing details.

All users: account credentials, messages sent through the platform, and records of platform activity (shifts posted, claimed, and completed).

Competition entrants: where we run a prize draw or competition, we collect the name, email address, role and region you give us on the entry form, together with a record of your consent and the time you gave it. We use this to administer the draw and to contact the winner. We keep entries for 12 months after the draw closes and then delete them.

We do not collect or store patient health information. Any clinical records remain within the practice’s own systems.

3. How we use your information

To operate the platform: matching, shift posting, claiming, messaging, notifications, and invoicing.
To verify clinician credentials. Verification status and relevant professional details are visible to practices you engage with.
To communicate service updates and support responses.
To improve the platform.

We do not sell personal information. We do not share your information with third parties except as described in this policy or with your consent.

4. Credential verification

By registering as a clinician you authorise us to verify your professional registration against publicly available registers (e.g. the Medical Council of New Zealand and Nursing Council of New Zealand registers).

5. Where your data is stored

Platform data is hosted with Supabase in Sydney, Australia. Our website is hosted on Vercel (Vercel Inc.). Email is delivered by Google Workspace (Google LLC) for account and sign-in emails, and by Resend (Resend, Inc., which delivers via Amazon Web Services) for platform notifications. These providers may process data outside New Zealand; we take reasonable steps to ensure comparable safeguards apply as required by the Privacy Act 2020.

6. Cookies and analytics

We use only essential cookies required for login and platform function. We do not currently use third-party advertising or tracking cookies. If we introduce analytics, this policy will be updated.

We record the IP address of form submissions for a short period to limit automated abuse of our public forms.

7. Retention

We keep personal information only as long as needed for the purposes above or as required by law. Shift and invoicing records are retained for 7 years in line with tax record-keeping requirements. You may request deletion of your account; some records may be retained where legally required.

8. Your rights

Under the Privacy Act 2020 you may request access to, and correction of, your personal information. Contact privacy@shiftmedical.co.nz. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner (privacy.org.nz).

9. Security

We use industry-standard measures including encrypted connections (HTTPS), role-based access controls, and row-level security on our database. No system is completely secure; notify us immediately of any suspected breach.

10. Contact

Privacy Officer, Shift Medical Limited, Christchurch, New Zealand. privacy@shiftmedical.co.nz