Our commitment to transparency, privacy, and security. Read our privacy policy and terms of service below.
Last updated: March 21, 2026
Shift Harmony AI, Inc. (“Company”, “we”, “our”, or “us”) understands that privacy is important to our users. This Privacy Policy describes our practices regarding the collection, use, sharing, and protection of your personal information for the website located at https://shiftharmony.ai/ (the “Website”), and our related platform and services, including schedule generation, rule configuration, preference collection, administrative tools, analytics, and support (collectively, the “Services”). This Privacy Policy also tells you about the rights and choices you have with respect to your personal information, how you can assert those rights, and how you can contact us to get answers to your questions.
With respect to the personal information that our clients and their vendors collect from you outside of our Services and provide to us via use of the Services (“Service Data”), where permitted by law, we process such information only as a “service provider” or “data processor” (as those terms are defined under applicable data protection laws) on behalf of our clients, who act as the “business” or “data controller” (as those terms are defined under applicable data protection laws). Our clients—namely, health care organizations that utilize the Services and our AI-powered workforce scheduling platform—are the parties that control the use of the Service Data and determine the purposes for which we process such information. While this Privacy Policy describes how we process Service Data on behalf of our clients, our clients are responsible for their own practices in collecting, using, and disclosing information they collect from you. To learn more about such clients’ use of your information and your rights that you may have over such information, please consult the privacy policy of the applicable health care organization.
BY USING OR ACCESSING THE SERVICES, YOU AGREE TO THIS PRIVACY POLICY. IF YOU DO NOT AGREE WITH OUR POLICIES OR PRACTICES, YOU SHOULD NOT USE OR ACCESS THE SERVICES OR PROVIDE US WITH ANY PERSONAL INFORMATION.
The following links will take you directly to the corresponding sections of this Privacy Policy:
This Privacy Policy applies to the personal information that we obtain in various contexts. We use the terms “personal information” or “personal data” to refer to information that reasonably identifies, relates to, describes, or can be associated with you. Data that has been deidentified or that otherwise cannot reasonably be related back to a specific person is not considered personal information.
The following are the categories and types of personal information that we or our third-party partners may collect from or about you, depending on how you interact with the Services:
We collect personal information that you provide to us directly. This may include, but is not limited to:
When you visit our Services or open or click on emails we send you, we or third parties we work with may automatically collect certain information using technologies such as cookies and other tracking technologies described below.
We collect and use personal information for the following purposes:
In addition to using your personal information ourselves for the reasons stated above (and as otherwise mentioned in this Privacy Policy), we may disclose your personal information to other affiliates and entities in the following instances:
With regard to Service Data, our clients provide us with instructions on what to do with such information. These choices and instructions may result in the access, use, disclosure, modification, or deletion of Service Data. Clients and their affiliates determine their own policies for the sharing and disclosure of Service Data. We may transfer Service Data to third parties on our clients’ behalf, and under such circumstances, we do so strictly according to our clients’ instructions.
Last Updated and Effective as of: March 21, 2026
These terms of service (the “Terms of Service”) are an agreement between you, whether personally or on behalf of an entity (“you”) and Shift Harmony AI, Inc. (“Company,” “we,” “us,” or “our”), concerning your access to and use of the website at https://shiftharmony.ai/ (the “Website”) and all related services, products, platforms, websites, and offerings (the “Services”) maintained and operated by Shift Harmony AI, Inc. where a link to these Terms of Service is provided.
NOTICE REGARDING DISPUTE RESOLUTION: THESE TERMS OF SERVICE CONTAIN TERMS THAT GOVERN HOW CLAIMS BETWEEN YOU AND US WILL BE RESOLVED. FOR EXAMPLE, SECTION 18 CONTAINS AN ARBITRATION AGREEMENT AND WAIVER OF CLASS ACTION WHICH STATES THAT WE MUST ARBITRATE INSTEAD OF GOING TO A COURT BEFORE A JUDGE AND JURY AND THAT ALL SUCH ARBITRATION CLAIMS MUST BE BROUGHT IN YOUR INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS REPRESENTATIVE OR MEMBER OR OTHERWISE ON BEHALF OF OTHERS IN ANY PURPORTED CLASS, COLLECTIVE OR REPRESENTATIVE PROCEEDING.
All other third-party trademarks, registered trademarks, and product names mentioned on the Services are the property of their respective owners and may not be copied, imitated or used, in whole or in part, without the permission of the applicable intellectual property rights holder. Reference to any products, services, processes or other information by name, trademark, manufacturer, supplier or otherwise does not constitute or imply endorsement, sponsorship, or recommendation by Company.
You acknowledge and expressly agree that any contribution of feedback regarding the Services that you provide to us (the “Feedback”) does not and will not give or grant you any right, title, or interest in the Services or in any such Feedback. You agree that Company may use and disclose Feedback in any manner and for any purpose whatsoever without further notice or compensation to you and without retention by you of any proprietary or other right or claim. You hereby assign to Company any and all right, title, and interest (including, but not limited to, any patent, copyright, trade secret, trademark, show-how, know-how, moral rights and any and all other intellectual property right) that you may have in and to any and all Feedback.
Except as expressly set forth in these Terms of Service, no license is granted to you and no rights are conveyed by virtue of accessing or using the Services. All rights not granted under these Terms of Service are reserved by Company.
Company is under no obligation to screen or monitor content, but may review content from time to time at its sole discretion. Company will make all determinations as to what content is appropriate in its sole discretion. Company may edit or remove any content at any time without notice.
A single, neutral arbitrator will resolve Claims. The arbitrator will be either a lawyer with at least ten (10) years’ experience or a retired or former judge, selected in accordance with the rules of the American Arbitration Association. The arbitration will follow the procedures and rules of the American Arbitration Association which are in effect on the date the arbitration is filed unless those procedures and rules are inconsistent with these Terms of Service, in which case these Terms of Service will prevail. Those procedures and rules may limit the discovery available to you or us. The arbitrator will take reasonable steps to protect your customer account information and other confidential information if requested to do so by you or us. Each party to the arbitration will bear the expense of that party’s attorneys, experts, and witnesses, and other expenses, regardless of which party prevails, but a party may recover any or all expenses from another party if the arbitrator, applying applicable law, so determines. The arbitrator’s award is final and binding on the parties.
We will not choose to arbitrate any Claim you bring in small claims court. However, if such a Claim is determined by the court to be outside its jurisdiction, the parties agree that the dispute shall then be submitted to arbitration.
Class Action Waiver: BY USING THE SERVICES, YOU AGREE THAT YOU AND COMPANY ARE EACH WAIVING THE RIGHT TO A TRIAL BY JURY OR TO PARTICIPATE IN A CLASS ACTION, COLLECTIVE ACTION, PRIVATE ATTORNEY GENERAL ACTION, OR OTHER REPRESENTATIVE PROCEEDING OF ANY KIND. CLAIMS AND REMEDIES SOUGHT AS PART OF A CLASS ACTION, PRIVATE ATTORNEY GENERAL OR OTHER REPRESENTATIVE ACTION ARE SUBJECT TO ARBITRATION ONLY ON AN INDIVIDUAL (NON-CLASS, NON-REPRESENTATIVE) BASIS, AND THE ARBITRATOR MAY AWARD RELIEF ONLY ON AN INDIVIDUAL (NON-CLASS, NON-REPRESENTATIVE) BASIS.
Time Bar: ANY CLAIM YOU HAVE MUST BE COMMENCED WITHIN ONE (1) YEAR AFTER THE DATE OF THE CLAIM.
This Data Processing Addendum (“DPA”) forms part of the ShiftHarmony.AI Platform Terms & Conditions between the Customer set forth on an Order Form (“Customer”) and ShiftHarmony.AI (collectively, the “Parties”) for the provision of services by ShiftHarmony.AI (identified either as “Services” or otherwise in the applicable agreement, and hereinafter defined as “Services”) (the “Agreement”) to reflect the Parties’ agreement with regard to the Processing of Customer Personal Information.
Capitalized terms not otherwise defined herein shall have the meaning given to them in the Agreement. In this DPA, the following terms shall have the meanings set out below:
“Aggregate Data” means information that relates to a group or category of individuals, from which individual identities have been removed, and that is not linked or reasonably linkable to any individual or household.
“Customer Personal Information” means any Personal Information Processed by ShiftHarmony.AI or ShiftHarmony.AI’s Subprocessor, solely on behalf of Customer, pursuant to the express terms of an applicable statement of work or order under the Agreement.
“Data Protection Assessment” means an assessment of the impact of processing operations on the protection of Personal Information and the rights of Data Subjects, which may also be called a “Data Protection Assessment,” “Data Protection Impact Assessment,” or “Risk Assessment” by applicable Data Protection Laws.
“Data Protection Laws” means any and all applicable U.S. data protection, security, or privacy-related laws, statutes, directives, or regulations, including but not limited to: (a) the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq. (“CCPA”), together with any amending or replacement legislation, including the California Privacy Rights Act of 2020 and any regulations promulgated thereunder; (b) the Virginia Consumer Data Protection Act of 2021, Va. Code Ann. § 59.1-571 to -581; (c) the Colorado Privacy Act of 2021, Co. Rev. Stat. § 6-1-1301 et seq.; (d) Connecticut Public Act No. 22-15, “An Act Concerning Personal Data Privacy and Online Monitoring”; (e) the Utah Consumer Privacy Act of 2022, Utah Code Ann. § 13-61-101 et seq.; (f) the Texas Data Privacy and Security Act, 11 Tex. Bus. & Com. Code § 541.001 et seq.; (g) the Oregon Consumer Privacy Act, Or. Rev. Stat. § 646A.570 et seq.; (h) the Montana Consumer Data Privacy Act, Mont. Code Ann. § 30-14-2801 et seq.; (i) the Iowa Consumer Data Protection Act, Ia. Code Ch. 715D; (j) the New Hampshire Data Privacy Act, N.H. Rev. Stat. Ann. 507-H; (k) the Nebraska Data Privacy Act, Neb. Rev. Stat. § 87-1101 et seq.; (l) the Delaware Personal Data Privacy Act, Del. Code § 12D-101 et seq.; (m) the New Jersey Data Privacy Act, N.J. Rev. Stat. § 56:8-166.4 et seq.; (n) the Tennessee Information Protection Act, Tenn. Code Ann. § 47-18-3201 et seq.; (o) the Minnesota Consumer Data Privacy Act, Minn. Stat. § 325O.01 et seq.; (p) the Maryland Online Data Privacy Act of 2024, Md. Code Ann., Com. Law § 14-4601 et seq.; (q) the Kentucky Consumer Data Protection Act, Ky. Rev. Stat. § 367.3611 et seq.; (r) the Indiana Consumer Data Protection Act, Ind. Code § 24-15; (s) the Rhode Island Data Transparency and Privacy Protection Act, R.I. Gen. Laws § 6-48.1-1 et seq.; (t) the Washington “My Health My Data” Act, Wash. Rev. Code § 19.373.005 et seq., and Nev. Rev. Stat. § 603A, as amended by Nevada S.B. 370 (“Washington and Nevada Consumer Health Data Laws”); and (u) all other equivalent or similar laws and regulations in the United States relating to Personal Information and privacy, and as each may be amended, extended or re-enacted from time to time.
“Data Subject” means an identified or identifiable natural person whose Personal Information is being Processed. The term “Data Subject” shall refer to a “Consumer” as that term is defined under Data Protection Laws.
“Deidentified Data” means information that cannot reasonably identify, relate to, describe, be capable of being associated with, be linked directly or indirectly with, or be reasonably be used to infer information about an identifiable natural person.
“Personal Information” means information that is protected by applicable Data Protection Laws or that otherwise that identifies, relates to, describes, is capable of being associated with, or can reasonably be linked, directly or indirectly, with a particular individual or household.
“Personnel” means officers, directors, employees, Subprocessors, agents and representatives.
“Regulatory Authority” means the applicable public authority or government agency responsible for supervising compliance with Data Protection Laws, including, but not limited to: the California Privacy Protection Agency; and U.S. state attorneys general.
“Security Breach” means any security incident that adversely impacts the security of Customer Personal Information.
“Subprocessor” means any third party appointed by ShiftHarmony.AI to Process Customer Personal Information as a ShiftHarmony.AI or Processor on behalf of Customer in connection with the Agreement.
The terms “Business,” “Business Purpose,” “Controller,” “Process,” “Processor,” “Sell,” “Service Provider,” and “Share” shall have the same meaning as in the Data Protection Laws, and their cognate terms shall be construed accordingly.
ShiftHarmony.AI’s Processing of Personal Information. ShiftHarmony.AI shall treat Customer Personal Information as confidential and shall only Process Customer Personal Information as necessary to perform its obligations on behalf of and in accordance with Customer’s documented instructions for the following permitted purposes: (i) in accordance with the Agreement and applicable order or scope of work and applicable Data Protection Laws (including without limitation, the CCPA); and/or (ii) as applicable, if initiated by Data Subjects in their use of the Services. ShiftHarmony.AI shall not (A) Sell, Share, or otherwise make available Customer Personal Information to any third party in exchange for monetary or other valuable consideration, and (B) retain, use or disclose Customer Personal Information outside of the direct business relationship with the Customer or for any other purpose than what is specified in the Agreement and/or this DPA. When acting as a Service Provider under the CCPA, ShiftHarmony.AI shall not combine Customer Personal Information with Personal Information it receives from, or on behalf of, another person or persons, or that it processes as a Business, except as expressly permitted by Data Protection Laws. ShiftHarmony.AI shall promptly notify Customer after it makes a determination that it can no longer meet its obligations under applicable Data Protection Laws. Nothing herein shall limit or restrict ShiftHarmony.AI’s right to use Aggregate Data and/or Deidentified Data or limit ShiftHarmony.AI’s right to use Customer Personal Information in any manner that is not restricted by specific Data Protection Laws.
Details of the Processing. The subject matter of Processing, the duration of the Processing, the nature and purpose of the Processing, the types of Customer Personal Information, and categories of Data Subjects Processed under this DPA are specified in Annex I attached hereto.
Any information that constitutes “consumer health data” under the CTDPA or the Washington and Nevada Consumer Health Data Laws;
Any Personal Information that is deemed by Regulatory Authorities as meriting sensitive or other heightened treatment under applicable Data Protection Laws or U.S. state or federal consumer protection laws.
The Parties shall reasonably cooperate in responding to Data Subject rights requests (“Data Subject Request”) and complying with requirements of Data Protection Laws in relation thereto.
If a Data Subject Request is made directly to ShiftHarmony.AI, ShiftHarmony.AI will promptly inform Customer and will advise the Data Subject to submit the request to Customer. Customer will be solely responsible for responding substantively to any such Data Subject Requests or other communications involving Personal Information.
Confidentiality. ShiftHarmony.AI shall ensure that its Personnel engaged in the Processing of Customer Personal Information are informed of the confidential nature of the Customer Personal Information, and have received appropriate training regarding the Processing of Customer Personal Information.
Reliability. ShiftHarmony.AI shall endeavor, in the exercise of its reasonable business discretion, to ensure the reliability of any Personnel engaged in the Processing of Customer Personal Information.
Appointment of Subprocessors. With respect to the Processing of Customer Personal Information, Customer authorizes ShiftHarmony.AI to appoint Subprocessors to Process Customer Personal Information for a business purpose on behalf of Customer, and consistent with the business purpose set forth herein, pursuant to a written contract that includes obligations that are at least as protective as those set out in this DPA and as required by Data Protection Laws.
Controls for the Protection of Customer Personal Information. ShiftHarmony.AI shall maintain appropriate physical, technical and organizational measures designed to protect the security, confidentiality, and integrity of Customer Personal Information. In the event of any (i) unauthorized acquisition, alteration, or disclosure of Customer Personal Information that requires notification to an individual, government or regulatory body, or law enforcement authority under Data Protection Laws, or (ii) breach of Data Protection Laws with respect to Customer Personal Information, ShiftHarmony.AI shall notify Customer promptly.
Data Security Incident Management and Notification. ShiftHarmony.AI shall maintain security incident management policies and procedures, and if at any time ShiftHarmony.AI determines that there has been a Security Breach, ShiftHarmony.AI shall promptly: (i) notify Customer in writing of such Security Breach; (ii) investigate and take steps to remediate the Security Breach, and (iii) provide information regarding the specific Customer Personal Information adversely impacted by the Security Breach as reasonably requested by Customer.
Audits and Assessments. If required of ShiftHarmony.AI under applicable Data Protection Laws, ShiftHarmony.AI shall reasonably cooperate with Customer at Customer’s expense, in relation to any audit of ShiftHarmony.AI reasonably necessary to enable Customer to comply with its obligations under Data Protection Laws (“Audit”), and shall seek the equivalent cooperation from relevant Subprocessors. Any Audit shall be: (i) subject to a mutually agreed upon scope; (ii) conducted by an independent third party who has signed a nondisclosure agreement with ShiftHarmony.AI or the Subprocessor, as the case may be; and (iii) subject to the confidentiality obligations set forth in the Agreement. Customer shall use reasonable endeavours to minimize any disruption caused to the ShiftHarmony.AI’s (or, Subprocessor’s, as the case may be) business activities as a result of an Audit. Audits shall take place no more than once in any calendar year except as otherwise required of ShiftHarmony.AI under applicable Data Protection Laws. In addition, if required of ShiftHarmony.AI under applicable Data Protection Laws, ShiftHarmony.AI shall allow Customer to take reasonable and appropriate steps to (a) ensure that ShiftHarmony.AI’s Use of Customer Personal Information is consistent with Customer’s obligations under applicable Data Protection Laws, and (b) stop and remediate unauthorized use of Customer Personal Information. Any information disclosed in connection with an Audit shall be the Confidential Information of ShiftHarmony.AI (and/or Subprocessor, as the case may be).
Data Protection Assessments. Upon Customer’s request and to the extent required of ShiftHarmony.AI under applicable Data Protection Laws, ShiftHarmony.AI shall provide Customer, at Customer’s reasonable expense with the reasonably necessary information needed for Customer to carry out a Data Protection Assessment related to Customer’s use of the Services, to the extent that Customer does not otherwise have access to the relevant information and that such information is reasonably available to ShiftHarmony.AI.
ShiftHarmony.AI shall, on the written request of Customer, return all Customer Personal Information to Customer and/or at Customer’s request delete the same from its systems, except as otherwise permitted by applicable Data Protection Laws.
The Parties to this DPA hereby submit to the choice of jurisdiction stipulated in the Agreement with respect to any disputes or claims howsoever arising under this DPA, including disputes regarding its existence, validity or termination or the consequences of its nullity; and this DPA is governed by the laws of the country or territory stipulated for this purpose in the Agreement.
In the event of any change to or new Data Protection Law(s), the Parties shall mutually agree upon any reasonably necessary amendments or revisions to this DPA.