Privacy Policy

1. Data controller

Tayori HB, company reg. no. 969708-0167, Gjutformsgatan 1, 216 48 Limhamn, Sweden, is the controller for the processing of your personal data. Contact: [email protected]

2. Personal data, purposes and legal basis

Account, content and communication

We process your account and profile details, posts, images, chats, voice messages, followers, follow requests, blocks, activity and settings to provide BetweenShift. This also covers notifications, quizzes, ratings and bookings. Passwords are stored only in unreadable form. The processing is based on our contract with you (Art. 6(1)(b) GDPR).

The following applies to visibility and access:

• Your profile: Your username, profession, the year you joined, your follower and post counts, badges, profile photo, profile text and tags are visible to all signed-in members, even if your account is private. You can also be found in the member search. On a private account, your years in the profession, work experience, region and online status are shown only to approved followers, except for mentors. The whole uploaded profile photo can be shown, including what falls outside your crop.
• Images: Profile photos and images in posts can be opened outside the app by anyone who has the image’s web address. Images and audio in chats have restricted access.
• Workplace: This is optional and is not shown on your profile. Public accounts can be found through the workplace filter; for primary care, municipal care and private practice the filter covers the same category across the whole country. We also show the number of members per hospital, even when the number is one. Together with other information, that can make a person identifiable. The hospital statistics are based on our legitimate interest in showing how members are distributed (Art. 6(1)(f)).
• Anonymity: Anonymous posts and shared check-ins are still linked to your account on our side, and BetweenShift and Supabase have technical access to those links. The author of an anonymous post can be shown to an authorised administrator who is reviewing a report or a request for review; that access is logged. The content itself can also make you recognisable. Outside Safe Spaces, your reactions can show your identity even if you replied anonymously, except in threads you started anonymously yourself.
• Chats: The participants can see the messages and read activity. Members added to a group later can read earlier messages. BetweenShift and Supabase have technical access, but we only look at messages that are reported. We then review a copy of the text or image, never the audio of a voice recording. Moderators see the sender and the person who reported it. Special rules apply to Today’s mood, see below.
• Presence and notifications: Activity is recorded even if you hide your online status. Push notifications can contain usernames and technical identifiers, but not the text of a message or post. Notifications inside the app, however, can contain excerpts of text. If you turn off notifications on your phone, the push identifier can remain and delivery processing can continue without the notification being shown.

Wellbeing and health data

Check-ins contain your rating of the day, feeling word, energy level, whether you worked, any journal text and your profession at the time. The profession is used only for How colleagues feel. The health data is processed with your explicit consent under Art. 9(2)(a) GDPR. The different uses are:

• Your own check-ins: Your data is shown only to you unless you actively share it. A separate consent is required for your wellbeing history and personal summaries.
• Overall statistics: Feeling words are summarised across the app’s members. Free text and workplaces are not included. The statistics are shown only once there are at least five participants and are rounded to reduce the risk of identification. The processing is based on legitimate interest (Art. 6(1)(f)) together with the consent to health data processing.
• How colleagues feel: With a separate explicit consent, the rating, feeling word and professional group of new check-ins are used in group statistics. They are shown only once there are at least ten participants and ten check-ins. The statistics contain no names, workplaces or journal text. Both these and the overall statistics stay in the app and are not passed on to regions or other outside parties.
• Today’s mood: You confirm each share. A share covers the rating, feeling word, energy, date and the full journal text, if any, and is shown without your name for at most seven days from the check-in date. With consent to How colleagues feel, the share can also be shown under your professional group, if at least ten members have visible shares there. Sharing requires consent to your wellbeing history. Replies are shown only to the recipient and the person who wrote the reply. When something is reported, administrators can read the content and, for a reply, the check-in it belongs to, but the moderation view does not show the participants’ identities.

Summarising data and hiding identities reduce the risk of identification but do not guarantee anonymity. Avoid details that identify patients or other people.

You can withdraw consents under Privacy and data protection. If you withdraw the consent to health data or to How colleagues feel, the check-ins concerned are removed from the statistics. Current shares end at the next publication time, within 20 minutes, if you stop sharing or withdraw the consent to health data or to your wellbeing history. If you withdraw only the consent to How colleagues feel, the share stops being shown under the professional group but can remain in Today’s mood. No longer showing a share is not the same as deleting it; see section 4.

If you write about your own health in a post or reply, for example in the Health forum or in a Safe Space, the data is used to show the post the way you chose and for moderation (data you have made public yourself, Art. 9(2)(e)).

Mentors, sessions and payments

For mentor applications we process your profession, experience, motivation, application video and the review result in order to assess the application (Art. 6(1)(b)). The video contains your face and voice, has restricted access and is not used for biometric identification.

Names are collected for all mentor applications. For licensed professions and the protected professional title, we check your name and personal identity number with the National Board of Health and Welfare (Socialstyrelsen) and check for duplicate accounts. This is based on our legitimate interest in correct qualifications and in preventing misuse (Art. 6(1)(f) and Chapter 3, Section 10 of the Swedish Data Protection Act). Your name and personal identity number are stored encrypted and are not shown to other members. The checks can be repeated while you are a mentor.

We process booking, calendar, session and payment details, as well as objections and ratings, to provide and administer mentor sessions (Art. 6(1)(b)). Objections are shown to the mentor. Rating comments are available to you, the mentor and administrators during a review; other members see only aggregated ratings. Session activity is recorded for charging and refunds without the messages being read.

Apple and Google handle membership purchases. RevenueCat administers subscriptions using your user id. We process your subscription status and purchase events, but we do not store card numbers or security codes.

Mentor payments are handled by Stripe. Your payment method is saved on the mentor’s Stripe account while the payment is not settled. The mentor receives limited payment details as an independent controller. We send account and session identifiers, not your name or email address. The card is normally removed when the payment has been settled or written off, the session has ended without payment, an incomplete booking has been abandoned or an account concerned has been deleted. The card is also removed if the booking has stayed unconfirmed for 30 days. We store amounts, payment references, payment status and documentation of your charge approval. Mentors give their identity and bank details directly to Stripe; we receive information about the account’s payment capabilities and record withdrawals.

Support, security and other administration

• Support: Contact details and the content of your request are used to handle your question (Art. 6(1)(b)), or to meet our obligations when you exercise your rights (Art. 6(1)(c)).
• Feedback and invitations: Feedback, optional answers when cancelling, the link between the person who invited and the person invited, and information about the invited person’s first payment are used for improvements and to follow up invitations and rewards (legitimate interest, Art. 6(1)(f)). The person who invited sees a count, not identities.
• Mailings: Email addresses on the waiting list and the mailing list are processed with consent (Art. 6(1)(a)). You can ask to be removed at any time.
• Moderation and security: Reports, reported content, decisions, reviews and administrator actions are processed to prevent misuse and handle cases (Art. 6(1)(f)), and when the law requires it (Art. 6(1)(c)). The identity of the person who reported is not shown to the person reported.
• Technical operation: IP address, device and installation details, sign-in events, push identifiers and error logs are used for operation, security and troubleshooting (Art. 6(1)(f)). Error reports can be linked to your user id, but content written by users is removed. The data is not used for marketing or for profiling you as a person. Some settings and details about abandoned bookings are stored only on your phone.
• Records and legal requirements: We record approvals, consent choices and age declarations to be able to show what you have chosen (Art. 6(1)(c) and (f)). Bookkeeping, transaction records and applicable DAC7 reporting are processed to meet legal obligations (Art. 6(1)(c)).

3. Recipients and transfers outside the EU/EEA

We use Supabase for the database and storage, Cloudflare for web hosting and email forwarding, Sentry for error reporting, Expo for push notifications and app updates, Brevo for the app’s email, Google Workspace for handling email, EmailOctopus for the waiting list and mailings, and RevenueCat for subscription management.

Apple and Google handle subscriptions as independent controllers and deliver push notifications. Stripe handles mentor payments; the mentor concerned receives payment details as described in section 2. The National Board of Health and Welfare (Socialstyrelsen) receives data for qualification checks, and the Swedish Tax Agency (Skatteverket) for applicable DAC7 reporting. Data can be disclosed to the Police or the Health and Social Care Inspectorate (IVO) when a crime is suspected or when the law requires it, with the applicable legal basis.

Our database and primary file storage are located within the EU. Our suppliers and their subprocessors can also process data outside the EU/EEA. For Cloudflare, Sentry, Expo, Stripe and Google, the Data Privacy Framework, the framework for data protection between the EU and the US, is used for transfers to certified recipients in the US. Supabase, including for processing in the US and Singapore, and RevenueCat use the European Commission’s standard contractual clauses. Transfers to EmailOctopus in the United Kingdom are covered by the Commission’s adequacy decision. You can contact us for information and copies of the safeguards.

When the app fetches news or exchange rates or checks the internet connection, outside services receive your IP address. If you open an outside web page, its own privacy policy also applies, and it can use its own cookies.

4. Retention, deletion and your rights

The main rule is that data is kept while you have an account and deleted when the account is deleted. The following exceptions and specific periods apply:

• Account and security: Unconfirmed accounts are deleted after 24 hours. The original registration details remain in the sign-in account until the account is deleted, even if the profile is changed. Sign-in logs are kept for 180 days, even after the account is deleted. Backups are kept for at most 30 days.
• Content and chats: Quotes in other people’s replies and excerpts in notifications can remain after the original has been deleted. Notifications remain until they are deleted or an account concerned is deleted. Leaving a group or session chat does not delete your messages. Removed post images are deleted within two days; when an account is deleted, chat files are deleted at the latest the following night. Reported copies follow the rules for moderation.
• Wellbeing: Check-ins are kept until you delete them or your account. Shared copies and replies are kept just as long, even after the share has stopped being shown. On deletion, the share stops being shown within 20 minutes; scheduled cleanup follows. When you withdraw the consent to health data, you can choose to keep earlier check-ins; they are then not counted in any statistics.
• Mentor applications: The application and video are kept until the account is deleted; the video can be deleted earlier on request. Your name and personal identity number are stored as soon as you leave the form step, even without a submitted application, and are deleted if the application is rejected or the account is deleted. Check emails to and from Socialstyrelsen are deleted once the answer has been recorded.
• Bookings and payments: Booking, payment and objection details, and the approvals for bookings that took place, can remain after the account is deleted, without a direct link to the account but with Stripe’s references. RevenueCat’s purchase data is not deleted when the BetweenShift account is deleted. Accounting records are kept as required by law, normally for seven years after the end of the calendar year in which the financial year ended.
• Moderation: Decisions are normally kept for 24 months from the decision or from when the measure ended. Permanent suspensions and details of blocks can remain for as long as the account exists. Decision copies of hidden posts are deleted seven days after the review period and any review have ended. Reported chat copies are deleted when the sender’s or the reporter’s account is deleted. In Today’s mood, review copies of replies are cleared after 90 days, and reports of shares are deleted with the shared copy. Some reports currently have no automatic time based deletion. The administrator log and some suspension details are kept without a time limit, even after an account is deleted, for security and follow up.
• Quiz, feedback and support: Quiz winners’ usernames and profile photos are shown to other members for seven days. Quiz answers and draw details are deleted 90 days after the quiz closed; the fact that you won is kept with your account. Feedback is deleted once handled, while a limited log entry remains. Answers when cancelling are kept until the account is deleted. Support requests are kept for as long as the request requires.

Deleting your account in the app can be blocked while mentor sessions, payments or objections are not finished, or for seven days after a paid session has ended. A failed payment can block deletion until it has been paid or written off after 14 days. This does not limit your right to contact us and have a request for erasure under the GDPR considered.

You can request access, rectification, erasure, restriction and data portability under the GDPR, and object to processing based on legitimate interest. You can withdraw a consent at any time without affecting the lawfulness of earlier processing.

Contact [email protected]. We normally answer within one month and tell you within that time if an extension is needed under the GDPR. The app’s data export is an aid and does not cover all data that can be part of your right of access; contact us for a complete request. The export’s file links can be opened by anyone who has them for seven days. You can lodge a complaint with the Swedish Authority for Privacy Protection (IMY).