Privacy Policy

This policy covers the HospiSavvy website and the HospiSavvy iOS and Android apps.

We collect the following information:

• Account details: name, email address, phone number, employee ID, department and business address.
• Content you create: audit and checklist responses, photos, remarks, tasks, announcements, recognition posts, chat messages, photos and voice notes sent in chat, and support tickets.
• Technical data: device type and app version, used to run and secure the service.

We do not use your data for advertising or tracking, and we do not collect your location.

We collect and display your name, email, employee ID, and assigned department as provided by your employer.

Your login credentials are encrypted. You are responsible for maintaining the security of your password.

The app records when you start and complete checklists, including the exact time and duration of tasks.

When required by a task, the app accesses your camera or gallery to upload photos as proof of work.

Your task completion rates, timeliness, and audit scores are tracked and visible to your managers.

Scores from audits are recorded to update your professional compliance status.

Comments and “Approve/Reject” notes from your supervisors are stored as part of your performance history.

Any comments you add to checklists or audit forms are visible to management and stored for operational records.

Your data is only visible to authorized personnel based on the platform’s Role-Based Access Controls (RBAC).

You may request updates to your profile information through your system administrator if you find inaccuracies.

We may collect basic device info (OS version, model) to ensure the app functions correctly during your shift.

We keep your data while your account or your organisation’s account is active. When an account is deleted, we aim to remove its personal data from our active systems within 30 days of a verified request, except where the law requires us to keep it. Some data may remain in our backups for a limited period until those backups are rotated out.

We share data only with providers that help us run HospiSavvy. They process data only on our instructions and are required to protect it to the same standard as this policy. We do not sell personal data.

• Amazon Web Services (AWS): cloud hosting, database and file storage, and email delivery via Amazon SES (sign-in codes and notifications).
• Google Firebase Cloud Messaging (Google LLC): delivery of push notifications to your device.
• Stripe: processing of subscription and payment information for paying customers.

A current list of subprocessors is available on request.

Your data is hosted on Amazon Web Services infrastructure located in Mumbai, India (AWS ap-south-1 region). If you access HospiSavvy from the United Arab Emirates or another country, your personal data is transferred to and processed in India. We apply appropriate safeguards and contractual protections to this transfer and process the data only for the purposes described in this policy.

You can request deletion of your account at any time by emailing support@hospisavvy.com or by following the steps at hospisavvy.com/account-deletion. You can also withdraw consent, or ask us to access, correct or delete your data, using the same contact. We aim to respond within 30 days, and may verify your identity before acting on a request.