The nursing station’s time-off book, on your phone.

DRAFT — this document has not yet been reviewed by a lawyer and is not in force. It is published so beta testers can see what the app collects and how it behaves.

OffDuty

Last updated: 14 August 2026

The short version

OffDuty is a tool for the staff of one hospital floor to coordinate time off. It replaces the paper book at the nursing station.

• It holds no patient information. There is nowhere in the app to put it.
• We do not sell your data, and we never share it for advertising or marketing.
• There is no analytics, tracking, or advertising software in this app — none, of any kind.
• We do keep your name and your work email, because that is how signing in and showing you on the floor's calendar works.
• You can delete your account, and everything attached to it, from inside the app.

The rest of this document is the detail behind those sentences.

Who we are

OffDuty is operated by Greystone Lab LLC ("we", "us"). If you have a question about this policy or about your data, contact support@offduty-app.com.

OffDuty is not provided by your employer, and your employer does not control it unless they have separately told you otherwise.

What we collect, and why

Everything below is either something you typed, or something the app needs in order to work. There is no hidden collection.

• First and last name — Where it comes from: You, at sign-up; editable any time on the Profile tab · Why: So colleagues on your floor can see who is off
• Email address — Where it comes from: You, at sign-up · Why: Signing in, and account recovery
• Password — Where it comes from: You, at sign-up · Why: Stored only as a cryptographic hash by our authentication provider. We never see it
• Which floor you are on, your role (staff or supervisor), and your usual shift — Where it comes from: Joining with an invite code; your supervisor can change role and shift · Why: Deciding what you can see and do
• Time-off requests: the date, the shift, the status, and an optional short note — Where it comes from: You · Why: The purpose of the app
• PTO balance: hours allotted, hours used, hours per shift — Where it comes from: Your supervisor types these in · Why: Showing how much time you have left
• Push notification token — Where it comes from: Your device, if you allow notifications · Why: Telling you when a request is approved or denied
• Imported schedule: which staff member works which shift on which date — Where it comes from: A supervisor pasting in the floor's existing schedule · Why: Showing how thin a shift would get if someone is off
• Import records: who imported a schedule, when, the period covered, and any names the app could not match — Where it comes from: Generated when a supervisor imports · Why: So an import can be reviewed and undone
• Remembered name matches: a name exactly as it appeared in an imported schedule, and who it refers to — Where it comes from: A supervisor confirming a match · Why: So the same schedule does not have to be matched by hand every time

We do not collect your location, your contacts, your photos, your health information, your device's advertising identifier, or anything about patients.

Special note on the optional note. When you request a day off you may add a short reason. Please do not put medical details in it — yours or anyone else's. It is visible to your supervisor, and it is stored as plain text. It is there for "daughter's graduation", not for a diagnosis.

Who can see what

• Your name — You: ✓ · Others on your floor: ✓ · Your supervisor: ✓
• Your email address — You: ✓ · Others on your floor: — · Your supervisor: —
• The days you have asked off, and whether they were approved — You: ✓ · Others on your floor: ✓ · Your supervisor: ✓
• The note on a request — You: ✓ · Others on your floor: — · Your supervisor: ✓
• Your PTO balance — You: ✓ · Others on your floor: — · Your supervisor: ✓
• Imported schedules and remembered name matches — You: — · Others on your floor: — · Your supervisor: ✓

This is enforced by the database itself, not by the app, so a fault in the app cannot show another floor's information to the wrong person. Nobody outside your floor can see any of it.

Names of people who do not use OffDuty

When a supervisor imports the floor's schedule, that file may list people who do not have an OffDuty account — agency, float or travelling staff. The app keeps two things about them:

• the name exactly as it appeared in the file, so the schedule does not have to be matched by hand again next time; and
• a list of names the app could not match, recorded against the import so the supervisor can see who was left out.

Only that floor's supervisor can see either. If you are named in an imported schedule and want your name removed, contact support@offduty-app.com and we will remove it, or ask the supervisor of the floor to remove it from the app.

Who else your information reaches

We use a small number of service providers to run OffDuty. We do not sell your data to anyone, and none of these companies is permitted to use it for their own purposes.

• Supabase Inc. — Everything in the table above. They host the database and handle sign-in. The database runs in their Canadian region (ca-central-1)
• Expo (Exponent Inc.) — Your device's push notification token, the text of each notification, and — each time the app starts — your IP address, device platform and app version, as part of checking for an app update
• Apple (iPhone) or Google (Android) — The text of each push notification, in order to deliver it to your phone
• GitHub, Inc. (Microsoft) — A weekly encrypted backup of the whole database, kept for 90 days
• Amazon Web Services — A copy of that same backup, if the operator has enabled it

What a push notification actually contains. This is worth stating plainly because it is not obvious. When you submit a request, your supervisor's phone receives a notification reading, for example, "Maria Alvarez requested Tue, Aug 18 off." That sentence — a name and a date — passes through Expo's and Apple's or Google's servers in order to reach the phone. When a request is decided, you receive "Your request for Tue, Aug 18 was approved." The note is never included in a notification.

If you turn notifications off, none of this happens.

Where your data is stored

The database is in Canada — Supabase's ca-central-1 region. If you work in the United States, that means your name, email and time-off history are held outside the country. They are protected the same way wherever they sit, and no additional party gains access because of it.

Backups are held by GitHub, and by Amazon Web Services if the operator has enabled that, in whichever region those services are configured for — which may be the United States.

How long we keep it

We keep your information for as long as your account exists.

• You can delete your account at any time from the Profile tab. This permanently removes your account, your name, your email address, your PTO balance, every time-off request you have made and every note on them. It cannot be undone, and it removes your past time off from your floor's calendar.
• If your supervisor removes you from a floor, your account still exists; you can delete it yourself as above.
• Backups. Deleted information can remain in encrypted backups for up to 90 days after deletion, after which those backups expire.

We do not currently operate a fixed retention schedule beyond the above, and we will not pretend otherwise.

Your choices

• See and correct your information. Your name is editable on the Profile tab. For anything else, contact support@offduty-app.com.
• Delete your account. Profile tab → Delete account.
• Turn off notifications. In your phone's settings, or by declining the permission prompt. The app works without them.
• Ask us a question. support@offduty-app.com.

Depending on where you live, you may have additional rights over your personal information, including rights of access, correction, deletion and portability, and a right not to be discriminated against for exercising them. Contact us and we will help.

Security

• All traffic between the app and our servers is encrypted in transit (TLS).
• Access to data is enforced at the database level, per floor, so the app cannot be tricked into showing one floor's information to another.
• Passwords are stored only as cryptographic hashes, by our authentication provider. We cannot read them.
• Backups are encrypted at rest.

No system is perfectly secure, and we do not claim OffDuty is. It is a small tool run by a small operator, and it is currently in beta.

HIPAA

HIPAA governs protected health information about patients. OffDuty contains none. It holds staff scheduling and time-off records, which are employment records rather than protected health information — under 45 CFR 160.103 (https://www.ecfr.gov/current/title-45/section-160.103) the definition expressly excludes employment records held by a covered entity in its role as employer.

We are not making a claim of HIPAA certification, because no such certification exists.

Children

OffDuty is a workplace tool for hospital staff. It is not directed at children and we do not knowingly collect information from anyone under 16.

Changes to this policy

If we change this policy we will update the date at the top, and the version in the app will change with it. Material changes will be announced in the app.

Contact

Greystone Lab LLC support@offduty-app.com

DRAFT — this document has not yet been reviewed by a lawyer and is not in force. It is published so beta testers can see what the app collects and how it behaves.

OffDuty

Last updated: 14 August 2026

Read this part first

OffDuty is not your employer's official record of leave.

Your hospital's timekeeping and payroll system is. OffDuty is a shared calendar for one floor — the digital version of the book at the nursing station.

That means:

• An approval in OffDuty is not a grant of leave. It is your supervisor telling you, through the app, that they intend to approve it. Whatever process your employer requires — a formal request, a signature, an entry in their system — still applies.
• The PTO balance shown in OffDuty is an estimate. It is a number your supervisor typed in and the app adjusted as requests were approved. It is not calculated from payroll and may not match it.
• **If OffDuty and your employer's system disagree, your employer's system is correct.** Always.

Please do not stop checking with your manager because the app said yes.

Who these terms are between

These terms are an agreement between you and Greystone Lab LLC ("we", "us"), who operate OffDuty. By creating an account you accept them.

OffDuty is independent software. It is not provided, endorsed, or administered by your employer unless they have separately told you so.

Beta software

OffDuty is in beta. It may contain faults, it may lose data, and it may be unavailable without notice. It runs on free-tier hosting with no service level agreement and no guarantee of uptime. Do not rely on it as your only record of anything that matters to you — keep whatever record your employer requires.

Using OffDuty

You may use OffDuty to request time off, to see when colleagues on your floor are off, and — if you are a supervisor — to decide requests, set balances, and import your floor's schedule.

You must not:

• Enter any patient information, ever. Not names, not room or bed numbers, not diagnoses, not anything clinical. There is no field for it and there is no legitimate reason to put it anywhere in this app.
• Put medical details about yourself or anyone else in the note on a request. A short reason is what the field is for.
• Import a schedule you are not authorised by your employer to handle.
• Try to access another floor's information, or anyone's account but your own.
• Use OffDuty to harass anyone, or to make employment decisions you would not be willing to explain.

If you are a supervisor importing a schedule, you are responsible for making sure you are permitted to put that information into a third-party tool. If you are not sure, ask your employer before you do it.

Coverage warnings are advice, not rules

OffDuty may warn that a shift is at or below its coverage line. These warnings never block anything. The app does not refuse requests, does not auto-approve, and does not overrule a supervisor. Staffing a floor needs human judgement, and the supervisor is the one who has it.

A warning being absent does not mean a day is adequately staffed. The app only knows what has been entered into it.

Your account

You are responsible for keeping your password to yourself and for what happens under your account. Tell us at support@offduty-app.com if you think someone else has access to it.

You may delete your account at any time from the Profile tab. Deletion is permanent and cannot be undone. It removes your account, your name, your email address, your balance, and every time-off request and note you have created — including from your floor's calendar, where your past approved days will no longer appear.

We may suspend or remove an account that is being used in breach of these terms.

Your employer's policies still apply

Nothing in OffDuty changes your employment terms, your entitlement to leave, your employer's leave policy, or any agreement between your employer and a union. If this app and your employer's policy disagree, your employer's policy governs.

What we do not promise

OffDuty is provided "as is" and "as available", without warranties of any kind, express or implied, including any implied warranty of merchantability, fitness for a particular purpose, or non-infringement. We do not warrant that OffDuty will be uninterrupted, timely, secure, or error-free, or that the information in it is accurate or complete.

Limitation of liability

[FOR COUNSEL] This section needs a lawyer. The commercial reality to draft

against: an individual operator, a free beta, no revenue, used inside a hospital

where a staffing or leave error has real consequences for real people. The

foreseeable claims are (a) someone takes leave that was not actually granted, (b) a

shift is short because a coverage number was wrong, (c) a disclosure of staff

personal data. Please advise on cap, exclusions, and whether a consumer-protection

carve-out is required in {{JURISDICTION}}.

Indemnity

[FOR COUNSEL] Advise whether an indemnity is appropriate here at all, given the

users are individual employees rather than businesses.

Changes

We may update these terms. If we do, we will change the date at the top and the version shown in the app. Continuing to use OffDuty after a change means you accept the updated terms.

Governing law

[FOR COUNSEL] {{JURISDICTION}}.

Contact

Greystone Lab LLC support@offduty-app.com