Privacy Policy — SCHDL AI Mobile App

SCHDL Inc ("SCHDL," "we," "our," or "us") provides the SCHDL AI mobile application for iOS and Android (the "App"). The App helps people coordinate shift coverage and manage their schedules. This Privacy Policy explains how we collect, use, share, and protect information when you use the App. It supplements the privacy policy for our website at schdlai.com, which continues to apply to the website.

By downloading or using the App, you agree to the collection and use of information as described in this Policy. If you do not agree, do not use the App.

No patient information. The App is for staff coordination, staff scheduling and shift coverage only. We do not collect, store, or process patient information or Protected Health Information (PHI) of any kind, and the App is not designed to receive it. You must not enter patient names, records, diagnoses, or any other patient-identifiable information into the App. See Section 4.4.

The App offers two types of accounts. Which one you get depends on how you sign in.

How we decide which account you get. When you sign in, we look at your email address. If it belongs to a healthcare organization that SCHDL has onboarded, you are directed to the Enterprise Account for that organization. Enterprise Accounts cannot be created by individuals on their own; they exist only through your employer. Any other email address creates a Consumer Account.

Keeping the two separate. Information in your Consumer Account is not shared with your employer, and your employer does not see your circle or the days off you share there. Enterprise data stays within your employer's environment and is not shown to your Consumer circle.

SCHDL Inc is a Delaware corporation that provides agentic AI-powered shift coverage coordination for healthcare facilities, hospitals, and health systems in the United States. The App is intended for adults 18 and older and is not directed to children.

4.1 Information for All Accounts

• Full name
• Email address
• Phone number (for shift coordination and coverage notifications)
• Profile details you choose to add, such as a photo
• Messages and requests you enter into the Coverage Wizard

Signing in with a personal email account. If you sign in through Google or another sign-in provider, we receive only the basic profile information you approve, such as your name, email address, and profile photo. We do not read your email messages, contacts, or calendar.

4.2 Consumer Account Information

• Your schedule: shifts, availability, and scheduling preferences you enter
• Days off, PTO, and vacation you choose to record or share
• Your circle: the people you invite or accept, and the sharing settings you choose for each
• Schedule information that colleagues choose to share with you

We suggest you describe time off simply, for example "Out" or "Vacation." Please do not enter medical or other sensitive reasons for time off.

4.3 Enterprise Account Information

• Department or unit affiliation and your role (Employee, Supervisor, or Administrator)
• Shift times, dates, assignments, and coverage events
• Scheduling and staffing data your employer provides or synchronizes through integrations with systems such as Epic, Kronos, or Workday

Your employer is responsible for making sure it has the right to share this data with us.

4.4 No Protected Health Information (PHI)

The App handles scheduling and coverage coordination data only. We do not collect, process, store, or transmit Protected Health Information (PHI) as defined under HIPAA. The App does not access patient records, clinical data, or any patient-identifiable information. Please do not enter patient information into the App.

4.5 Information Collected Automatically From Your Device

• Device type, operating system and version, and App version
• Push notification token (only if you enable notifications)
• Device and session identifiers used to keep you signed in and secure the App
• IP address (used for security, not retained long term)
• Features used and timestamps of interactions
• Crash and performance diagnostics

This data is used only to operate, secure, and improve the App. It is not used for advertising.

4.6 Device Permissions: Location, Microphone, and Photos

The App asks for your permission before it uses each of the following. You can say no, or change your choice at any time in your device settings. The App continues to work if you decline, with the limits noted below.

• Notifications (optional): Used to send shift coverage requests, confirmations, circle invitations, and coordination alerts. You can turn notifications off at any time in your device settings, although you may then miss time-sensitive requests.
• Face ID and fingerprint sign-in (optional): If you turn it on, your device uses Face ID or fingerprint recognition to sign you back in. Your device handles this. We do not receive or store your face or fingerprint data.
• Location: With your permission, the App collects your device's current location while you use it, so we can show you hospitals and facilities near you, match you to the right hospital profile, and help you find the facility where you have been asked to attend. If you decline, you can still search for or choose a facility manually. We do not share your precise location with other users, your circle, or your employer.
• Microphone: Used only while you dictate a request or talk to SCHDL AI in a voice conversation. On iOS, a separate Speech Recognition permission lets the App turn what you say into text. Your speech is processed to understand and carry out your request.
• Photos: Used only to upload a profile photo, and only if you choose to add one. You can decline access or skip the photo, and your account works fully without it.
• Advertising: The App does not use advertising identifiers and does not track you.
• Not used: The App does not use your camera, contacts, calendar, or Bluetooth.

Your circle is made up of people you choose. You control what you share.

• Nothing is shared with a person until you invite them or accept their invitation.
• You choose what each person can see, such as days off, PTO, vacation, or shift availability.
• You can change or stop sharing with any person at any time. Stopping sharing removes their access going forward.
• Anyone in your circle can see what you share with them, and may have seen or noted it before you stop sharing. Share only with people you trust.
• You see a colleague's schedule only if that colleague has chosen to share it with you.

• To provide, operate, and maintain the App, including processing the voice requests you speak
• To sign you in and keep your account secure
• To personalize your experience, such as greeting you by name and showing hospitals and facilities near you when you allow location access
• To send shift coverage notifications, confirmations, circle invitations, and coordination alerts, including by push notification and SMS
• To identify qualified, available staff for open shift coverage (Enterprise Accounts)
• To show you the schedule information you and your circle have chosen to share (Consumer Accounts)
• To track and document shift coverage events for operational and compliance purposes (Enterprise Accounts)
• To diagnose crashes, fix bugs, and improve the App
• To respond to your inquiries and provide support
• To comply with legal obligations

We do not use your information for advertising, for marketing to third parties, or for sale to data brokers.

The App does not track you across other companies' apps and websites. We do not use advertising identifiers, do not run third-party advertising, and do not share your data with data brokers.

8.1 We Do Not Sell Your Data

SCHDL does not sell, rent, or trade your personal information or scheduling data, and does not share it for cross-context behavioral advertising.

8.2 Service Providers

We share data with trusted service providers who help us operate the App, under confidentiality obligations. These include:

• Cloud hosting and infrastructure providers
• Communication services for SMS and push notification delivery (we use Google Firebase Cloud Messaging for push notifications)
• Crash reporting and analytics tools used to improve the App (we use Google Firebase Analytics), and mapping and speech-recognition providers that support nearby-facility search, dictation, and voice conversations
• AI model providers that process the messages and requests you enter into the Coverage Wizard in order to generate responses.
• Payment processors (future integration through Stripe, Inc.)

8.3 Your Employer (Enterprise Accounts Only)

If you use an Enterprise Account, your employer can access your usage and scheduling activity in that environment as part of its administrative functions, subject to the agreement between your employer and SCHDL. Your employer's own privacy practices apply to what it does with that data.

8.4 People You Choose (Consumer Accounts Only)

We share information with members of your circle only as you direct, as described in Section 5.

8.5 Legal Requirements

We may disclose information if required by law or in response to valid legal process, such as subpoenas, court orders, or government requests. We will notify you where legally permitted.

8.6 Business Transfers

If SCHDL is involved in a merger, acquisition, or sale of all or substantially all of its assets, your information may be transferred as part of that transaction. We will notify you by email or a prominent notice before a transfer takes place.

We use industry-standard technical and organizational measures to protect your information, including:

• Encryption in transit using TLS
• Encryption at rest for stored data
• Access controls limiting data access to authorized personnel
• Separation between Consumer and Enterprise data
• Session management and authentication controls
• A SOC 2 compliance program in progress

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Consumer Accounts. We keep your information while your account is active. If you delete your account or ask us to, we delete or anonymize your personal data within 30 days, except where we must keep it by law. Copies in backups are removed on a rolling schedule within 90 days.

Enterprise Accounts. Retention follows the agreement between your employer and SCHDL. By default, active scheduling and shift data is retained for 90 days after the account is terminated for audit and compliance purposes, then deleted or anonymized.

For both account types, we may keep aggregated, anonymized data that cannot identify you to improve the Service.

Deleting your account. You can delete your account and personal data at any time in the App, or request deletion by emailing hello@schdlai.com from your registered email address. We will process verified requests within 30 days. For Enterprise Accounts, we may coordinate the request with your employer's administrator.

You may have the right to:

• Access: request a copy of the data we hold about you
• Correction: request correction of inaccurate or incomplete data
• Deletion: request deletion of your personal data, subject to legal retention requirements
• Portability: request your data in a machine-readable format
• Objection: object to certain processing

To exercise these rights, contact hello@schdlai.com. We will respond within 30 days and may need to verify your identity first. For Enterprise Accounts, your employer may be the right party to respond to some requests, and we will tell you if that is the case.

State privacy rights. Residents of certain US states, including California, may have additional rights under state law, including the right to know what personal information we hold, to request deletion or correction, and not to be treated differently for exercising these rights. We do not sell personal information or share it for cross-context behavioral advertising. You may exercise any applicable right through the contact below.

The App uses session tokens and similar technologies that are necessary for sign-in and core functionality. We do not use advertising cookies or cross-app tracking.

The App is for adults 18 and older and is not directed to anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account or that we have collected information from a minor, contact hello@schdlai.com and we will delete it promptly.

We may update this Policy from time to time. When we do, we will revise the Effective Date above and, for material changes, notify users by email or through a notice in the App at least 14 days before the change takes effect. Continued use of the App after the effective date means you accept the updated Policy.

SCHDL Inc — Privacy

Privacy requests: hello@schdlai.com

Security: security@schdlai.com

Website: schdlai.com

SCHDL Inc is incorporated in the State of Delaware.

© 2026 SCHDL Inc. All rights reserved.