Last updated: September 19, 2026
CareShiftLTC ("CareShiftLTC", "we", "us") is a product of Arzyn Brothers Inc. (Ontario Corporation Number 1374912-6), with its registered office at 42 - 400 Newman Drive, Cambridge, Ontario, N1S 0E8, Canada. This policy describes what information we collect through the CareShiftLTC web application and website (careshiftltc.com), how we use it, who we share it with, and how we protect it. It applies to long-term care homes and their staff who use the service, and to visitors who contact us or request a demo.
Account information. Name, work email address, password (stored only as a cryptographic hash), role and designation (for example RN, RPN, PSW), and the home or organization you belong to.
Employment and scheduling data. Shift schedules, availability, leave and swap requests, shift bids, attendance and punch-clock records (including time and, where the home enables it, device/location metadata at clock-in), certifications and their expiry dates, and performance indicators such as Bradford scores. This data is entered by your home's administrators, HR and managers, or generated by your use of the service.
Documents. Files uploaded by you or your home, such as union contracts, certificates and policy documents, stored in encrypted object storage.
Billing information. Subscription plan, licensed bed count and payment status. Payment card details are collected and processed directly by Stripe; we never see or store full card numbers.
Location information. Where your home turns on location-verified punching, we collect the precise geographic coordinates reported by your device (latitude and longitude, as accurate as your device allows) at the moment you clock in or out, together with the distance from the home. This is sensitive location information about you. It is captured only at the punch itself — never continuously and never in the background — is used only to confirm that a punch was made at the home, and is visible only to you and to your home's HR and administrators. If your home does not enable this option, no location is collected. You can refuse the browser's location prompt; your home may then ask you to punch at a home device instead.
Social Insurance Numbers. Payroll processing is not an active CareShiftLTC service. Where a home previously entered a Social Insurance Number against a staff pay record, that number is stored encrypted, is never shown in lists, exports or reports, and can be reached only by that home's administrators and by the staff member it belongs to. A home can ask us to erase these numbers at any time, and we do not collect new ones.
Device and usage data. Push-notification device tokens, browser type, and standard server logs (IP address, pages accessed, timestamps) used for security and troubleshooting.
Facilities and equipment records. CareShiftLTC does not provide physical plant, equipment or safety-device maintenance tracking. Homes continue to use their own regulated maintenance procedures and systems for call bells, bed rails, personal assistance services devices and other equipment, and we do not collect or store those records.
Demo requests and contact. When you request a demo or email us, we collect your name, email address, organization and message.
Health information. CareShiftLTC no longer offers sick-leave, call-in or infection-surveillance features, so we do not collect symptom or health information about staff or residents. Where a home entered such records while those features were available, they remain under that home's control, are visible only to that home's authorized users, and can be deleted on the home's instruction. CareShiftLTC does not collect, use or disclose resident personal health information.
We use the information above to:
Agency staffing and payroll services are not currently offered. Timesheet and attendance records may be exported by a Home for use with its own independent payroll provider; CareShiftLTC does not process payroll, calculate payroll tax or pay employees.
We do not sell personal information, and we do not use it for advertising.
CareShiftLTC is multi-tenant: every record belongs to one home (tenant). Staff data is visible only to users of the same home, according to their role — for example, HR and administrators see staff records and compliance data, while staff see their own schedule, requests and documents. Organization-level administrators see aggregated figures across their homes but not individual staff records. Row-level security in the database enforces this separation even if application code were to request cross-home data.
We share information only with the providers needed to run the service:
Each provider processes information only as instructed and is bound by its own security and privacy obligations. We may also disclose information where required by law, court order, or to protect the rights, safety and security of our users and the service.
We retain account and employment data for as long as the home's subscription is active and as needed to meet legal and audit obligations. Attendance punches, audit-log entries and historical operational records older than 12 months may be moved into secure archive storage rather than being kept in the active system. CareShiftLTC does not currently create or process payroll records as a service. When a home's account is cancelled, its data is kept for a 30-day grace period so it can be exported, and is then permanently deleted, including staff sign-in accounts, except where retention is required by law. Demo-request and contact information is kept only as long as needed to respond and manage the relationship.
We use encryption in transit (TLS) and at rest, hashed passwords, optional two-factor authentication, role-based access control, row-level database security and an audit trail of administrative actions. No method of transmission or storage is perfectly secure.
If we become aware of a breach of security safeguards affecting information we hold, we contain and investigate it immediately and notify the affected home without unreasonable delay, and in any event within 72 hours of confirming the breach. Our notice describes what happened, the information involved, what we have done and what we recommend.
Because the home is the organization responsible for its staff's employment records — and, in Ontario, the health information custodian for any personal health information in its care — the home decides on and makes any notification to affected individuals and to regulators, and we support it in doing so. Where the breach creates a real risk of significant harm to an individual, PIPEDA requires notification to the individual and to the Office of the Privacy Commissioner of Canada, and a record of the breach to be kept for 24 months; where personal health information is involved in Ontario, PHIPA requires notification to the affected individual at the first reasonable opportunity and, in the circumstances set out in that Act, to the Information and Privacy Commissioner of Ontario. We keep our own record of every breach for at least 24 months.
Depending on your jurisdiction (Canadian federal and provincial privacy legislation such as PIPEDA, Quebec Law 25 and, where applicable, PHIPA in respect of personal health information handled by the home), you may have the right to access, correct or delete your personal information. Because most employment data is controlled by your home, please contact your home's administrator or HR first; they can correct or remove records directly. You may also contact us at connect@careshiftltc.com and we will help or direct your request appropriately. Signed-in users can also download a copy of their own information at any time from My Profile → “My information & privacy”, without going through their home. You can unsubscribe from non-essential emails using the link in those messages; service-critical notifications (such as security alerts) cannot be opted out of while your account is active.
If information about you is wrong or incomplete, you can ask for it to be corrected from My Profile → “Ask for a correction”. The request goes to your home's HR team, who must answer within 30 days. If they agree, the record is corrected. If they refuse, they must tell you why, and you may write a statement of disagreement, which we attach to the record permanently so that anyone who later reads it also sees your account. Every request, response and statement is kept in the audit trail.
Our Privacy Officer is responsible for this policy and for answering access, correction and complaint requests. You can reach the Privacy Officer at privacy@careshiftltc.com or by mail at Privacy Officer, Arzyn Brothers Inc., 42 - 400 Newman Drive, Cambridge, Ontario, N1S 0E8. We acknowledge requests within 5 business days and respond within 30 days; if we need longer, we will tell you why and give you a new date.
If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada. In Ontario, complaints about personal health information go to the Information and Privacy Commissioner of Ontario. Quebec, Alberta and British Columbia have their own provincial commissioners. You do not have to come to us first, and we never penalize anyone for making a complaint.
We do not use advertising or cross-site tracking cookies, and we do not sell or share information with advertisers. The public website uses no analytics cookies. Inside the app we store only what is needed to keep you signed in and working: your sign-in session, your choice of whether a computer is private or shared, and small preference settings such as your last-used view. These are stored on your own device and are cleared when you sign out or clear your browser. Because none of these are optional or used for tracking, no cookie banner is required — but you can block them in your browser, in which case sign-in will not work.
Our current, dated list of service providers — what each one does, the information involved and where it is processed — is published at careshiftltc.com/suppliers. We notify each home's administrators before adding or replacing a provider that processes personal information.
CareShiftLTC serves long-term care and retirement homes in Canada only. Your records — accounts, schedules, attendance, documents and audit logs — are stored in Canada, in our database and file storage hosted in the Toronto region, and are subject to Canadian federal and provincial law.
Some supporting services necessarily process limited information outside Canada, mainly in the United States:
Each of these providers is bound by contract to process information only on our instructions and to protect it with comparable safeguards. While information is outside Canada it may be accessible to the courts and law-enforcement authorities of that country. Homes that need to avoid this can turn off AI features and optional text-message alerts in Home setup.
The service is intended for adults employed or engaged by long-term care homes and is not directed at children. We do not knowingly collect information from anyone under 16.
We may update this policy from time to time. Material changes will be announced in the app or by email, and the "Last updated" date above will change. Continued use after an update means you accept the revised policy.
Questions about this policy or your information: connect@careshiftltc.com
Telephone: 1-888-812-0777 (toll-free across Canada). Please do not share resident health information by phone or text.
Legal entity: Arzyn Brothers Inc. (Ontario Corporation Number 1374912-6)
Registered office: 42 - 400 Newman Drive, Cambridge, Ontario, N1S 0E8, Canada
Mailing address: 42 - 400 Newman Drive, Cambridge, Ontario, N1S 0E8, Canada
See also our Terms of Service and Request Account & Data Deletion.