Privacy Policy

1. Who we are and what this Policy covers

1.1 Alder Ridge Health Technologies LLC ("Alder Ridge", "we", "us") provides FullFloor Scheduling ("FullFloor" or the "Service"), a staff scheduling tool for skilled nursing facilities.

1.2 This Policy covers the website at fullfloor.app, the Service at app.fullfloor.app (including when it is added to a phone's home screen), and the emails, text messages and push notifications the Service sends.

1.3 The Service is used by businesses. Our Subscription Terms of Service govern each facility's account. This Policy explains what personal information we handle and why.

2. The people this Policy is about, and our role for each

3. Information we collect

3.1 From account holders. Facility name; your name; work email address; a password (stored only in hashed form by our sign-in provider); the network address and browser used when the account was opened and when you accept our Terms; two-step verification enrollment; payment card details, which are entered directly with our payment processor, Stripe (we store only the last four digits and card brand, and the billing status of the account); support correspondence.

3.2 About staff users, provided by the facility or by the staff member.

• Roster details: name, job title or position, department, work phone number and extension, email address, employment type, certifications and license numbers, and whether the person has been invited to or has set up a login.
• Pay rate, if the facility chooses to enter it or import it from a payroll file. Pay information is visible only to the facility's administrators unless the facility decides otherwise.
• Schedule and attendance: scheduled shifts, published schedules, call-off requests and decisions, open-shift offers and responses, overtime swap offers, time-clock punches, attendance check-ins, and reports computed from these.
• Room assignments and sign-offs: assigned rooms and beds (room numbers and bed labels only), run acceptances and daily sign-in sheet records, which include the statement accepted, the name typed, the date and time, the method, the device and network address used, and a tamper-evident checksum.
• Room rounds: findings about a room and photos of the room. Facilities agree not to photograph residents.
• Files the facility uploads or emails in: payroll and time-clock exports, schedule sheets and roster files sent to the facility's address at reports.fullfloor.app, and timesheet or license scans for agency staff.
• Notifications: notification preferences; text-message consent status and the date consent was requested and confirmed; push notification registrations for the person's device or browser.
• Sign-in details: email and password, or the phone number and one-time code used to sign in by text; session information; the date the person last opened the app.
• Assistant conversations: the questions a scheduler or staff member types to the Assistant and its replies.

3.3 From website visitors. The website is a set of static pages. We do not collect information through it beyond what any web server receives with a request (such as your network address, browser type and the page requested), which our hosting provider may keep in standard server logs for security.

3.4 Sources. We receive information from you, from your facility (which enters or imports it), from your device (push registration, browser details), and from our providers (for example, Stripe tells us whether a payment succeeded and Telnyx tells us whether a text was delivered).

3.5 Resident and patient information. The Service is not designed for information about residents or patients, and facilities agree in our Terms not to enter it. If we find it, we remove it.

4. How we use information

• To provide the Service: build and show schedules, offer open shifts, record call-offs, punches, assignments and sign-offs, read the schedule and roster files a facility sends in, produce reports, and answer questions put to the Assistant. The Assistant and the automated reading of uploaded files run on Amazon Web Services; the relevant schedule and roster information is sent there to produce the answer or the reading, and is not used to train any model.
• To send notifications by push, email and text about the person's own schedule and shift offers. Shift offers are sent first to staff whose scheduled hours would not put them into overtime, and then to everyone; whether a shift is filled is decided by the facility's scheduler.
• To sign people in and keep accounts secure: passwords, two-step verification, one-time codes by text, session cookies, a bot check at sign-up, rate limits and an access log.
• To bill the facility through Stripe.
• To support you when you contact us.
• To meet legal obligations and to establish or defend legal claims, including keeping records of agreements accepted.
• To operate and improve the Service, using information about how it is used in a form that does not identify a facility or a person.

We do not use personal information for advertising, we do not sell it, and we do not share it for cross-context behavioral advertising. We do not make decisions with legal or similarly significant effects about staff by automated means; scheduling decisions are made by the facility.

5. How we share information

5.1 Inside your facility. Administrators and managers of a facility see the staff information their role allows. Staff see their own schedule, their own shifts and the open shifts offered to them. Pay information is limited to administrators unless the facility changes that setting.

5.2 Providers that run the Service. We share information with the providers below, only as needed for them to provide their service to us, under contracts that restrict their use of it. All are in the United States unless noted.

5.3 Legal and safety. We may disclose information when the law requires it, to respond to lawful requests, or to protect the rights, safety or property of a facility, its staff, the public or us.

5.4 Business transfers. If Alder Ridge is acquired or merges, or sells the FullFloor business, information may transfer to the successor, who will be bound by this Policy until it is changed with notice.

5.5 Text-message information. Mobile phone numbers, text-message consent records and message content are used only to deliver the messages described in Section 4. They are not shared with third parties or affiliates for marketing or promotional purposes.

6. Cookies and similar technologies

6.1 The Service (app.fullfloor.app) uses cookies that are necessary to sign you in and keep you signed in, and a cookie that records whether your session is active. These are set by the Service, are not readable by other sites, and are cleared when you sign out. Your light-or-dark display preference is kept in your browser's local storage. The bot check on the sign-up page is provided by Cloudflare and may set its own cookie for that purpose.

6.2 The website (fullfloor.app) sets no cookies and runs no analytics or advertising scripts.

6.3 Because we do not track people across other websites or apps, there is nothing to opt out of, and browser "Do Not Track" or Global Privacy Control signals do not change how the Service works.

7. How long we keep information

• While a facility's account is active: we keep the facility's information so the Service can work. The facility controls its roster and can remove people from it.
• After a facility cancels: we keep its information for 90 days so the facility can reactivate and export it. The facility's data is deleted automatically 90 days after cancellation, or sooner at the facility's written request. Copies age out of our backups within 12 months after that.
• Unfinished sign-ups: an account created without a payment card or code is deleted automatically after 7 days.
• A user's own login: a user can delete their login in account settings. Their profile is anonymized and their login removed; the facility's records in which they appear are not changed.
• Records we keep longer: records of agreements accepted, the log of administrative actions, and billing records are kept for up to 6 years, or longer if the law requires, so we can show what was agreed and meet our own obligations.

8. Security

We use commercially reasonable measures to protect information, including encryption of traffic between your browser and the Service, encryption of stored data by our database provider, database-enforced access rules that separate each facility's data on every table, two-step verification (required for owners and administrators), role-based access inside each facility, sign-off records that can be written only by the Service and never edited or deleted afterwards, an append-only log of administrative actions, daily database backups by our database provider, and a bot check and rate limits on sign-up and sign-in. No method of storage or transmission is completely secure, and we cannot promise absolute security. Keep your password private and turn on two-step verification.

9. Your rights and choices

9.1 Everyone. You can ask us to tell you what personal information we hold about you, to correct it, or to delete it, and you can ask for a copy. Email support@fullfloor.app. We will verify that the request comes from you, usually by writing back to the email address on the account, and we will answer within 45 days. Where we hold your information as a facility's service provider (Section 2), we will pass your request to the facility and help it respond; the facility decides, because it is the employer.

9.2 California residents. If the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies, California residents have the right to know what personal information we collect, use and disclose; to request deletion; to request correction; to receive a copy in a portable form; to opt out of sale or sharing of personal information (we do not sell or share it); to limit the use of sensitive personal information (we use it only to provide the Service); and not to be discriminated against for exercising these rights. You may use an authorized agent; we will ask the agent for proof of authority and may confirm with you directly. Where your facility is the "business" and we are its "service provider" for your information, your rights are exercised through your facility.

9.3 Notice at collection (California). The table below lists the categories of personal information we collect, the purposes, and how long we keep each. We do not sell or share personal information.

9.4 Notifications. Reply STOP to any text to stop receiving texts. Turn off push notifications on your device. Account and security emails are necessary to run the Service and cannot be turned off while you have an account.

9.5 Other states. Residents of other states with privacy laws may have similar rights. Contact us and we will apply the rights the law gives you.

10. Children

The Service is for working adults. It is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has provided information to us, contact us and we will delete it.

11. Where information is stored

Information is stored and processed in the United States. Our database is hosted in the US East (Ohio) region, and our other providers are in the United States. If you use the Service from outside the United States, your information will be transferred to the United States.

12. Changes to this Policy

We may update this Policy. We will post the new version with a new version date, and for a material change we will email the facility's administrator at least 30 days before it takes effect. Using the Service after that date means you accept the updated Policy.