Privacy Policy

At Dokk ("we," "us," or "our"), we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our on-call scheduling platform at dokk.app and oncall.dokk.app (collectively, the "Service").

Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the Service.

1. Information We Collect

1.1 Information You Provide to Us

We collect information that you voluntarily provide when using our Service:

• Account Information: Name, email address, phone number, job title, and organization details
• Profile Data: Doctor profiles, preferences, availability, and scheduling preferences
• Schedule Data: On-call assignments, shift information, and historical scheduling data
• Communication Data: Messages, support requests, and feedback you send to us
• Payment Information: Billing details processed securely through our payment processors (we do not store full credit card numbers)

1.2 Information Automatically Collected

When you access our Service, we automatically collect certain information:

• Log Data: IP address, browser type, operating system, access times, and pages viewed
• Device Information: Device type, unique device identifiers, and mobile network information
• Usage Data: Features used, actions taken, and interaction patterns
• Cookies and Tracking: We use cookies and similar technologies (see Section 7)

1.3 Information from Third Parties

• Authentication providers (if you use SSO)
• Payment processors
• Analytics providers

2. How We Use Your Information

We use the information we collect to:

• Provide and Maintain the Service: Create schedules, track assignments, send notifications
• Process Transactions: Handle billing and payments
• Communicate with You: Send service updates, security alerts, and support messages
• Improve Our Service: Analyze usage patterns to enhance features and user experience
• Ensure Security: Detect fraud, prevent abuse, and protect our users
• Comply with Legal Obligations: Respond to legal requests and prevent harm
• Personalize Experience: Customize features and recommendations based on your usage
• Marketing (with consent): Send promotional materials about new features (you can opt out anytime)

3. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

3.1 Within Your Organization

Schedule information is shared with other users within your organization (tenant) as necessary for scheduling purposes.

3.2 Service Providers

We share data with third-party vendors who provide services on our behalf:

• Cloud hosting providers (e.g., AWS, Google Cloud)
• Payment processors (e.g., Stripe)
• Email service providers
• Analytics services (e.g., Google Analytics)
• Customer support tools

These providers are contractually obligated to protect your data and use it only for the services they provide to us.

3.3 Legal Requirements

We may disclose your information if required by law or in response to:

• Valid legal processes (subpoenas, court orders)
• Government requests
• Protection of our rights, property, or safety
• Emergency situations involving danger to persons

3.4 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.

3.5 With Your Consent

We may share your information for any other purpose with your explicit consent.

4. Data Retention

We retain your information for as long as necessary to:

• Provide our Service to you
• Comply with legal obligations
• Resolve disputes and enforce agreements
• Maintain business records

When you delete your account, we will delete or anonymize your personal information within 90 days, except where we are required to retain it for legal or regulatory purposes. Schedule data may be retained for historical record-keeping purposes but will be anonymized.

5. Data Security

We implement industry-standard security measures to protect your information:

• Encryption: Data is encrypted in transit (TLS/SSL) and at rest (AES-256)
• Access Controls: Role-based access and multi-factor authentication
• Regular Audits: Security assessments and vulnerability testing
• Secure Infrastructure: Hosted on secure, certified cloud platforms
• Employee Training: Staff trained on data protection and security practices
• Incident Response: Procedures in place for security breaches

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

6. Your Privacy Rights

Depending on your location, you may have the following rights:

6.1 Access and Portability

You can request a copy of your personal information in a portable format.

6.2 Correction

You can update or correct your information through your account settings or by contacting us.

6.3 Deletion

You can request deletion of your personal information, subject to legal retention requirements.

6.4 Restriction

You can request that we limit how we use your information.

6.5 Objection

You can object to our processing of your information in certain circumstances.

6.6 Opt-Out

You can opt out of marketing communications at any time by clicking "unsubscribe" in emails or updating your preferences.

To exercise these rights, contact us at privacy@dokk.app. We will respond within 30 days.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Essential Cookies: Required for the Service to function (authentication, security)
• Performance Cookies: Help us understand how users interact with our Service
• Functionality Cookies: Remember your preferences and settings
• Analytics Cookies: Measure site traffic and usage patterns

You can control cookies through your browser settings, but disabling essential cookies may limit Service functionality.

8. HIPAA Compliance

For Enterprise customers who require HIPAA compliance, we offer Business Associate Agreements (BAA). Under a BAA:

• We commit to safeguarding Protected Health Information (PHI)
• We implement additional technical and organizational safeguards
• We comply with HIPAA Security and Privacy Rules
• We report breaches as required by law

Note: Standard plans do not include a BAA. If your use case involves PHI, please upgrade to an Enterprise plan and contact us to execute a BAA.

9. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child, we will delete it promptly.

10. International Data Transfers

Our Service is hosted in [specify region, e.g., "the United States"]. If you access our Service from outside this region, your information may be transferred to, stored, and processed in countries where our servers are located.

We ensure appropriate safeguards are in place for international transfers, including:

• Standard Contractual Clauses
• Data Processing Agreements
• Compliance with applicable data protection laws

11. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to know what personal information we collect and how we use it
• Right to request deletion of your personal information
• Right to opt-out of the sale of personal information (we do not sell personal information)
• Right to non-discrimination for exercising your privacy rights

To exercise these rights, contact privacy@dokk.app or call [phone number].

12. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), you have rights under the General Data Protection Regulation:

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent
• Right to lodge a complaint with a supervisory authority

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the new policy on this page with an updated "Last Updated" date
• Sending an email notification to registered users
• Displaying a prominent notice on our Service

Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

14. Third-Party Links

Our Service may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.