Last updated: October 10, 2026
CareShiftLTC is a staff scheduling and workforce platform. It does not collect, store or process resident charts, clinical care notes or resident personal health information as defined under provincial health privacy law (including Ontario's PHIPA). Staff information is limited to administrative data such as contact details, availability, schedules, professional designations and licence or clearance expiry dates.
CareShiftLTC uses a small number of outside service providers to run the application. Each one is bound by a written agreement that limits it to processing information only on our instructions and to the standard of protection required by Canadian privacy law (including PIPEDA). This page is the current, dated list. Core records are stored in Canada (Toronto region); the providers marked below as processing outside Canada handle only the narrow information described.
Cross-border notice: information processed or in transit outside Canada may be accessible to the courts, law-enforcement and national-security authorities of that country under its laws.
These are always in use whenever a home uses CareShiftLTC.
| Provider | What it does | Information involved | Where processed |
|---|---|---|---|
| Supabase (Toronto region) | Database, authentication and file storage — the system of record | All account, scheduling, attendance, certification and document data | Canada (ca-central-1, Toronto) |
| Vercel | Application hosting and content delivery | Requests in transit; no records stored at rest | Global edge network, including the United States |
| Lovable | Development and deployment platform for the application | Application code and configuration; no routine access to home data | European Union and United States |
These are used only for the feature named. A home can turn off AI features and optional text or push alerts in Home setup, which removes those providers from its data flow.
| Provider | What it does | Information involved | Where processed |
|---|---|---|---|
| Amazon SES | Transactional email — invitations, alerts, password resets | Name, work email address, message content | Canada (ca-central-1, Montreal) |
| Resend (backup email delivery) | Backup transactional email delivery if Amazon SES is unavailable | Name, work email address, message content | United States |
| Telnyx (optional text message alerts) | Text message shift call-outs and alerts to staff who opt in (add-on; off unless the home enables it) | Staff mobile number and the operational alert text (shift date, time, designation, home name) — no resident or health information; message content is not retained | Canada / United States (carrier routing) |
| Stripe | Subscription billing for the home (not for staff) | Billing contact and payment details of the home | United States |
| Firebase Cloud Messaging (Google) | Push notifications to the mobile app | Device token and notification text | United States |
| Google Maps Platform | Address lookup and clock-in geofence distance | Home address, punch coordinates | United States |
| Google Gemini (AI features) | Bulk schedule import and union-contract reading — only when a home turns AI on | Only documents an authorized HR user or administrator chooses to upload. Processed to provide the feature and never used to train or improve public AI models | United States |
Before we add a provider that will process personal information, or replace one already listed, we update this page with a new date and notify each home's administrators by email at least 30 days in advance, unless a shorter period is needed to keep the service secure or available. Emergency changes are posted here and emailed within 5 business days.
A home that objects to a new provider may raise it with our Privacy Officer at privacy@careshiftltc.com, and may end its subscription without penalty if the change is material and we cannot offer an alternative.
See our Privacy Policy for what we collect and your rights, and our Terms of Service for the roles of the home and CareShiftLTC.