Privacy Notice

This notice says what Angel Squad collects, why, who sees it, how long it is kept, and what you can do about
it. It is written to be read rather than to be survived.

What we collect

Because you gave it to us. Your name, email address, and optional phone number. Your profile: role,
facility type, credentials and licences you choose to record, work history, education, job preferences,
résumé. Everything you post, comment, message, upload or schedule. What you tell the contact form.

Because the service runs. Sign-in events, sessions and the devices they are on, an audit record of
administrative actions, operational logs, and delivery records for the email we send you. Your IP address is
kept as a salted hash, not in the clear, so it can be matched against a later event without being readable
as a location.

Because a browser sends it. A session cookie once you sign in, and a device cookie of 128 random bits that
lets us tell one browser from another for security purposes. Neither is a tracking profile, and there are no
third-party advertising or analytics cookies on this site at all.

What we do not collect. We do not buy data about you. We do not sell or rent anything about you to anybody.
We do not run behavioural advertising. And we do not want patient information: the terms prohibit posting it,
and content that looks like it is escalated to our staff for removal.

Why we use it

To run your account and sign you in; to show your content to the people you chose to share it with; to send
sign-in links, security alerts, and the notifications you asked for; to keep the service secure and to
investigate abuse; to answer you when you contact us; and to meet legal obligations. Where the law asks us to
name a basis: performing our agreement with you, our legitimate interest in a secure and functioning service,
your consent for optional communications, and legal obligation for the rest.

Who sees it

• People you shared with. Every post carries a visibility — public, community, organisation, group, or
  connections — and that setting is what decides who can read it. Your profile has its own visibility setting.
• Organisation administrators, for what happens inside their organisation. Not your direct messages with
  people outside it, and not your personal calendar.
• Our staff, when moderating reported content, investigating a security event, answering support, or
  operating the service. Administrative access is recorded in an append-only audit log, and an administrator
  acting as you is marked as such on every record it produces.
• Service providers who process data for us, under contract and nothing more: our hosting provider, the
  provider that delivers our email, and error and uptime monitoring. Notification email is deliberately kept
  content-free, so the provider that carries it never learns what a message says.
• Nobody else, unless the law compels it or you ask us to. If we are compelled and are allowed to tell you,
  we will.

How it is protected

Traffic is encrypted in transit (TLS 1.3, and DTLS-SRTP for calls) and content is encrypted at rest (AES-256)
with documented key custody. Access to production is limited and audited. Every account can hold a second
factor, and administrative accounts must. Media for calls is served from infrastructure we run, not from a
third-party conferencing service. Each deployment is single-tenant: your data is not co-mingled with another
customer's in a shared application database.

We do not offer a scheme in which only the participants hold the keys, and we would rather say so plainly than
imply otherwise. The server holds message content because legal holds, moderation, export and audit — the
controls healthcare organisations actually require of us — cannot be honoured on content the server cannot
read.

How long we keep it

• Your account and profile: until you delete it.
• Posts, comments and documents: until you delete them, then removed on our purge schedule.
• Chat and direct messages: 365 days by default; an organisation may set a shorter period for its own
  channels.
• Operational event logs: 30 days.
• Audit records: kept long-term. They are how we can tell you who did what to your account, and they are
  append-only for the same reason.
• Backups: on a rolling schedule; a deletion reaches them as they age out.
• Legal holds override all of the above for as long as the hold lasts.

What you can do

You can see and correct your profile at any time, change what each part of it is visible to, download an export
of your data, and delete your account. Deletion has a short grace period, then removes or anonymises your
content. You can turn off every optional email; sign-in and security email keeps working, because it is how you
get back in and how you find out something happened. Every marketing or digest email carries a one-click
unsubscribe that is scoped to that kind of message and to no other.

Depending on where you live you may also have the right to object to processing, to restrict it, to ask for it
in a portable form, or to complain to a supervisory authority. Ask us through the contact form on the help page
and we will do it.

Children

Angel Squad is for working adults. It is not for anyone under 18, and we do not knowingly hold data about
children. If you believe we do, tell us and we will delete it.

Where data lives, and changes to this notice

The service and its backups are hosted in the United States. If we change this notice materially we publish a
new version number and ask you to acknowledge it the next time you sign in; older versions stay available.

Questions, requests and complaints go through the contact form on the help page.