Privacy Notice

1. Who we are

Scrubs.Health is operated by MyCityCopilot ("we", "us"). MyCityCopilot is the data controller for the personal data described in this notice — we decide why and how it is processed.

2. Personal data we collect, and why

• Account data (email address, password credentials, Google sign-in identifier) — to create and secure your account. Legal basis: performance of our contract with you.
• Profile data (name, school, program type, hour goals) — to personalize your log and produce attestation documents. Legal basis: contract.
• Hour log content (dates, times, categories, notes, provider and facility details you save, and signed verification documents you upload) — to provide the core record keeping service. Legal basis: contract. Please do not enter patient names or protected health information.
• Support messages — to answer your questions. Legal basis: legitimate interests in supporting our users.
• Usage and technical data (log records, device identifiers, IP address, error reports) — to keep the Service secure, prevent fraud and abuse, and improve reliability. Legal basis: legitimate interests.
• Marketing communications, where you opt in — legal basis: consent, which you may withdraw at any time.

Payment card details are collected and processed by Paddle, not by us; we never see or store your card number.

3. Who we share data with

• Service providers / subprocessors — hosting, database and file storage, authentication, email delivery, error monitoring and support tooling, acting on our instructions.
• Merchant of Record — Paddle.com, which handles the sale of our product, checkout, payments, tax compliance, invoicing and refunds.
• Professional advisers — legal and accounting advisers where necessary.
• Authorities — where required by law or to protect our legal rights.

We do not sell your personal data.

4. Provider registry searches

Provider and facility searches query the public CMS National Plan & Provider Enumeration System (NPI) registry. Only the search text you type is sent; your identity is not.

5. Retention

We keep your account, log entries and uploaded documents for as long as your account is active, so your verified hour log stays available across application cycles. If you delete your account, we delete or anonymise your data within 30 days, except records we must retain for legal, tax or accounting purposes. Technical logs are kept for a limited period and then deleted.

6. Security

We apply appropriate technical and organisational measures, including encryption in transit, encrypted storage, row-level access controls so each student can only reach their own records, and a private storage bucket for uploaded signed documents.

7. International transfers

We operate from the United States and our providers may process data in the US and other countries. Where data is transferred from the UK or EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or port your personal data, to object to processing based on legitimate interests, to withdraw consent, and to opt out of marketing. Residents of the UK/EEA may also lodge a complaint with their supervisory authority. Email support@scrubs.health and we will respond within one month.

9. Cookies

We use essential cookies and local storage to keep you signed in and to operate the checkout. We do not use advertising cookies. You can clear or block cookies in your browser, though sign-in will not work without the essential ones.

10. Children

The Service is intended for students aged 16 and over and is not directed at younger children.

11. Contact

MyCityCopilot — support@scrubs.health. We will post any changes to this notice on this page.