Account privacy

Creating and protecting your account

The site stores your account name, sign-in email, email-confirmation status, and account dates. If you use an account password, the site stores a hash rather than the password itself. Sign-in records include session times, browser information, and network information used to protect access. Your account security page shows a simplified browser or device label and lets you end other sign-ins.

Your account and your hospital directory link are separate. Creating an account or signing in with Google or Facebook does not grant hospital access or permission to edit a schedule.

Signing in with Google or Facebook

If you choose an available social sign-in option, that provider sends the site an account identifier and, when available, your name, email address, and profile image. The site uses this information to create or recognize your account and let you sign in. The provider identifier is saved with your account. OAuth access and refresh tokens, when supplied, are encrypted before storage.

Social sign-in requests only basic identity and email permissions. It does not give this site access to your Gmail inbox, contacts, Google Drive files, Facebook posts, or permission to post for you. Your password for Google or Facebook is entered with that provider and is not shared with this site.

Google or Facebook receives the sign-in request and handles it under its own privacy policy. You can manage the connection in your provider’s account settings. Removing that connection does not by itself delete information already stored by The Providers’ Well or sign you out of existing site sessions.

Linking your directory entry

The site checks the full phone number or email you enter against the selected directory entry. The claim record uses a fingerprint of the matched contact detail; it does not keep the raw quiz answer. Directory information already stored in WellCall remains part of the hospital directory.

The site owner can review your account name, account email, requested directory entry, verification status, and review history to make an access decision. Member name-search results during enrollment show only the name, category, and entry identifier needed to select a profile.

Personal calendars and private availability

My availability lets you share busy times and work preferences without sharing personal event titles, locations, attendees or notes. Calendar files are processed on your device; only approved busy start/end intervals are sent. Google Calendar connection requests busy-time and read-only calendar-list access separately from social sign-in. Calendar names pass through the server to your own calendar selector. Selected calendar identifiers and connection credentials are stored to refresh your busy times.

Imported busy times are unavailable by default. You may explicitly mark a time as “Strongly prefer free” or “Prefer free.” These are scheduling preferences that may be outweighed by coverage needs; unavailable time remains protected. Priorities describe time periods, not event identities, and no event content or reason is imported to infer importance. Review your choices after calendar changes.

Busy intervals, private priorities, work preferences and calendar credentials are encrypted at rest under a dedicated runtime key. Other members and administrators cannot browse your private times, priorities or connected calendars through WellCall. The server can decrypt these records for scheduling, and someone with infrastructure and encryption-key access could read them; this is not end-to-end encryption. Administrators see proposed work assignments and coverage totals, not private calendar records or preference scores. Scheduling outcomes can reveal likely availability, so this is not a promise of anonymity. Your consent determines whether open time may be treated as general availability. Stale imports are not treated as confirmed free time.

AI group planning is a separate opt-in, initially off. OpenAI receives randomized per-review pseudonyms, relative work patterns, compatible shift options, numeric preference costs and constraints, and day/night preferences—not your name, actual calendar dates, raw busy times or event details. Work patterns may still be recognizable. Background AI processing uses temporary provider storage for polling even with long-term response storage disabled; it is not zero-data-retention processing. Provider abuse-monitoring retention may also apply. WellCall requests deletion after collecting results and attempts cancellation/deletion of superseded jobs; failed cleanup remains subject to the provider’s retention policy. Keep the review page open while it runs. If a result expires, you can start a new review without losing your saved availability. The owner sees validated group work assignments; other members see only their own suggestions. Turning off AI planning excludes your inputs from new drafts and invalidates older drafts.

Use My availability to disconnect a source or clear your private busy times, priorities and preferences. These actions do not cancel your master shifts. Provider revocation is attempted on disconnect; you can also remove the permission in Google’s account settings. Operational account/contact bindings and record versions remain for access control. Infrastructure backups may retain earlier encrypted versions according to hosting retention.

Verification texts and consent

Text confirmation is currently off. No verification messages are sent or checked. Eligible personal-mobile matches and confirmed account emails provide viewing access; a number match is not proof of phone possession. Existing verification configuration and historical consent records remain stored for future use and auditing.

If text confirmation is enabled and you request a verification text, Twilio receives the destination mobile number and the information needed to send and check a code. The site keeps evidence of your choice: your account and claim identifiers, a fingerprint of the destination, the notice version, a request fingerprint, and the time you agreed.

Consent to enrollment texts is used for that verification request. It does not opt you into promotional texts. You can use owner review without requesting a text. See the SMS terms for messaging help and how to stop messages.

Account email

When you request a verification or password-reset email, Resend receives the email address and message to deliver it. The account page reports whether email delivery is available. These messages help confirm your email or recover access; they do not subscribe you to promotional email.

Forgotten-password recovery preserves your existing permissions, including schedule viewing, editing, and staff-office access. It signs out all devices and cancels unfinished profile verification, which must be restarted.

Requesting deletion

Use Account data requests to request deletion of your account and associated personal data. Sign in and submit your request before removing a Google or Facebook connection you need to access the account.

The site saves your account identifier, request number, request time, optional note, and review status. The owner can review your request and record a response; the reviewer and review time are also recorded. A submitted or reviewed request is not confirmation that data has been deleted. Account data and hospital records are reviewed separately, as explained on the request page.

Security history and your choices

Directory approvals, access changes, and verification consent are recorded so the owner can investigate problems and manage membership. Security and review records can remain after a code or sign-in expires.

Use Account security to change your password or end other sessions. Use owner review on your member page for help with a directory link. Contact the site organizer about corrections to account or directory information. Keep patient information out of enrollment and verification notes.