Privacy Policy

1. Scope

This policy applies to the N-Ship web and mobile nurse shift scheduling service (“Service”).

2. Personal data we collect

• Account: name, email, hashed password, affiliation (team/ward), role/permissions
• Service use: schedule settings, generated schedules/request history, inquiries
• Logs: usage records, access times, error logs, IP (security/abuse prevention)
• Cookies/similar tech: minimum data for sessions and UI settings, and (when configured) usage analytics
• Social login: profile fields within the consented scope

3. How and when we collect

• Direct input at signup/login, profile edits, settings saves, and inquiries
• Logs/cookies created automatically while using the Service

4. Purposes of use

• Identify users, authenticate, and manage permissions
• Provide core features such as schedule generation/management and request handling
• Respond to inquiries and send service notices
• Stability, error analysis, and quality improvement via de-identified statistics
• Detect and respond to security anomalies

5. Retention

• In principle, delete without delay when the account is closed or the purpose is fulfilled
• Exceptions: retain for periods required by law (disputes, transaction records, etc.)

5-1. Retention summary

• Account/profile: kept while in use; deleted on withdrawal
• Schedules/request history: kept for a reasonable period for service and disputes, then deleted
• Access/error logs: kept for a reasonable security/audit period

6. Sharing with third parties

We do not provide personal data to third parties except with consent or where law requires.

7. Processors

We may entrust infrastructure, security, or log monitoring within the scope needed to run the Service, and will disclose the processor, scope, retention, and safeguards.

8. Cross-border transfer

We do not principally transfer personal data abroad. If Google Analytics 4 (Google LLC, USA) and/or Naver Analytics are enabled for web usage statistics, cookies, device/browser identifiers, visited pages, and events (sign-up, login, schedule generation, etc.—excluding personal identifiers) may be sent to those providers.

If further transfers become necessary, we will disclose purpose, items, location, and retention in advance and obtain consent where required.

9. Your rights

• You may request access, correction, deletion, or suspension of processing.
• How: use Inquiries in the Service or contact the administrator
• We will handle requests without delay unless law provides an exception.

10. Cookies and similar technologies

We may use essential cookies for sessions and convenience features. We may also use analytics cookies (Google Analytics 4, Naver Analytics, etc.) to improve the Service; scripts load only when measurement IDs are configured. You can refuse cookies in browser settings, but some features may be limited.

10-1. Cookie categories

• Essential: login persistence, security, and required service delivery
• Functional: user preferences such as theme/language
• Analytics: de-identified visit/usage measurement for quality improvement (e.g. GA4/Naver Analytics). Analytics events do not include name, email, or account IDs.

11. Destruction

• Destroy without delay when the purpose is fulfilled, retention ends, or the account is closed
• Electronic files: permanently delete with non-recoverable methods
• Paper: shred or incinerate

12. Security measures

• Least-privilege access and account controls
• Encryption in transit; hashed passwords
• Access log retention and integrity protections
• Physical/technical safeguards and reviews

13. Contact

For privacy questions or rights requests, use Inquiries in the Service. We will respond as promptly as possible.

14. Legal basis and governing law

This policy follows applicable Korean laws including the Personal Information Protection Act. Collection and use rely on lawful bases such as consent, contract performance, and legal obligations.

15. Children’s data

We do not collect or use personal data of children under 14 without a legal guardian’s consent. Where needed, we will provide consent steps in advance.

16. Changes to this policy

Material additions, deletions, or edits will be announced in the Service at least 7 days in advance (30 days for significant changes).

17. Privacy officer

• Name/role: Administrator
• Contact: Inquiries in the Service