Privacy Policy

This Privacy Policy explains how [Bobbi legal entity name] ("Bobbi", "we", "us") collects, uses, shares, and protects personal information when you use the Bobbi mobile application, web portals, and website (the "Platform"). Bobbi connects dental practices ("Clinics") with dental professionals ("Professionals") for temporary shifts.

We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable Canadian privacy laws. By using the Platform you consent to the practices described in this Policy.

Information you provide directly:

• Account information: first and last name, email address, mobile phone number, password (stored in hashed form by our authentication provider), and profile photo.
• Professional profile (Professionals): dental role(s), years of experience, bio, minimum hourly rate, weekly availability and working hours, home address, and preferred travel radius. Your address is converted to geographic coordinates so we can match you with nearby shifts.
• Credentials (Professionals): licence or registration type, issuing body (e.g., RCDSO, CDHO, ODAA), licence number, issue and expiry dates, and images or PDFs of licence and certification documents you upload.
• Clinic information (Clinics): clinic name, description, address (also converted to coordinates), phone number, contact email, website, logo, and office photos.
• Shift and work records: shifts posted, applications and offers (including proposed rates and times), bookings, check-in and check-out times, timesheets (hours, breaks, pay amounts), invoices, and payment status confirmations.
• Communications: messages you send through in-app chat (including structured counter-offers), disputes and dispute notes, reviews and ratings, feedback and support requests.
• Call records: when you start a phone call from the Platform, we log who initiated the call, the recipient, the phone number dialed, and the related shift or conversation. We do not record the audio of calls.
• Referral information: your referral code, codes you use, and rewards you earn.
• Preferences: your notification settings (push, SMS, and email categories). Marketing email is off by default and sent only if you opt in.

Information collected automatically:

• Usage and log data, including IP addresses recorded in our security audit logs, timestamps of actions, and records of changes to important records (such as profiles, credentials, and invoices).
• Basic device information needed to run the app and deliver notifications.

The Platform does not currently use third-party advertising, ad tracking, or product analytics services, and we do not currently obtain information about you from data brokers or background check providers.

• When you enter an address, the text you type is sent to our address-search provider (Photon, operated by komoot) to suggest matching addresses, and the selected address is stored as precise latitude/longitude coordinates.
• We use these coordinates to show nearby shifts to Professionals, to show approximate distance between a Professional and a Clinic, and to display locations on maps.
• Map images are loaded from map tile providers (OpenStreetMap and CARTO on the web, and Apple Maps or Google Maps in the mobile app), which receive your IP address and the map area you view in order to serve the map.
• We do not track your real-time device location in the background.

• To operate the marketplace: creating profiles, matching Professionals with nearby shifts by role, rate, and distance, processing applications, bookings, timesheets, and invoices.
• To verify credentials: our team manually reviews uploaded licence documents to confirm they appear authentic and valid.
• To enable communication: in-app messaging, offers, and call connections between Clinics and Professionals.
• For trust and safety: displaying ratings and reviews, resolving disputes using platform records, investigating violations of our Terms, and maintaining security audit logs.
• To provide support and respond to feedback and bug reports.
• To send service communications (such as application updates, timesheet and payment status, and shift reminders) according to your notification preferences, and marketing email only with your opt-in consent.
• To operate the referral program and prevent fraud or abuse.
• To comply with legal obligations and enforce our Terms.

We do not sell personal information, and we do not use it for third-party advertising.

The Platform is a marketplace, so parts of your information are visible to other users:

• Professionals: your name, photo, dental role(s), experience, bio, rating, reviews, and approximate distance or area are visible to Clinics reviewing applicants or profiles. Your exact home address is not shown to Clinics.
• Clinics: your clinic name, address, photos, description, rating, and posted shifts are visible to Professionals.
• When an application is accepted, the parties can message each other in-app and may be connected by phone to coordinate the shift.
• Credential documents and licence numbers are visible only to you and to authorized Bobbi personnel for verification — Clinics see your verification status, not your documents.
• Reviews you write are shown with your name.

We share personal information only as described here:

• Service providers that host and run the Platform: Supabase (database, authentication, file storage, and realtime infrastructure) and Vercel (web hosting). These providers process data on our behalf under their own security commitments; data may be stored or processed on servers located in the United States.
• Address search and maps: Photon (komoot) receives address text you type; OpenStreetMap, CARTO, Apple Maps, and Google Maps receive standard web requests (including IP address) when serving maps.
• Mobile infrastructure: Expo provides the framework services used to run the mobile app.
• Between users, as described in Section 5.
• Authorized Bobbi personnel can access shift-related messages, call logs, and account records for support, safety, verification, and dispute-resolution purposes. Administrative access is logged in our audit trail.
• Legal reasons: if required by law, subpoena, or court order, or to protect the rights, safety, or property of Bobbi, our users, or the public.
• Business transfers: if Bobbi is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy.

If we add optional in-platform payments in the future, payment details will be handled by a dedicated payment processor (such as Stripe) under its own terms and privacy policy, and we will update this Policy before launch.

• We keep personal information while your account is active and as needed to provide the Platform.
• Work records (shifts, timesheets, invoices, disputes) and security audit logs are retained after individual interactions end because they document commitments between users and support dispute resolution, fraud prevention, and legal compliance.
• When your account is closed we delete or de-identify personal information within a reasonable period, except where we are required or permitted to retain it (for example, financial records, dispute records, and audit logs).

• Access and correction: you can view and update most of your information in the app. You may also request a copy of the personal information we hold about you.
• Deletion and deactivation: contact us at [support email address] to deactivate or delete your account. We will action requests within a reasonable time, subject to the retention exceptions in Section 7.
• Notifications: you control push, SMS, and email categories in your notification settings. Marketing email requires your opt-in and can be withdrawn at any time.
• Withdrawal of consent: you may withdraw consent to our handling of your information by closing your account, subject to legal and contractual restrictions; some information (like your address for shift matching) is required for the Platform to function.
• Complaints: you may contact our Privacy Officer (Section 12) at any time. You also have the right to complain to the Office of the Privacy Commissioner of Canada.

We protect personal information with administrative, technical, and physical safeguards, including encryption in transit, row-level access controls in our database so users can only access records they are entitled to, restricted and logged administrative access, an append-only audit trail of changes to sensitive records, and private storage for credential documents. No system is perfectly secure; we cannot guarantee absolute security, and you are responsible for keeping your password confidential.

Bobbi operates from Canada, but our hosting providers store and process data on servers that may be located in the United States. While information is outside Canada it is subject to the laws of that jurisdiction, and may be accessible to its courts and authorities under those laws. We use contractual and technical safeguards with our providers to protect information wherever it is processed.

The Platform is intended for working professionals and dental practices and is not directed to anyone under 18. We do not knowingly collect personal information from minors; if you believe a minor has provided us information, contact us and we will delete it.

Questions, access requests, and complaints can be directed to our Privacy Officer: [privacy officer email address], or by mail to [Bobbi legal entity name], [registered business address].

We may update this Policy as the Platform evolves — for example, if we add payment processing, push notification delivery, analytics, or background checks, we will describe them here before or as they launch. For material changes we will notify you through the Platform or by email. The "Effective date" above always reflects the current version.