Privacy Policy

GoodShift, 8 Mohamed Mokaled St., 23, Corner of Yassin Ragheb St., Nasr City, Cairo, Egypt, is the data controller for your account data in both products and on this website: your sign-in, contact details, profile, purchases, pay terms and payment answers, and usage data. In Climo, each clinic (the practitioner) is the data controller of the patient records it keeps, under Egypt's Personal Data Protection Law No. 151 of 2020, and GoodShift is the data processor that stores and displays those records on the clinic's instructions. A question about a patient record goes to the clinic first; we help it answer. This policy is governed by the laws of the Arab Republic of Egypt. The GoodShift app is used in many countries; if you live outside Egypt, you keep the data-protection rights the law of your own country gives you. You can reach us at support@goodshift.work.

In the GoodShift app we collect the following:

In Climo we collect the following:

On goodshift.work we collect the following:

We use your data to: • create and secure your account, and verify your mobile number by a one-time SMS code; • in the GoodShift app: verify identity and prevent fraud, show work near you, let a poster choose a Champ, record the pay terms a poster declares and the Paid / Not paid yet answers and unpaid reports a Champ gives, record the start and completion of work, compute ratings, badges, strikes, the "Pays on time" figure and account standing, sell and deliver in-app purchases (posting credits, the 30-day pass, boosts, the Urgent badge and the one-time activation), and keep the chat safe; • in Climo: run the clinic you set up or link to, show a clinic to its patients, record bookings, visits, catalogue and payments, verify a clinic's business documents, and bill the subscription; • send you the notifications and emails you have not turned off, and the service messages you cannot turn off (account security, purchase receipts); • fix crashes, understand which features are used, and improve the products; • comply with the law that applies to us, including Egyptian law, and respond to lawful requests. We do not sell your data, and we do not use it for advertising or track you across other companies' apps or websites.

Google Cloud / Firebase: our backend for both products and this website (database, file storage, server functions, sign-in and SMS verification, push notifications, crash reporting, analytics). Data is processed under Google's data processing terms. Apple App Store and Google Play (both products): the stores that sell GoodShift's in-app purchases and Climo's subscriptions. The store takes the payment, holds your payment details and handles refunds of store purchases under its own refund policy. We receive only a record that a purchase happened. RevenueCat (both products): processes the purchase records for GoodShift's in-app purchases and Climo's subscriptions (the product, the date, the store and the store's transaction id). It never receives your card details. Amplitude (GoodShift app): receives product usage events with no personal identifiers. Google Analytics (goodshift.work): page views on this website. Google Maps Platform (GoodShift app): the address a poster types and the pin they place, to find places and show the address. Apple (sign-in with Apple in both products; in Climo, notifications, maps and address lookup for the clinic's pin). Google Workspace (Gmail): sends our transactional emails from support@goodshift.work. Other users: in the GoodShift app your public profile (name, photo, rating, reviews, badges, skills, rates, work photos) is visible to other users, and a poster's "Pays on time" figure is shown on the poster's profile. Your mobile number, email, identity documents, identity number and purchase history are never public and are not visible to a poster who has chosen you. In Climo, what a clinic and a patient see of each other is described in section 12. Legal authorities: if required by Egyptian law, a court order or the law of the country where the data is processed, we may disclose data to competent authorities.

All data is stored on Google Cloud. Because GoodShift is used in many countries, your data may be stored and processed outside the country where you live. Climo's patient records and health data are stored in the United States, outside Egypt; a clinic confirms when it sets up that the consent it holds covers that storage. Store purchases are handled by Apple or Google, and purchase records by RevenueCat, each under its own terms and safeguards. We do not add a provider without updating this page.

Identity documents (GoodShift app). Submitting a face selfie and a photo of your identity document is required before you first apply for or post work; the review is done by GoodShift's reviewers only, and a review that is still pending does not stop you. The documents are stored securely, never displayed publicly in full, and never used for advertising. Others see only a verification status. An identity number is optional and can be removed at any time; only its last four characters ever leave GoodShift. If you delete your account, these documents are erased within 30 days. Mobile number verification (both products). When you enter your number we ask Google's Firebase Authentication to send a one-time code by SMS; entering it proves the number is yours. Your number is shared with Firebase Authentication and, through it, with the mobile operator that delivers the message. Standard rates from your operator may apply. We keep your number, and a record that it was verified, for as long as your account exists, and use it to contact you about work, bookings, purchases and account security. We do not use it for marketing and never sell or rent it. It is never shown on a public profile. If you cannot receive SMS, contact support@goodshift.work and we will verify your account another way.

While a piece of work is running in the GoodShift app, either party can share a link to a page showing the other party's first name, photo, verification status, the type of work, the work address and the scheduled time. If you have provided an optional identity number, only its last four characters appear. The link is a bearer link: anyone who holds it can open that page, with no GoodShift account and no sign-in, until it stops working. It stops working as soon as the work is completed or cancelled, and in any case within 24 hours of the work starting. We ask search engines not to index it and it is never listed anywhere; treat sending it the way you would treat sending any private detail, because whoever you send it to can forward it. Sharing your live location is optional and off by default, every single time. It is never remembered between sessions, and turning it on is never implied by sharing the details. While it is on, your device sends its position to us about once a minute, and that position is visible only on the page behind a link you sent, not to the other party to the work and not to anyone browsing GoodShift. Your operating system shows its own indicator the entire time. It stops when you switch it off, when the work ends, when the link expires, or when you sign out; and our servers refuse to store a position at all once the work has ended. We keep only your most recent position, overwritten in place: there is no location history and no trail. The SOS control dials the local emergency number from your own phone. It is a dialler hand-off and nothing more: GoodShift is not called, is not notified at the time, and does not respond. We do record that the control was pressed, together with the work record, both parties, the time and, when your device had one available, the position your device reported. That record is visible only to our own reviewers looking at patterns after the fact, and it is never used to decide payment answers, unpaid reports, disputes or account standing. Emergency contacts you save are stored on your own account, visible only to you, never shown to anyone else, never included on the shared page, and never sent anywhere by us. They exist only so that sharing takes fewer taps.

GoodShift holds no card or bank details. When you buy posting credits, the 30-day pass, a boost, the Urgent badge or the one-time activation, you pay Apple or Google through your store account. The store handles the payment and keeps your payment details; we receive, through RevenueCat, only a record that the purchase happened (the product, the date, the store and the store's transaction id). Refunds of store purchases follow the store's own refund policy. A credit that comes back because nobody applied in time is not a refund; it simply returns to your credit balance. Money for the work itself never passes through GoodShift. A poster pays the Champ directly, off the app, on the pay terms declared on the posting. We keep only those pay terms, the Champ's Paid / Not paid yet answers with their time, and any unpaid report. These are the parties' own statements: GoodShift records them and works out the "Pays on time" figure from them, but does not decide who is right about money and never collects or pays it. Climo never holds card or account details for payments between a clinic and its patients. The payment handle a clinic chooses to show is shown to its own patients so they can pay it, and a payment proof image is kept for 90 days after the appointment.

If you post work as a Business in the GoodShift app, we collect your company profile (company name, logo and contact details), your business documents (a tax card and commercial register, where your country has them), and a record of the Business Client Agreement you sign in the app: the name and title you type as the authorised representative, the date and time, the contract version and the platform used. An individual Client signs the Individual Provider Agreement instead, and the same record is kept. In Climo, a clinic submits business documents so we can verify it; every read of those documents by our reviewers is recorded. We use these to verify who is posting or running a clinic, to keep a legal record that you agreed to the platform's terms, and, where needed, to contact you before a decision. A signed agreement is retained as a legal record for as long as your account exists and for any period the law requires afterwards.

Only the clinic that entered a patient record, and the team members it adds, can read it. GoodShift staff do not read patient records. The one exception is a copy of a clinic's records that the clinic asks us for in writing: our support prepares it from that clinic's data only, hands it to the clinic, and deletes our copy within 7 days. A patient who links to a clinic sees their own visits, packages and payments, and any note the practitioner chooses to share. The details you enter as a patient stay on your account, where only you can see them. When you ask a clinic to link, that clinic sees your name, your verified phone number and your photo so it can recognise you; the rest reaches it only if it approves your request, and from then on the clinic keeps them as the controller of its record of you. If a clinic declines or you cancel, it keeps no copy. A clinic's catalogue, name, logo, brand and hours are visible to signed-in patients. Its stock counts and costs are not. Business documents are read by GoodShift staff only to verify a clinic, and every such read is recorded. Our staff use a private admin site that shows account details and clinic profiles, never a patient record, a booking or a payment; every account opened and message sent there is recorded.

We send email to the address on your account. Purchase receipts and account-security emails (for example a sign-in or a scheduled deletion, and in Climo a subscription problem) are part of the service and cannot be turned off while the account exists. Every other email, including reminders, digests and seasonal greetings, can be turned off in the app's settings or from the unsubscribe link in the email, which works without the app. An email never carries a patient's name, a treatment, or, in the GoodShift app, another user's private details. We keep a short record of each email sent (which kind, when and the reason it carried) so nothing is sent twice. Push notifications are sent only to a device that allowed them, and only for the categories you keep switched on. A device's notification token is deleted when you sign out on it.

GoodShift app. We keep your account data while your account is open. When you delete your account, your profile, personal data and identity documents are deleted or anonymised within 30 days, except records the law requires us to keep. Purchase records are kept for as long as the law requires for accounting; Egyptian law governs this. Pay terms, Paid / Not paid yet answers, unpaid reports, strikes and reviews are kept, anonymised, as the standing record of what happened, so other users' figures stay true; reviews may remain visible without a link to you. The enforcement history of an account that was restricted is retained so a deletion cannot be used to start over. Nothing about money can block a deletion, because no money for work is owed through GoodShift. Climo. Deletion is a 30-day soft delete: nothing is removed for 30 days and signing back in restores everything. After 30 days the clinic's records (patients, visits, photographs, documents, bookings, the catalogue and its photographs, the public profile) are permanently deleted. Financial ledger rows are kept for 5 years with names and patient references removed. Payment-proof images are deleted 90 days after the appointment. The record of each email sent is kept for 400 days. A patient's deletion removes their account and its links; each clinic keeps its own records of them as that clinic's controller. Deleted data can persist in backups for up to 30 further days. This website. An early-access email is kept until you ask us to remove it or we close the list.

You can ask to see the personal data held about you, to have it corrected, to have it deleted, and to object to how it is used. In the apps you can correct your profile, change your notification and email choices, and delete your account yourself. Where the data is a Climo patient record, the clinic answers as the controller and we help it; where it is your own account, we answer. Write to support@goodshift.work. We answer within 30 days. You may also complain to Egypt's Personal Data Protection Centre. If you live in another country, you keep the rights your own country's data-protection law gives you, including complaining to its data-protection authority.

Accounts in both products are for people aged 18 or over. A child's clinical records live in a clinic's own records, kept by the clinic as controller with the consent of a parent or guardian. We do not knowingly create an account for a child; tell us at support@goodshift.work if you believe one exists and we will remove it.

Data is encrypted in transit and at rest. Access is limited by security rules that check who is signed in and what they may see, every request is checked to come from the real app, and purchase records and account standing are written only by our servers, never by a phone. Names, amounts and patient details are kept out of our server logs by design. No system is completely secure, so please use a strong, unique password and keep your sign-in details to yourself. If a breach affects your data, we tell you, the clinic where relevant, and, where the law requires, the regulator.

We may update this policy. The version and date at the top change when we do, and a change that materially affects you is shown in the app before it takes effect.

Requests about your data go to the controller: for a Climo patient record, the clinic; for everything else, GoodShift. Email: support@goodshift.work Website: goodshift.work GoodShift, 8 Mohamed Mokaled St., 23, Corner of Yassin Ragheb St., Nasr City, Cairo, Egypt