Legal
Privacy Policy
Last updated: September 20, 2026
This Privacy Policy describes how we collect, use, store, and protect your personal data when you use the Order Manager mobile application (the "App"). By using the App, you agree to the practices described in this policy.
1. Information We Collect
We collect the following categories of data to provide our workforce management and attendance tracking services: Authentication Data: Worker ID and password, transmitted securely over HTTPS to authenticate your identity. User Profile Data: First name, last name, email address, phone number, blood type, role/position, healthcare provider (EPS), and skill tag/certification area. This data is provided by your organization and used to manage your work profile. Attendance Data: Clock-in and clock-out timestamps, shift duration, and attendance status — collected when you start and end your shift using the app. Location Data: When you start or end a shift, the app captures your device's foreground location (latitude and longitude) and attaches it to the attendance record. Location is also used to display your position on the field map and to help locate field orders and tasks. Location is only accessed while you are using the app, only when you grant the location permission, and never in the background; if you decline the permission, clock-in and clock-out still work and no coordinates are recorded. Order & Task Data: Information about the field orders and tasks assigned or offered to you, including order number, customer name, customer phone number, service address, service name, amount, status, and current workflow step. This data is provided by your organization. Notification Data: Notifications sent to you by your organization, including read/unread status. Device Preferences: Your chosen theme preference (light or dark mode).
2. How We Use Your Data
All data we collect is used exclusively for workforce management purposes: • Authenticate you securely to the platform • Track your attendance, work hours, and shift schedules • Record the location associated with each clock-in and clock-out • Display your position on the field map and help you locate field orders and tasks • Show and manage the orders and tasks assigned or offered to you • Deliver notifications from your organization • Display and manage your worker profile • Apply your theme preference to the app interface We do not use your data for advertising, profiling, automated decision-making, or any purpose beyond the core workforce management functionality.
3. Data Storage & Security
Your data is protected through multiple layers of security: • Authentication tokens (JWT access and refresh tokens) are stored in your device's encrypted keychain/keystore (expo-secure-store on mobile, HTTP-only cookies on web). • Attendance data (including the coordinates recorded at clock-in and clock-out), preferences, and cached data (such as order lists and address-to-coordinate geocoding results) are stored in encrypted local storage (MMKV with a cryptographically secure encryption key) and never leave your device except when transmitted to our servers or, for geocoding, to Google as described in Section 4. • All data transmission between the app and our servers is encrypted via HTTPS/TLS. • Your password is never stored on your device — it is only transmitted during login over an encrypted connection. We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.
4. Third-Party Services
We do not integrate with any third-party analytics, advertising, crash reporting, push notification, or tracking services. Specifically, the app does NOT use: • Analytics SDKs (no Google Analytics, Firebase Analytics, Amplitude, Mixpanel, or similar) • Advertising SDKs or ad networks • Crash reporting services (no Sentry, Crashlytics, or similar) • Push notification services (no Firebase Cloud Messaging, OneSignal, or similar) • Social media SDKs or social login integrations • Any form of user behavior tracking or profiling The app does use the following Google services, solely to display maps and locate orders and tasks: • Google Maps SDK — renders the field map on your device. • Google Geocoding API — when an order has no stored coordinates, the app sends the order's street address to Google to obtain latitude and longitude so the order can be shown on the map. Geocoding results are cached on your device. Google processes this information under its own privacy policy. No other data is shared with Google, and these services are not used for advertising or tracking.
5. Device Permissions
The app requests the following device permissions, solely for core functionality: • Internet access — required to communicate with the server for authentication, attendance tracking, orders, and notifications. • Location (foreground) — required to record the coordinates of your clock-in and clock-out and to display your position on the field map. The app does not access your location in the background and does not track you while the app is closed. If you deny this permission, clock-in and clock-out still work without coordinates. • Storage access (Android) — standard permission for local data caching (Expo framework default). The app does NOT request access to: • Camera • Contacts • Microphone • Photo library / media • Bluetooth • Calendar • Health data • Push notifications No other sensitive device sensors are accessed.
6. Data Retention & Deletion
Your attendance data, profile, and notification history are retained on our servers for as long as your account is active with your organization. Your organization manages the retention policy for workforce data. To request deletion of your personal data, please contact your organization's administrator or our support team at the contact information below. We will respond to deletion requests within 30 days. When you log out of the app, all locally cached data — including attendance records, cached orders and geocoding results, and preferences — is cleared from your device.
7. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data: • Right to access — request a copy of your personal data • Right to rectification — correct inaccurate or incomplete data • Right to erasure — request deletion of your data • Right to restrict processing — limit how your data is used • Right to data portability — receive your data in a structured format • Right to object — object to certain processing activities To exercise any of these rights, contact us using the information below.
8. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes through the app or via email. Continued use of the app after changes take effect constitutes acceptance of the updated policy. This policy was last updated on September 20, 2026.
9. Contact Us
If you have questions about this Privacy Policy, your data, or would like to exercise your rights, contact us at: • Email: privacy@ordermanager.com • Contact your organization's administrator for account-specific inquiries.
10. Governing Language
This policy is provided in English and Spanish. In the event of any discrepancy or conflict between the two versions, the English version prevails.