Privacy policy

1. Who this policy is for

This policy describes information processed for deniseapp.com, the Denise mobile app and the administration interface used to coordinate staff replacements and callouts. It applies to website visitors, employees and administrators of participating organizations.

Your organization supplies and manages some of the information needed to manage its workforce. Denise processes this information to provide the service. Your organization remains your contact for its employment decisions, callout rules and record-retention obligations. This policy complements your employer’s privacy notices.

Contact for this policy: Marc-André Théberge, founder of Denise, at info@pratiqo.ca. This address receives privacy questions and requests for access, correction and deletion concerning Denise.

2. Information used

Account and contact information

Depending on your use and enabled channels: first and last name, email address, phone number, preferred language, account identifier and information needed for authentication. An organization may also create an employee record without an app account.

Employment information

Information entered or imported by your organization may include your employee number, employment status, job title, authorized sites and units, qualifications, seniority and, when supplied for callout rules or cost calculations, relevant pay rates and overtime settings.

Availability and callout activity

Your availability and preferences, offers addressed to you, responses, shift assignments and dates, as well as administration actions and their history. SMS exchanges may include message and reply content, the numbers involved, offer references, timestamps, consent records and sending or delivery statuses.

Device and technical operation

Identifiers needed for push notifications, notification permission status and technical information useful for operation, security and troubleshooting, such as IP address, browser or device type, connection dates and technical errors. Hosting and communications providers also process technical metadata as part of their services.

Requests sent to Denise

When you contact us, we receive the contact details and content you choose to send, such as your organization’s name and your demonstration or support request.

Limit sensitive information: Denise manages workforce coordination. Do not enter patient records, diagnoses or medical details explaining an absence. The app does not request continuous GPS tracking. A shift’s location is the site or unit defined by the organization.

3. Where information comes from

Information comes from you when you use the service, your organization when it configures its workforce and rules, your device for authorized technical functions, and communications providers when they return responses or delivery statuses.

Fictional data in the website demonstration illustrates the product and is not a record of real employees.

4. Why information is used

• Create and protect access, verify permissions and link employees to the correct organization.
• Display shifts, identify eligible recipients under the organization’s settings and deliver authorized communications.
• Record responses, support shift assignment and retain a history of decisions and operations.
• Provide dashboards and operational indicators, such as response times, replacements and time or cost estimates.
• Handle support requests, resolve incidents, prevent abuse and keep the service secure.
• Manage consents, personal-information requests and applicable obligations.

Callout rules may use professional criteria configured by the organization. These rules alone are not a disciplinary decision or a guarantee of assignment. Contact your manager with questions about eligibility, ranking or an assignment.

We do not sell workforce-management personal information or use it for targeted advertising.

5. Who can access information

Employees can access the information and functions intended for them. Authorized administrators of your organization access the information needed for their responsibilities, according to their roles and scope. Denise’s technical access supports operation, security and assistance as necessary.

Another customer organization does not receive your data merely because it uses Denise. Disclosure may also be necessary to comply with a legal obligation, respond to a valid authority request, or protect people’s rights and safety where permitted by law.

6. Technical providers

The service relies on providers that process information needed for their functions:

• Supabase: authentication, database and application processing.
• Twilio: SMS and reply routing, numbers, content and communications statuses when SMS is enabled.
• Expo, Apple and Google: services needed for app distribution, updates and notifications, including relevant device tokens and notification content.
• Vercel: hosting for the administration interface when served by this provider.
• ChatGPT Sites and its Cloudflare infrastructure: public-website hosting and delivery.
• Email services used by Denise and your organization: receiving requests, support and relevant account messages.

Information shared is limited to what the relevant service needs. These providers’ terms govern their processing; Denise must also take its commitments to your organization into account. We do not supply this information for providers to target employees with advertising.

7. Hosting and processing outside Québec

Information may be processed in Canada or other countries, including the United States, depending on the services and environment used. The primary database region is specified to the organization during setup. Hosting a database in Canada does not mean that all notification, email, web-hosting or support services process data exclusively in Canada.

Information processed abroad may be subject to those jurisdictions’ laws and authorized government access. Contact us or your organization’s representative for details of your organization’s environment.

8. Notifications, SMS and choices

Push notifications: you can allow or refuse notifications in your device settings and adjust available preferences in Denise. Withdrawing permission may prevent you from receiving push alerts.

SMS: sending depends on channel activation and the applicable consent on record. You can reply STOP to the sending number to request an end to SMS messages, or contact your organization or Denise. Your carrier’s charges may apply. An offer response is processed under the callout rules; receiving a text message does not constitute a shift assignment.

Withdrawal applies to processing that relies on your consent. It does not automatically remove employment records or information your organization or Denise must retain on another applicable basis.

Lock-screen content: notifications and SMS may be visible to someone with access to your device. You can hide previews in your device settings.

9. Public website and cookies

The website demonstration and calculator run in your browser. Their interactions do not create a real staffing need, send SMS or push notifications, or transmit calculator values to Denise.

The current website has no hosted collection form, advertising tracker or audience-analytics tool added by Denise. The contact button opens your email application; a message is sent only when you choose to send it. Fonts are hosted with the website.

Hosting may process technical data needed to display, secure and deliver the website, including requests and IP addresses. Signed-in areas may use cookies or local storage for authentication and essential functions. You can manage this storage in your browser; disabling it may interfere with sign-in.

Links to external websites lead to services with their own policies.

10. Retention and deletion

Retention depends on the information category, purpose, service use, the organization’s instructions and applicable obligations. Contact details and preferences support an active service. Callout histories, assignments, consents and logs may need to be retained for traceability, professional obligations, security or dispute resolution.

We limit retention to what is needed for these purposes. Deactivating an employee or closing access does not automatically erase the employer’s history. Backup copies, where present, may remain until their rotation or expiry.

To request account closure or information deletion, email info@pratiqo.ca. Specify that your request concerns Denise, your organization, and the email address or phone number associated with the account. We will verify your identity, determine the relevant information with the organization, and explain anything that must be retained and why. Do not send your password or an identity document with an initial request.

11. Your requests and rights

Subject to applicable rules, you may request access, correction, details about use, deletion, withdrawal of consent and, where provided, a copy or transfer of information in an appropriate format. Some rights may be limited by retention obligations or other people’s rights.

Use available profile settings and contact your organization about the employment information it supplies. You can also contact Denise directly at info@pratiqo.ca. We will route your request to the appropriate contact and handle information for which Denise is responsible. You may send us a complaint or contact the relevant privacy authority, including Québec’s Commission d’accès à l’information.

12. Security and appropriate use

The service uses authentication, role- and organization-based access controls, communications encrypted in transit, and technical and operational logs to limit unauthorized access and support incident investigations. No security measure eliminates every risk.

Protect your sign-in details, keep your device up to date and report suspicious use to your organization and Denise. The service is intended for workplace team management, rather than a service directed at children.

13. Updates and contact

This policy may evolve with the service’s features and providers. The last-updated date appears at the top. Material changes will be communicated appropriately, for example through the service or to the affected organization. Additional consent will be requested where required.