• Meridyon is PHI-free by design. It schedules clinicians, not patients. It is not built to hold patient records, clinical data, or protected health information (PHI), and we ask that none be entered.
• We handle workforce data — what an organization needs to schedule and recruit its staff.
• Your organization controls that data; we process it for them (we are the processor / service provider; they are the controller / business).
• We never sell personal information, never use it for advertising, and never use customer data to train AI models.
• All customer data is stored and processed in the United States.
• Organizations can export their data at any time (CSV, Excel, iCal, JSON) at no charge, and we provide anything the built-in exports don’t cover on request. No lock-in.

Meridyon is used by health systems, medical groups, practices, and departments (“Customers”) to schedule and recruit their workforce. The Customer is the controller (or “business”): it decides what workforce data goes into Meridyon and why. Meridyon is the processor (or “service provider”): we process that data only on the Customer’s instructions to provide the Service.

The people whose data appears in Meridyon are the Customer’s workforce — clinicians, schedulers, and administrators — and, in Meridyon Pipeline, job candidates. If that is you, you can exercise your rights through your organization’s Meridyon administrator or by contacting us (Section 7). This policy also covers our public website and sign-in pages, where Meridyon itself decides what is collected.

Workforce data (entered by Customers)

• Staff names and work contact details (for example work email, pager).
• Role, department, credential, and privilege metadata.
• Shift schedules, assignments, trades, time-off and other scheduling requests.
• FTE/cFTE targets and organization configuration (teams, call cycles, rules).
• Pipeline (recruiting) records, where used: candidate contact details, CVs and documents, training history, and application and stage history. Voluntary EEO self-identification only if the organization turns it on (off by default), stored apart from the candidate record and reported only in aggregate.

Account data

• Name, email, organization memberships, and role.
• Sign-in credentials: passwords stored only as bcrypt hashes (never plaintext), passkey public keys, and authenticator-app settings.
• When you accepted the Terms of Service and Privacy Policy, and which version (a date and a version — nothing else).
• Billing references from Stripe. Payment card data is handled by Stripe and never touches our servers.

What we do not handle

No patient data. No PHI. No clinical records. Meridyon has no patient-facing surface. Please don’t enter patient information anywhere, including free-text notes and assistant questions.

Collected automatically

• Security and audit records: sessions, sign-in events (including IP address, user agent, and time), and an audit log of administrative and scheduling changes with before/after values.
• In-app assistant (Compass) log: the questions people type, which help tools it used, whether it found an answer, and any thumbs-up/down feedback. We use this to improve help content; only that organization’s administrators and Meridyon can read it.
• Calendar feeds: the last time each personal calendar feed was fetched, so administrators can see who is subscribed.
• Analytics and errors: page-view counts from our self-hosted, cookie-free analytics (page path only; clinical screens excluded), Cloudflare’s cookie-free edge analytics, error reports (Sentry, when enabled), and, when enabled, product-funnel events (PostHog) tied only to opaque account IDs — never names, emails, or free text, with automatic click and text capture turned off.

Contact-form inquiries

When you use the contact form on our website, we receive what you enter (name, email, organization, role, group size, message), the page you sent it from, and any campaign labels in the link (for example utm_source). It is emailed (through our email sub-processor, Resend) to our support inbox so we can reply, and we send you a short acknowledgement. It is not stored in the Meridyon application database. Please don’t include patient information.

We use the information above only to:

• Provide, operate, and support the Service for the Customer.
• Authenticate users and secure accounts (sign-in, passkeys, MFA, sessions, rate limiting, lockout).
• Build schedules, targets, exports, calendar feeds, and the notifications the Customer configures.
• Keep audit logs and investigate security incidents, fraud, and abuse.
• Administer billing.
• Understand which features are used and fix problems, so we can improve the Service.

We do not use workforce data for advertising, we do not sell it, and we do not use it to make decisions that have legal or similarly significant effects on anyone.

AI features. Meridyon uses Anthropic as a sub-processor for: Compass, the in-app assistant; reading emailed schedule requests into structured requests; turning a scheduling rule typed in plain English into a rule; and, in Pipeline, reading CVs and candidate documents into candidate records and summaries and drafting position descriptions. For each request we send only what is needed — for example the question and the relevant help articles or schedule details such as staff names and shifts, or the CV being read. Processing happens in the United States. We do not use customer data to train AI models, and we choose AI providers whose commercial terms don’t train on our inputs.

As a processor, we process personal data under the Customer’s instructions and our agreement with the Customer (including any Data Processing Addendum). The Customer, as controller, is responsible for its legal basis and for any notices to its workforce and candidates.

Customer data is stored and processed in the United States, on US-based servers fronted by a US/global edge network for delivery and TLS. We do not transfer customer data outside the United States. Customers operating internationally should talk to us before relying on the Service for data subject to cross-border transfer rules.

We rely on a short list of third-party sub-processors to run the Service. As of the last-updated date:

We remain responsible for our sub-processors and give Customers notice before adding or replacing one.

You can ask to access, correct, delete, or get a portable copy of your personal data. Because your organization controls the workforce data in its Meridyon account, the quickest route is usually your organization’s Meridyon administrator, who can make most changes and exports directly.

• You can also contact us at [email protected]. If the request concerns data your organization controls, we will pass it to them and help them respond; we will not ignore it. We respond within 30 days.
• Things you can do yourself: update your password, passkeys, and authenticator app; see and end your active sessions; disconnect AI apps you connected; and reset your personal calendar-feed link.
• Organizations can export their data at any time (and ask us for anything the built-in exports don’t cover), and can ask us to delete their account (see Section 8).
• We will never treat you differently for exercising your rights.

• Schedules, staff records, and configuration: for the life of the account (the Customer’s operational record).
• Audit logs: retained for at least 2 years by default (configurable). While the account exists, retention never destroys them: older entries are archived rather than deleted, to protect the change-of-record trail.
• Sign-in security events: 1 year by default; expired sessions: 30 days. The automatic job that applies these windows is built but not yet switched on, so until it is, these records may be kept longer.
• Pipeline CVs: a candidate-retention rule (off by default) lets an organization anonymize or delete inactive candidates.
• Compass assistant log: for the life of the account.
• Backups: 30 days, with an off-site copy on the same cycle.
• When an account ends: the Customer has 30 days to export (read-only access), then customer data is deleted from production systems and backup copies age out within a further 30 days. Written confirmation is available on request. Billing records the law requires are kept as long as the law requires, and audit-log entries for up to 2 years after the account ends; both stay protected.
• A free trial that ends without a subscription stays read-only for at least 90 days. Before we delete it, we email the account owner at least 14 days in advance.

We protect data with measures suited to workforce-scheduling data: TLS 1.2+ in transit, passkeys and authenticator-app MFA (required for administrators by default), role-based access, server-side tenant isolation, audit logging, security headers and cross-site request forgery protections, rate limiting and account lockout, and daily plus off-site backups that are encrypted (AES-256) and restore-tested. Enterprise single sign-on can be set up with your IT team.

We describe our security posture accurately: we do not hold SOC 2, ISO 27001, or HITRUST certification yet, and some defense-in-depth hardening is still on our roadmap. Full details, including encryption at rest, are in our IT & Security Reference or on request. No system is perfectly secure; if an incident affects your data, we will tell the Customer without undue delay.

Meridyon uses only what it needs to work:

• meridian_session — keeps you signed in. HttpOnly, Secure, and SameSite=Lax. On a shared computer it is cleared when the browser closes; on a device where you sign in with a passkey stored on that device it lasts until the session expires.
• Short-lived single sign-on cookies (10 minutes), only while an SSO sign-in is in progress.
• Browser local storage for interface preferences (for example your last-selected department, view settings, and dismissed notices).
• When product analytics is enabled, PostHog stores an opaque identifier in a first-party cookie and local storage. Our page-view analytics and Cloudflare’s edge analytics are cookie-free.

We do not use advertising or cross-site tracking cookies.

This section applies to California residents. In most cases Meridyon is a service provider to the Customer (the “business”) and processes personal information only to provide the Service under our contract.

Categories of personal information

• Identifiers — Name, work email address, user/account identifiers.
• Professional or employment-related information — Role, department, credentials and privileges metadata, schedule assignments, FTE/cFTE targets; for Pipeline, candidate contact details, CVs, training history, and application history.
• Internet or network activity — Sign-in and session metadata, IP address and user agent (for security and audit), feature-usage and error events.
• Sensitive personal information (optional, off by default) — Voluntary EEO self-identification in Pipeline, only if an organization turns it on. Used only for aggregate compliance reporting.

We do not use sensitive personal information to infer characteristics about anyone, and we collect no patient or health information.

No sale, no sharing. Meridyon does not sell personal information and does not share it for cross-context behavioral advertising, as the CCPA/CPRA defines those terms.

Your rights. Subject to verification and legal limits, you can ask to know/access, correct, and delete personal information, and you will not be discriminated against for doing so. Because we are a service provider, we route verifiable requests to the relevant business and help it respond. Submit a request through your organization’s Meridyon administrator or at [email protected].

Residents of states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, and others as they take effect — may have rights to access, correct, delete, and get a portable copy of their personal data, and to opt out of targeted advertising, sale, or certain profiling. Meridyon processes workforce data as a processor for the Customer (the controller) and does not sell personal data, use it for targeted advertising, or use it for profiling with legal or similarly significant effects. Send requests to the Customer that controls your data, or to [email protected] and we will route them and help.

Meridyon is offered to US-based Customers and stores data only in the United States. It is not directed to individuals in the EU/UK or other regions. Meridyon is a workplace tool for clinical teams, is not directed to children, and we do not knowingly collect personal information from anyone under 16.

If we make a material change, we will notify Customers by email or in the app at least 30 days before it takes effect, and we will ask signed-in users to review the update in the app (that request never blocks sign-in). Changes that don’t reduce your rights may take effect when posted. The “Last updated” date above shows the current version.

Questions or requests about this policy or your data: [email protected]. Meridyon, Inc., a Delaware corporation.

See also our Terms of Service and IT & Security Reference.