Privacy Policy

Your employer — the organization that subscribes to Tjane Workforce — decides what workforce information is entered into the platform and who inside that organization may see it. Tjane Health operates the platform on their behalf and processes that information according to their instructions and this policy.

If you are an employee and want to know why a particular record exists, or want it corrected, start with your HR administrator. They control the record.

• Sign-in identity: email address, name if you provide one, and authentication metadata such as sign-in timestamps.
• Organization membership: which workspace you belong to and your role (owner, admin, manager, or employee).
• Product usage needed to operate the service, such as which screens wrote a record, for the audit log.

• Employment records: name, job title, department, location, hire and separation dates, employment status and classification.
• Contact details: work email, work phone, and emergency contact information.
• Credentials and licenses: type, issue and expiration dates, verification status, and any documents uploaded to support them.
• Schedules, time clock punches, timesheets, attendance occurrences, and leave requests.
• Training enrollments, quiz results, certificates, competency sign-offs, and policy acknowledgements.
• Performance reviews, corrective actions, and offboarding checklists, which are restricted to HR-authorized roles.
• Compensation fields where your organization chooses to use them, restricted to HR-authorized roles.

We do not ask for and do not want patient information. See the notice at the top of this page.

Documents you or your employer upload — licenses, certifications, background check confirmations, signed acknowledgements — are stored in a private storage area. They are not publicly addressable and are not served from a public URL. Access is granted per organization and per role, and download links are short-lived and generated only for an authorized signed-in request.

Uploads are size-limited and are recorded in the audit log with who uploaded them and when.

Subscription payments are processed by Stripe. Card numbers and bank details are entered on Stripe's own checkout and billing portal pages and are never transmitted to or stored by Tjane Workforce. We store only the non-sensitive references Stripe returns to us: a customer identifier, a subscription identifier, plan and status, renewal date, and the status of the most recent invoice. Stripe's own privacy terms govern their handling of payment data.

The platform can send operational messages: credential expiry reminders, schedule notices, approval requests, and account emails such as verification and password reset. Email is delivered by Resend and SMS by RingCentral, acting as our delivery providers. Message content, recipient address, and delivery outcome are recorded so administrators can prove a notice was attempted.

SMS recipients can reply STOP at any time to opt out of further messages to that number, or HELP for information. Opt-outs are honored at the phone-number level. Account-critical emails such as password reset are transactional and are not marketing messages.

Access is enforced at the database level, not only in the interface. Records are scoped to a single organization, and within an organization to the caller's role: employees see their own records, managers see the teams in their assigned departments or locations, and HR-restricted categories such as compensation, performance, and corrective action are visible only to roles explicitly granted that permission. The staff directory deliberately exposes only work contact details, not personal or HR data.

We do not sell workforce data, and we do not use it to train third-party models.

• Workforce records persist for as long as your organization's subscription is active, because employment and credential history is a record your organization is often required to keep.
• Terminated and inactive employee records are retained rather than deleted, so history remains defensible, unless your organization asks for removal.
• Audit events are append-only and cannot be edited or deleted through the product.
• Notification delivery records and subscription webhook records are kept for operational troubleshooting.
• On account closure your organization can request an export, followed by deletion of its workspace data. Backups age out on their own retention cycle after that.

We protect data in transit with HTTPS, keep documents in private storage, enforce per-organization access rules in the database, and record an audit trail of sensitive actions. No platform is immune to compromise and we make no security guarantee.

Your organization is responsible for the parts only it can control: choosing strong unique passwords, removing access promptly when someone leaves, granting elevated permissions sparingly, and deciding what information is appropriate to enter in the first place.

If we make a material change we will update the date at the top of this page and, where the change affects how workforce data is handled, notify organization owners in the product.

Questions about this page, your organization's data, or a deletion or export request should go to your Tjane Health account representative, or through the support channel listed for your organization at tjanehealth.com. Requests are handled through the account owner on record so we can confirm authorization before releasing or removing workforce data.