Privacy Policy

Chiefly Technologies, Inc. (“Chiefly,” “we,” or “us”) makes scheduling software for graduate medical education programs. This policy covers our website, chiefly.app (the “Site”), and the Chiefly web app (the “Service”).

Hospitals, health systems and residency programs (“Customers”) sign up for Chiefly and decide who gets access and what goes in. We process their program data on their behalf, under our agreement with them. If you use Chiefly through your program, your program’s own policies apply too, and its administrators are a good first stop for questions about your data.

Account information. Your name and email address, plus any phone number or profile photo on your account. Sign-in, including multi-factor authentication and Sign in with Google, runs through our authentication provider, so Chiefly never sees or stores your password.

Program and schedule data. What your program enters, or what we load for you during onboarding: resident names, training year, cohorts and tracks, rotations, rules and requirements, schedule assignments, rotation and vacation preferences, requested days off, holiday and clinic preferences, schedule requests, and files you upload, such as last year’s schedule.

AI assistant conversations. If your program turns on Chiefly’s AI assistant, we keep your messages, the files you attach, the assistant’s replies and any feedback you give, alongside your program’s data.

Usage and device information. Your IP address, browser and device type, the pages and features you use, and when. We log this to keep the Service secure and running. When something breaks, our error reports can include the request and who was signed in. Our error monitoring tool can also record a sample of visits to the Site and Service, with text and typed input masked, so we can see what went wrong and fix it.

Information you send us. If you book a demo, email us or fill out a form, we get your name, email, institution, role and whatever you tell us. Demo booking runs through our scheduling provider.

Cookies. We use the cookies and browser storage the Site and Service need to work: keeping you signed in, protecting your account and remembering your settings. We don’t use advertising cookies or track you across other sites.

What we don’t collect. Chiefly isn’t built for patient information or Protected Health Information (PHI), payment card numbers, Social Security numbers or dates of birth, and we don’t ask for them. Please don’t enter them.

• To run the Service: build and check schedules, show them to the people your program invites, and send the invitations and notifications you or your program trigger.
• To onboard and support your program. Our team loads your rules during onboarding and helps when you ask. Chiefly staff access customer data only to deliver the Service, and that access is logged.
• To keep Chiefly secure: verify sign-ins, prevent misuse and investigate problems.
• To fix bugs and improve the Service.
• To answer your questions and send messages about your account and the Service.
• To meet legal obligations and enforce our Terms of Service.

We don’t combine data across Customers, and we don’t use your program’s data to train AI models.

Where a program turns it on, the assistant answers questions and drafts schedule changes. To do that, our AI model provider processes your messages, the files you attach and the program data the assistant needs for your request.

Drafted changes don’t touch a schedule until someone on your team accepts them. Our provider doesn’t use this data to train its models.

We don’t sell personal information, and we don’t share it for advertising. We share it only in these cases:

• Within your program. People your program invites see its data based on their role. Program directors, coordinators and chiefs can build and edit schedules; residents can view published schedules and submit requests where the program allows it.
• Service providers. Companies that help us run Chiefly: hosting and storage, sign-in, schedule computation, error monitoring, email delivery, our AI model provider, demo scheduling, and our own email and documents. Each gets only what its job needs and is bound by data protection terms.
• At your direction. Exports you download and anything you choose to share or connect.
• Legal reasons. To comply with law or legal process, or to protect the rights, safety or property of our users, Customers, Chiefly or others.
• Business transfers. If Chiefly is part of a merger, acquisition or sale of assets, information may transfer as part of that deal, and this policy keeps applying to it.

• Program data stays for as long as your institution’s agreement with us. When it ends, or anytime on written request, we give the Customer a full export in a standard format such as Excel or CSV, then delete its data from our production systems. Deleted data then ages out of our backups. We don’t keep customer data for any other purpose.
• Account information stays while your account is active. Ask us or your program to delete it.
• Logs and error reports are kept for a limited time, for security and troubleshooting.
• Demo requests and emails are kept as long as we need them to follow up and keep our records. Ask us to delete them anytime.

• Data is encrypted in transit and at rest.
• The Service runs on Amazon Web Services in the United States.
• Access is role-based and scoped to each program, and Customers decide who is invited.
• Multi-factor authentication is available to every user and required for Chiefly staff who administer the platform.
• We’ve completed security reviews, including HECVAT and CORL assessments, for more than a dozen health systems, and we can share our security documentation with your IT team.

No system is perfectly secure. Keep your sign-in details private, and tell us right away at [email protected] if you think someone has gotten into your account. If we learn of unauthorized access to customer data, we’ll notify the affected Customers promptly.

• Ask to see, correct, export or delete your information by emailing [email protected]. If it’s part of a program’s schedule, we may work through your program, since the program controls that data.
• Your browser can block or clear cookies, but blocking the ones Chiefly needs will stop sign-in from working.
• Depending on where you live, you may have more rights over your information. We’ll honor requests as the law requires, and we won’t treat you differently for making one.
• You can also complain to your local data protection authority.

Chiefly is for professionals in graduate medical education and isn’t meant for anyone under 18. We don’t knowingly collect information from children.

The Site and Service link to other websites, such as our scheduling provider’s booking page. Their privacy practices are their own, so check their policies.

We’ll post any changes here and update the date at the top. If a change is significant, we’ll also tell Customers directly, for example by email.

For questions or requests about privacy, email [email protected].

Chiefly Technologies, Inc.
Charlottesville, Virginia