This Privacy Policy explains how ResFly collects, uses, stores, and shares information when residency programs, administrators, residents, faculty, and other authorized users use the ResFly application and related services.
Information we collect
We collect account and profile information such as name, email address, program affiliation, role, and authentication details. Programs may also enter scheduling, attendance, evaluation, communication, educational, and administrative information needed to operate their residency program.
We collect limited technical information—including device, browser, IP address, timestamps, and application events—to secure, maintain, and improve the service.
Google user data
When a user connects Google Drive, ResFly receives OAuth tokens and the Google account email address. Depending on the permissions approved by the user, ResFly may list Drive files and folders, display file metadata, open selected items, create or update program spreadsheets, organize files, and manage sharing when the user requests those actions.
ResFly uses Google user data only to provide user-facing Drive browsing, organization, sharing, backup, and export features. ResFly does not sell Google user data, use it for advertising, or allow humans to read it except when required for security, legal compliance, support requested by the user, or service operations permitted by applicable law and Google’s API Services User Data Policy.
How we use information
We use information to provide and administer ResFly, authenticate users, enforce program permissions, deliver requested communications and integrations, prevent abuse, troubleshoot problems, maintain audit records, and improve reliability and usability.
How information is shared
Information may be shared with authorized members of the user’s residency program according to program roles and settings. We may also use service providers that process data on our behalf for hosting, databases, email delivery, file storage, monitoring, and authentication. These providers may use the information only to perform services for ResFly.
We may disclose information when legally required, to protect users or the service, or as part of a merger, acquisition, financing, or sale of assets with appropriate safeguards.
Security and retention
ResFly uses administrative, technical, and organizational safeguards appropriate to the nature of the information. Google OAuth access and refresh tokens are encrypted in storage. No system is completely secure, but we work to prevent unauthorized access, alteration, disclosure, and loss.
We retain information while it is needed to provide the service, meet program requirements, resolve disputes, enforce agreements, and satisfy legal obligations. Retention periods may vary by data type and program configuration.
Your choices and deletion requests
Users can disconnect Google Drive from ResFly and can revoke ResFly’s access from their Google Account security settings. Users may request access, correction, export, or deletion of personal information by contacting their program administrator or ResFly. Some information may be retained when required by law or legitimate program recordkeeping needs.
Children, international use, and changes
ResFly is intended for professional medical education and program administration and is not directed to children. Information may be processed in the United States and other locations where ResFly’s service providers operate. We may update this policy and will revise the “Last updated” date when changes are made.
Contact
Questions or privacy requests may be sent to support@resfly.app.