How Synchro protects your team's data.
Synchro manages staff schedules, not patient charts. We take security seriously, and we don't over-promise.
What we actually do
Access control
Every action requires a login. Each user has a role: administrator, manager, physician, nurse or other professional. Each person sees only what they need. Sessions time out on their own.
Audit logging
We log admin actions, like building or publishing a schedule. If a question ever comes up, you can see who did what.
Backups
We back up your data every day and keep each backup for 30 days. We test restoring from them on a regular basis.
Infrastructure
Synchro runs on well-known cloud providers. Each one has its own security measures and outside certifications. Every one of them is named, with its role and country, on our Subprocessors and hosting page.
Law 25 and privacy
Quebec's Law 25 applies to any organization that handles personal information, including information about staff. Synchro does not handle patient data. Medical record systems do that, under stricter rules. We do handle information about your team: names, availability, absences and preferences.
We follow the basic principles. We collect only what we need. We use it for one clear purpose: running your schedule. We keep it secure. And every user can see and correct their own information.
For this information, your clinic is the responsible party and Synchro acts as its service provider. Our commitments in that role are written in our Data Processing Agreement, which forms part of our Terms of Service. For a question about your information: [email protected].
What we don't claim
We are a young company, founded in 2025. We do not yet hold an outside-audited certification such as SOC 2 or ISO 27001. We would rather tell you that than claim one we don't have.
If an incident happens
If there is a confidentiality incident:
- We act right away to reduce the risk of harm
- We notify the person your clinic designated without delay, and no later than 72 hours after confirming the incident
- We record it in our incident register and share our review of what happened with you
To report a security flaw, write to [email protected].
Frequently asked questions about data security
Is my data used to train AI?
No. We use your data only to run Synchro for you.
Can I export my data?
Yes. You can export to CSV or iCal at any time. If you cancel, you can take all your data before the account closes.
What happens if I cancel?
We keep your data for 30 days after you cancel, so you can still get it back. Then we delete it.
Where is the data physically?
In the United States, with the providers listed on our Subprocessors and hosting page. If you need a specific region (for example, a CIUSSS contract that requires Canadian hosting), contact us and we can talk about it.