Your information, handled with care.

What we collect

We collect only what the staffing relationship needs:

• Application data — name, contact details, CV, license states, certifications, references, work history, and availability submitted through the site or by email.
• Contact-form data — your name, email address, who you are (facility, clinician, or general inquiry), an optional role or specialty, and the message you send us.
• Usage telemetry — anonymous, aggregated visit data via Plausible Cloud (no cookies, no cross-site identifiers, no stored IP). See the Cookies notice.
• Operational records — the credentialing paperwork, references, and assignment history we gather and hold for the clinicians and facility partners we work with, in coordination with each facility's medical staff office.

How we use it

• To match clinicians to assignments and facilities to qualified clinicians.
• To facilitate credentialing, onboarding, and assignment logistics.
• To respond to inquiries and stay in touch with the clinicians and facility partners we work with.
• To meet the legal, regulatory, and contractual obligations specific to healthcare staffing.

Where it lives

• Application + contact data — Supabase (US-hosted Postgres, encrypted at rest).
• Outbound transactional email — Resend (US-based email delivery).
• Anonymous site analytics — Plausible Cloud (cookieless, no stored IP).
• Site hosting — Cloudflare (global edge network).

How long we keep it

These are our own retention windows. Where the law sets a floor we meet or exceed it; otherwise they reflect how long the staffing relationship actually needs the records.

• Job-application data — up to 18 months from last contact, then deleted unless an active engagement extends the relationship. (Federal EEOC rules require only one year; the longer window is our own policy.)
• Contact-form messages — up to 12 months from last reply, then deleted.
• Operational records tied to an active clinician or facility engagement — kept for the duration of the engagement, then as long as our agreements and applicable law require — typically up to 7 years after it ends, to align with Texas employment-record and tax statutes of limitation.

A note on HIPAA

IMS is a staffing agency — not a healthcare provider or health plan. The information we collect about you (contact details, licenses, certifications, references, and work history) is professional credentialing information about you as a clinician, not patient health records, so it is not "protected health information" under HIPAA. When you are placed at a facility, any patient information you handle on that assignment is governed by that facility's own HIPAA policies, because on assignment you work under the facility's direction — not ours.

Your rights and how to exercise them

You can ask us at any time to confirm what we hold about you, correct it, or delete it. Email [email protected] with the subject Data deletion request. We aim to respond within 30 days.

We do not sell personal data, and we do not share it with third parties for advertising. We disclose only to the sub-processors listed above and to facilities or clinicians involved in an active engagement you have agreed to.

Privacy laws and where you live

Innovative Medical Staffing is a small Texas-based business. The comprehensive US state consumer-privacy laws — including those in California (CCPA/CPRA), Colorado, Connecticut, Virginia, Utah, and our home state of Texas — generally apply only to larger companies that cross specific revenue or data-volume thresholds, or that sell personal data. We do not meet those thresholds, and we do not sell personal data. Most of these laws also do not cover the information you give us as a job applicant or a business contact.

Texas's own law — the Texas Data Privacy and Security Act — exempts businesses that qualify as a "small business" under US Small Business Administration standards, which we do. The one rule that still applies to every business, large or small, is that sensitive personal data may not be sold without your consent; we satisfy it by not selling data at all.

None of that changes how we treat you. Whatever the law requires, you can ask us to confirm, correct, or delete what we hold — use the deletion-request flow above, and we will honor reasonable requests.

Where we operate

IMS is a US-based staffing agency serving US healthcare facilities and US-based clinicians. We do not target or market our services to people in the EU or UK, so the GDPR does not generally apply to what we do. If you are in the EU or UK and have a question or request about your information, email [email protected] and we will do our best to help.

Changes to this notice

We update this notice when our practices change or when the law requires it. The date at the top reflects the most recent change.