Smart solutions for the work schedules of Croatian healthcare institutions.
The roster that refuses to break the rest rules
Where the elusiveness of time becomes order.
ChronOrdo builds a ward’s whole month in one run, with the Croatian Labour Act enforced inside the generator — and leaves a record you can hand to an inspector.
- All personal data processed in the European Union
- Twelve-hour daily rest enforced as a hard floor
- Sick leave routes to HR, never to the ward chief
- Croatian and English throughout — interface, exports, manual
| Staff | mon12 | tue13 | wed14 | thu15 | fri16 | sat17 | sun18 |
|---|---|---|---|---|---|---|---|
| A. H.internal medicine | J | J | N | N | PR | ||
| M. K.cardiology | P | D | J | J | |||
| I. P.registered nurse | J | N | N | P | PR | ||
| D. B.nursing technician | GO | GO | GO | GO | |||
| S. V.internal medicine | J | P | P | J | D |
BlockedRest between the night and afternoon shift: 8 hours. The statutory minimum is 12.ZoR čl. 74
You already know how the month really goes
The head nurse opens last month's spreadsheet and starts again. Three days disappear. Then someone calls in sick on the 14th, and the fix is a round of phone calls — with nobody able to check whether the replacement came off a dežurstvo eleven hours ago.
- The spreadsheet is the system
- It is inherited from a predecessor. Formulas get copied, exceptions are carried in someone's head, and a mistake shows up only once the shift has been worked.
- Replacements happen by phone
- Cover is arranged verbally. Who is rested, who may stand in for whom, and whether it is even permitted are settled in the moment — and recorded nowhere.
- Compliance you cannot prove
- When the inspector arrives, "we were careful" is not an answer. You have to show who worked, how long they rested between duties, who approved any departure and why — per day and per worker.
- A day or two spent adding up hours
- At month end someone totals every worker's hours by hand: regular time, nights, weekends, public holidays, overtime, dežurstvo and pripravnost. It costs a working day or two, and each transcription is a fresh chance at an error nobody notices until payday.
- A distribution nobody measures
- Weekends, public holidays, night, afternoon and morning shifts and on-call duties do not fall evenly. Without numbers it stays invisible — until someone works out they have had every second weekend for three months running.
Four steps, and the ward runs on it
Nothing here needs an IT project. A ward is configured once, then repeats a monthly rhythm: configure, generate, review, publish, lock.
- 01
Step 1 — Set the ward up once
Every new organisation is seeded with the Croatian healthcare workforce catalogue: 227 professions across seven branch categories — six aligned to the professional chambers, one for non-medical staff — each carrying its chamber-derived code. You then set your shift templates, profession and branch quotas, rest policy, fairness window and — if you use them — workstations (radilišta). Staff arrive through an Excel roster import with a preview step, individual invitations, or Microsoft Entra ID single sign-on.
- 02
Step 2 — Staff say what they need
Workers file shift wishes and free-day requests, and set a standing shift preference. Wishes are validated when they are saved and again immediately before generation, so a wish accepted in the app cannot silently become impossible. Any wish the generator could not honour is recorded, with the reason, in the generation report.
- 03
Step 3 — Generate, and review a draft
The generator solves the month as a constraint-satisfaction problem: staff wishes, profession and branch quotas, Croatian Labour Act hard constraints, and fairness. Weekends, public holidays, night, afternoon and morning shifts, dežurstvo and pripravnost are all counted per worker across a rolling twelve months, so the generator evens out what a spreadsheet cannot show. Understaffing never aborts the run — the seat stays vacant and is routed to you. Understaffing is not hidden or quietly handed to you either: where a ward genuinely has no lawful option, recording a statutory rest breach is a deliberate, chief-only act that needs a written reason, and it opens an unresolved critical incident pinned to the chief who signed it, raises a compensatory-rest debt owed to the worker, and notifies that worker. No automatic path can do it. You can regenerate as often as you like, or rehearse a change in a sandbox (Isprobaj raspored) that never touches the live roster.
- 04
Step 4 — Publish, attest, lock
For the seats that stay open you can ask for a computed coverage proposal: it names who would take each seat and the rest that worker has before and after it, and nothing is written until you sign — and then all of it or none. Where nobody is free, the proposal may move an already-assigned worker and refill the shift they left; those rows are badged, because they change a roster somebody has already been given. The 12-hour statutory daily rest is never crossed, and any row that is not fully rested carries a written justification. Publishing is gated: every violation and open vacancy must be resolved or explicitly acknowledged with a written reason first. The published roster goes out by email with the PDF attached. Through the month the chief confirms each elapsed day in the Timesheet (Evidencija radnog vremena), which freezes that day. Hours are never added up by hand: they are carried per worker and per category — regular time, nights, weekends, public holidays, overtime, dežurstvo and pripravnost. When every day is confirmed, the month locks and writes immutable hour snapshots, so the day or two month end used to cost becomes an export.
Croatian labour law is the model, not a settings screen
Each institution declares its binding legal framework. Every rule below follows from that choice.
| Basis | Rule | Response |
|---|---|---|
| ZoR čl. 74 | Twelve hours of continuous daily rest. The gap is measured in real instants across the Europe/Zagreb daylight-saving change, not by subtracting clock hours. | Blocks |
| ZoR čl. 75 · Healthcare Collective Agreement | Thirty-six hours of continuous weekly rest, or forty-eight under the public-healthcare framework. Measured as a rolling 168-hour window, not by counting days. It blocks automatic placement by default and cannot be lowered at all in public healthcare; a private-sector institution may lower it to recording only. | Blocks |
| ZoR čl. 69 | Night work by adults is tested against the fixed 22:00–06:00 statutory band, decoupled from the editable night band a ward uses for pay. | Blocks |
| ZoR čl. 65(6), 68(2) | Pregnancy, parents of a child under eight, and part-time staff working for several employers — each behind a written consent window with a start and an end date. | Blocks |
| ZoR | Workers under 18, on their recorded date of birth: no night shifts (22:00–06:00), no dežurstvo, no overtime, at most 8 hours of active work in any rolling 24 hours, and 48 hours of continuous weekly rest. No consent and no emergency lifts any of it. | Blocks |
| ZoR čl. 79, 84 | Annual leave is consumed in the worker’s real working days, not Monday to Friday. Sick leave falling inside it interrupts the leave and refunds the days. | Automatic |
| ZoR čl. 86 | Statutory paid leave for life events and blood donation cannot be refused for understaffing — the refusal drops to a warning and the absence is still recorded. | Warns |
| ZoR čl. 62 | Hour norms and the share of nights, weekends and public holidays are prorated against the contracted part-time hours. | Automatic |
| ChronOrdo rule | 24 hours of rest after dežurstvo, and a 16-hour ceiling on an adult's active work in one duty. This is our institutional safety rule, not a provision of the Labour Act. | Blocks |
| ZoR čl. 65, 66 · NN 2/2026 čl. 73 | The 48-hour average week, the 50-hour (60 under NN 2/2026) weekly maximum and 180 annual overtime hours are computed and surfaced as findings for the chief to act on, rather than enforced as blocks. | Warns |
Where we detect rather than enforce, we say so. Recording a rest breach never makes a roster lawful — it opens an unresolved incident and an obligation to give the rest back.
Everything the ward actually does in a month
These are shipped capabilities, in use from the first roster you generate — not a roadmap.
Generate the whole month in one run
Press Generate and walk away; the roster is built in the background from your shift configuration, weekday/weekend/blagdan overrides, profession and branch quotas, staff wishes and a fairness ledger. Draft output can be regenerated as often as you like before anyone sees it.
Absence and annual leave, handled to the letter
Sixteen selectable leave types plus the custom ones each ward defines, with per-ward approval rules, oldest-first (FIFO) annual-leave consumption, prorated allocation for mid-year hires, carryover with expiry, and background jobs that assign the new year's entitlement and expire stale carryover. Before an absence is approved, the real generator runs twice with the same seed — with and without it — so only the days that absence newly breaks are blocked, and a pre-existing shortfall no longer freezes anyone's leave.
One phone call in sick, absorbed automatically
A reported medical absence immediately places a hospital-wide unavailability hold, before any HR approval, and overlapping published shifts in every department split or vacate. The approved absence then triggers partial regeneration and automatic replacement from lawful candidates. Whatever still cannot be covered lands on the Prazne smjene page with a green, amber or red rest advisory beside every candidate — and cross-department candidates carry chamber-compatibility warnings.
Dežurstvo and pripravnost kept legally apart
Separate duty types, separate opt-in pools, separate quotas, separate generation, separate replacement workflows and separate rest consequences. Each pripravnost call-in is recorded as its own activation with exact intervals, and a heavy night's activations upgrade the rest class and raise correction work for adjacent shifts.
An attested timesheet and a locked month
Per-day confirmation writes one immutable record per worker and freezes that day's shifts, stand-by and absences across fifteen handlers — with a lock icon in the grid and a daily 09:00 reminder email listing what is still unconfirmed. Locking the month writes immutable hour and absence-hour snapshots that database triggers physically refuse to let anything change. Reopening a month is restricted to organisation leadership and HR, behind a mandatory reason, and reverses every hour-bank movement through an append-only entry rather than deleting it.
COP-coded hour reports and exports everywhere
HR maps every working-hour and absence-hour category to your own COP codes on a dedicated page; those codes are then printed on the Excel and PDF hour reports your payroll team works from. The roster, statistics, overtime, absences, users, audit trail and preferences all export to Excel and PDF, in Croatian or English, with large exports running as background jobs and every download audited.
Health data does not follow clinical line management
Your institution is the controller. ChronOrdo is the processor. We provide the technical and organisational measures; the compliance conclusion stays yours.
Nine sensitive absence types never reach the chief
Sick leave, work injury, occupational disease, pregnancy complications, family care, quarantine, organ transplant, HZZO-funded sick leave and family/maternity leave route to HR. A department chief cannot approve, reject or create them, and sees only a redacted category label — on the roster, in the timesheet, in exports, everywhere. An architecture test fails the build if that redaction is ever bypassed.
A ward-level HR role for the glavna sestra
Department HR (Kadrovska služba odjela) gives the head nurse the Art. 9(2)(b) employment-law authority over her own ward's health data, without granting the ward chief access to it. It is scoped to the departments she holds, and a chief can never mint it — that would defeat the separation it exists to create.
If no HR seat exists, nothing is rejected
A sensitive request with no HR configured parks in a durable state, stays privacy-redacted, and is rerouted automatically once HR is set up. It is never refused and never downgraded to the chief.
Self-service data-subject rights
Staff can exercise their rights without going through a form on someone's desk: a request portal that verifies identity before anything is disclosed, and a machine-readable export that also satisfies the Art. 20 portability right. Signed-in staff get a one-click export page, plus login activity, active sessions, privacy settings and a page listing security incidents that affected them.
An internal clock, and a job watching the statutory one
Our DPO policy targets sit well inside the statutory month: three business days to acknowledge and verify identity, seven to fulfil an access or portability request, five for rectification, three for restriction. The statutory Art. 12(3) deadline is tracked independently, so a request cannot quietly run past it. The first request from any data subject in a rolling year is free.
Erasure that is cryptographic, and automatic
Erasure is cryptographic: the record becomes permanently unreadable rather than merely flagged as deleted, while the audit trail stays intact — which is how Art. 17 and the čl. 38 duty to keep working-time evidence are reconciled. A daily job anonymises departed staff at the retention horizon (11 years after departure by default) and refuses to run at all if retention is configured below the čl. 38 statutory minimum, rather than deleting statutory records early.
Article 22 handled openly
Schedule generation is treated as automated processing with a significant effect. The disclosure is delivered in-product, versioned, and re-shown when generator logic materially changes — recorded as an acknowledgement of delivery under a legal-obligation basis, never as consent. Until it is acknowledged, state-changing requests are refused. ChronOrdo does no profiling: no behaviour, performance or characteristic is inferred.
The paperwork your DPO will ask for already exists, in Croatian
A data processing agreement with a technical and organisational measures annex, Art. 30 records in both processor and controller form, a DPIA basis document written for hospital legal and IT departments, a data retention schedule, the sub-processor list, an Art. 14 employee notice and an AZOP complaint procedure. The agreement grants you an annual audit right on 30 days' notice, plus an extraordinary audit without notice on justified suspicion of a breach.
What your IT department and DPO will want confirmed
Stated as commitments rather than as configuration. The detail behind each one lives in the technical and organisational measures annex to our processing agreement, which goes to your team under contract.
Your data stays in the European Union
All personal data is processed within the EU, and the deployment will not run in a region outside it. There is no third-country transfer for primary processing.
Encrypted at rest and in transit
The database is encrypted in full, national identifiers carry a further layer of their own, and every connection between your staff and the service is encrypted end to end.
An audit trail that shows tampering
Every change is recorded automatically and sealed, so altering a historical entry becomes detectable rather than silent. Recording is on by default and is not something a developer can forget to switch on.
One institution's data cannot reach another
Separation is enforced in the data layer rather than in the interface, and it is re-verified automatically on every change — so a new feature cannot quietly open a path between institutions.
Access scoped to the ward, with separation of duties
Permissions are granted per department, elevated roles cannot be self-assigned, and irreversible actions require a second confirmation and a recorded reason. Our own staff are structurally kept out of your personnel data.
Backups, recovery and breach notice
Backups run daily with point-in-time recovery and a copy held in a second EU location. Our processing agreement sets the recovery objectives and commits us to notify your data protection officer within a fixed window of becoming aware of a breach — deliberately ahead of the deadline you owe AZOP.
Maintenance planned around your handovers
Routine maintenance is announced at least 48 hours in advance and scheduled away from shift handovers and the month-end payroll close.
The questions a careful buyer asks
What happens to our data if we stop using ChronOrdo?
You take it with you, free of charge. On expiry or termination the contract commits us to a full export of your data in machine-readable format at no extra cost — including the complete organisation export, whether or not that module was activated during the term — plus transition assistance and read-and-export access for up to 30 days afterwards. That right survives termination, including our own insolvency or liquidation. Your data remains your property throughout. The processing agreement then lets you choose deletion or return, executed within 30 days with a written destruction certificate, statutory working-time records returnable before deletion, and backups purged within 90 days. One thing worth knowing that most vendors do not offer: even if your account is suspended for non-payment, you keep read and export access to your statutory working-time and payroll evidence. Only operational features stop. You cannot lawfully be locked out of a record the Zakon o radu obliges you to keep.
Is a generated schedule an automated decision under GDPR Article 22?
Yes, and we treat it that way rather than arguing otherwise. The generator is deterministic constraint satisfaction, and its output determines which days a worker works, their night and weekend rotation and their pripravnost calendar — so we disclose it as automated processing with a significant effect. Three things follow. First, the lawful basis is Member State law under Art. 22(2)(b), not consent: staff are not asked to agree to their own roster being generated. Second, the disclosure is delivered in-product, versioned, recorded with timestamp and notice version, shown again when the generator's logic materially changes, and visible in the worker's own data export — and until it is acknowledged, state-changing requests are refused. Third, no generated schedule takes effect on its own: the output is a draft until a human chief publishes it, and a chief may change any assignment. Explanation runs through the department chief, who can see the constraints and inputs; contesting runs through the chief, your grievance procedure under the Labour Act, or AZOP. ChronOrdo does no profiling — it infers nothing about behaviour, performance or personal characteristics.
Can a department chief see why one of their nurses is absent?
No, by construction. Nine absence types — sick leave, work injury, occupational disease, pregnancy complications, family care, quarantine, organ transplant, HZZO-funded sick leave, and family or maternity leave — are classified as sensitive. They route to HR for approval; a chief is refused if they try to approve, reject or create one. Every response the chief receives passes through a redaction service, so on the roster, in the timesheet, in exports and in the audit views they see a category label and nothing more. The same rule applies to the reason a worker is exempt from on-call: the chief sees that an exemption exists, never which category it falls under. And a protected roster day carries no reason field at all — deliberately, because a "why is this day protected?" box would become a collection funnel for Article 9 data. If your ward wants HR authority closer to the floor, the Department HR role gives the glavna sestra that authority for her own ward only, still without opening it to the clinical chief.
Does ChronOrdo file our payroll with COP, FINA or HZZO?
No — and that is worth being clear about up front rather than at month end. What ChronOrdo does is get your hours right and code them the way your payroll team needs. Your HR maps every working-hour and absence-hour category to your own COP codes on a dedicated setup page, and those codes are then printed against each column on the Excel and PDF hour reports. For a locked month, those figures are rebuilt from the immutable snapshots written at lock time rather than from live data, so the report is reproducible months later. Submission itself stays with your payroll team and your existing channel — ChronOrdo generates no FINA-format submission file and has no integration with HZZO. HZZO appears in the product in one place only: sick leave carries an append-only, effective-dated record of who funds which interval, employer or HZZO, so a payer change part-way through one continuous absence does not require retyping or splitting the record.
Does ChronOrdo guarantee our rosters comply with the Zakon o radu?
It is designed for it, and we will show you the mechanism rather than sell you the conclusion. Our contract carves the working-time rules module out of the usual "as is" disclaimer: we warrant that the rest, overtime and other statutory working-time rules are designed for compliance with the instruments in force at the contract date — the Zakon o radu and the healthcare collective agreement — and that updates arising from changes to those instruments are part of the service. The warranty covers our engine rather than what you configure or what your staff enter, which is where most real exposure sits. Two things worth being precise about. The averaging limits — the 48-hour average week, the weekly maximum, the 180 annual overtime hours — are computed and reported as findings for the chief to act on rather than enforced as blocks, and the rules table says so. And recording a crossing of the statutory rest floor never makes a roster lawful: it opens an unresolved incident, a compensatory-rest debt owed to the worker, and a notification to that worker. Compliance remains your institution's to determine; what ChronOrdo gives you is a roster built to the rules and the evidence to show it. The full scope, and any limits that apply during an evaluation, are set out in the agreement we send before signature.
See it run on your own ward's rules
A demo on your shift patterns, your professions, your legal framework — not a generic sandbox.
ChronOrdo is built by ZanderLogic d.o.o., OIB 76778519738. Your institution remains the controller of its employees’ data; ChronOrdo is the processor.