This addendum forms part of the Terms of Service and governs how we handle your clients' personal information. It is accepted in the application when the account is opened, and the version and time of acceptance are recorded.
It is not a business associate agreement and does not make one available. Section 4 of the terms explains why, and excludes HIPAA covered entities from the service for that reason. Nothing in this addendum should be read as covering protected health information under HIPAA.
1. Parties and roles
You are the practice named on the account. We are Nikita Cherevko, a natural person established in Poland, at nikita@appointomat.com.
For your clients' personal information you decide the purposes and means and we act only on your instructions. Under California law you are the business and we are a service provider. Under Washington's My Health My Data Act and comparable state laws you are the regulated entity or controller and we are a processor. Where the European General Data Protection Regulation applies to your processing, you are the controller and we are the processor.
2. Subject matter, duration and instructions
We process your clients' personal information only to run an appointment book for you, for as long as your agreement lasts and for no more than 30 days after it ends.
Your documented instructions are this addendum, the terms, and what you and the people you authorise do in the application. We follow no other instruction.
3. Nature and purpose of processing
Booking, confirming, rescheduling and cancelling appointments, sending reminders and confirmations, and running a waiting list for freed slots. The operations are collection, recording, storage, organisation, display to people you authorise, transmission of messages to your clients, and deletion.
Migrating from another system
The application can load a file of clients and appointments exported from another system. This deserves its own clause because it is a bulk transfer of a set of health-related records, which is a different act from day-to-day scheduling.
- Loading the file is your instruction. You are responsible for being entitled to move that data into a new tool, and for whether the move is within the basis on which it was collected.
- We supply the mechanism and do not assess the lawfulness of the migration or check where the file came from.
- Column mapping is limited to the fields in section 4. A column holding a diagnosis, a Social Security number, a date of birth, an address or any treatment record has no destination field, cannot be mapped, and is never read. The limit follows from the absence of those fields, not from a rule that a setting could change.
- The file is parsed in your browser. Only the rows you mapped reach the server.
- Loading data sends no messages to your clients, in particular no confirmations for appointments carried over from a previous system.
4. Types of information and categories of individuals
Individuals: your clients, and people on your waiting list.
Information: name, phone number, optional and unverified email address, language, preferred message channel, appointment times, service, practitioner and attendance, a count of no-shows, your own cancellation note of up to 200 characters which is never sent to the client, waiting-list entries and the replies to offers, and a record of the messages sent.
The fact that a person has an appointment with a wellness provider is consumer health data under Washington's My Health My Data Act and comparable state laws, and sensitive personal information under California law, even with no note attached to it.
Permanently out of scope: clinical notes, diagnoses, ICD codes, referrals, documents, scans, photographs, Social Security numbers, dates of birth, home addresses, insurance details. No column exists for any of them, and adding one would require amending this addendum.
5. Our obligations
We will:
- Process your clients' personal information only for the purposes in section 3 and only on your instructions.
- Not retain, use or disclose it for any other purpose, and not outside the direct business relationship between us - including not selling it and not sharing it for cross-context behavioural advertising, as California defines those terms.
- Not combine it with personal information obtained from any other source, except as needed to run the service for you.
- Not use it for our own purposes. We do not build profiles on it, we do not train models on it, and we disclose it to nobody except the sub-processors in section 6.
- Certify that we understand the restrictions in points 2 to 4 and will comply with them. This sentence is here because California requires the certification to be in the contract.
- Bind everyone with access to confidentiality, by contract or by law.
- Apply the security measures in section 8.
- Meet the sub-processor conditions in section 6.
- Help you answer an individual's request - to access, correct, delete, or withdraw consent - through the export and deletion tools in the application. A request that reaches us directly is passed to you without delay and we do not answer it ourselves.
- Help you with security assessments, breach notification and risk assessments, to the extent the nature of the processing and the information available to us allow.
- Tell you if we can no longer meet these obligations, so that you can stop and remediate the processing.
- Delete or return the information when the agreement ends, under section 11.
You may take reasonable and appropriate steps to satisfy yourself that we are using the information consistently with your obligations, through the means in section 10.
6. Sub-processors
You give general authorisation for us to use sub-processors on the terms below.
The current list, with each one's role and location, is at /us/subprocessors and forms part of this addendum. It is kept separately so that changing a provider does not mean re-reading this document.
We impose obligations on each sub-processor no less protective than these, remain responsible to you for a sub-processor's acts and omissions as for our own, and give at least 30 days' notice by email before adding or changing one.
You may object on reasonable grounds within that period. If the objection cannot be resolved you may terminate immediately and require deletion under section 11, at no cost.
7. Where the data is, and transfers
All processing happens in the European Union. Nothing is stored in the United States. The locations are in the sub-processor list.
Your sending client data to us is not a restricted transfer under European law, because it travels into the EU rather than out of it. The transfer that does need a mechanism is the other direction: our making the data available to you, in the United States, as your processor. Where European data protection law applies to that flow, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Four (processor to controller), are incorporated into this addendum. Polish law governs them and the courts of Poland are the forum for the purposes of Clause 18(b). The Clauses do not apply where your own processing is already subject to Article 3(2) of the GDPR.
We will not move processing outside the European Economic Area without first changing the sub-processor list, which means the notice and objection rights in section 6.
8. Security
| Measure | |
|---|---|
| Location | Database and application both in Belgium, region europe-west1; both in the EU |
| Encryption | At rest at the database provider, in transit over TLS. The application serves HTTPS only |
| No client accounts | A client has no password to steal. Links in messages are single-use secrets tied to one appointment, verified cryptographically before any database lookup |
| Separation between practices | Enforced by the structure of the database - composite keys carrying the practice identifier - and by types the compiler checks. One practice's data is unreachable from another's session by construction, not by a condition in a query |
| Access control | Three roles with different permissions. Export and deletion of a client's data are restricted to the practice owner |
| Logging | Every read of a client list and every export is recorded with the practice and account identifier |
| Minimisation in messages | The service name shown in a message is a separate field defaulting to a neutral word, so a reminder does not print a service on a lock screen. The same applies to email subjects, calendar files and external calendar entries |
| Public pages | Appointment and offer links, and every booking step after the first, are excluded from search indexing with a no-referrer policy, so an appointment link never leaves in a header and never enters a search index. Only a practice's booking landing page, which holds no patient data, is visible to search engines |
| Backups | Held by the database provider, in the same location |
These may be updated as the service develops, but not in a way that lowers the level of protection.
9. Security incidents
We will notify you of a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to your clients' personal information without undue delay and no later than 48 hours after becoming aware of it, by email to the address on the account.
The notice will describe, so far as known at the time, what happened, the categories and approximate number of individuals and records affected, the likely consequences, and the measures taken or proposed. Further detail follows as it becomes available.
Notifying individuals and any regulator is yours to do - it is your obligation as the business, regulated entity or controller. We will help.
10. Audit
On request we will give you the information needed to show we are meeting this addendum, including the record of your acceptance with its version and date and the current sub-processor list.
You may audit, or have an auditor audit, no more than once a calendar year, on 30 days' notice, during business hours and without disrupting the service. The frequency limit does not apply after a security incident or where a regulator requires the audit. An auditor who is not your employee must be under confidentiality obligations. You bear the cost, unless the audit finds a material breach of this addendum.
11. Deletion and return
When the agreement ends you choose whether the data is returned or deleted. If you do not choose, it is deleted.
For 30 days after the agreement ends you may download everything in a machine-readable format. After that the data and its copies are deleted and cannot be recovered.
Deletion does not extend to anything the law requires us to keep, nor to the deletion log and the record of document acceptance, neither of which contains client data: the deletion log records only that a deletion happened and when, and the acceptance record concerns the practice owner and is the evidence that this addendum was entered into.
We will confirm deletion in writing on request.
12. General
This addendum changes on the terms in section 10 of the terms - at least 30 days' notice, with a right to terminate before it takes effect.
We may transfer this addendum to a successor under section 11 of those terms. The successor takes it unchanged and accedes to the Standard Contractual Clauses in section 7 as data importer. No re-acceptance is required, and you may object and terminate.
Where this addendum and the terms conflict on the handling of your clients' personal information, this addendum prevails.