Privacy Notice

This notice describes how Appointomat handles personal information for businesses in the United States and the people who book appointments with them. The Polish polityka prywatności is a separate document for customers under Polish law, not a translation of this one.

1. Two roles, and which one applies

For your clients' information, the practice is in charge and we are not. The practice decides what to collect and why; we process it on the practice's instructions under the data processing addendum. In California's vocabulary the practice is a business and we are a service provider; in Washington's, the practice is a regulated entity and we are a processor. A client's request about their own information goes to the practice.

For the account of the person who runs the practice, we are in charge. Section 3 covers that.

The controller in that second sense is Nikita Cherevko, a natural person established in Poland. Contact: nikita@appointomat.com.

One thing worth saying up front. California's thresholds - annual revenue, volume of consumers, or revenue from selling personal information - are almost certainly not met by an operation this size, so the CCPA's obligations on a business probably do not attach to us today. The disclosures in section 6 are given anyway. Washington's law has no such threshold, which is why section 7 is the one to read.

2. Client information we process for a practice

The fact that a person has an appointment with a wellness provider says something about them, so the set is closed by design rather than by stage of development: who, when, with whom, for which service, and whether they came.

There is no field for a clinical note, a diagnosis or a treatment record, and there never will be. There is no field for a Social Security number, a date of birth, an address or insurance details.

The service name shown in a message is a separate field that defaults to a neutral word, so a reminder does not print a service on a lock screen. A practice can change it, and then it is the practice's decision.

3. Account information we control

The email address and account identifier of each person who signs in, the practice name, its booking address, time zone, currency, chosen plan, and the practitioner name shown to clients. Technical logs carrying the practice and account identifier, and when each account last used the app, to the hour. For 90 days we also record which screens of the app were open and for how long, and what kind of change was made and whether it succeeded - as names of screens and functions (for example "working hours: saved"), never with content, searches or client information. This tells us where a new practice got stuck, so we can offer help and improve the product. No third-party analytics or screen recording is used.

Staff accounts. The practice owner may invite other people by email address, with a role (full access, calendar and services, or front desk) and optionally a calendar. We then hold that address, the person's name, the role, who sent the invitation and when, until when it is valid (7 days), and whether it was accepted or declined, and - after it is accepted - the account identifier. We keep the invitation link only as a cryptographic hash. An invitation nobody accepted is deleted when the practice revokes it. An account that was used stays after access is revoked, without the ability to sign in, because notes that person wrote are attributed to it; the practice can restore access. One account belongs to one practice.

A record of acceptance. When the practice owner accepts the terms and the data processing addendum, we record their identifier and email address, the document, its version, and the time. It exists only to show who accepted which version, is kept indefinitely, and is not deleted with the account - a contract with no evidence of acceptance proves nothing.

If you use the contact form on this site we also hold your name, email address, practice name and message.

4. Where information is held, and who else touches it

Everything is processed in the European Union. The database and the application are both in Belgium; email is delivered by a provider in France. No patient information is stored in the United States. The one exception is staff sign-in: the email address and account ID of the people who work in a practice are processed by Google Firebase Authentication, which runs only in US data centers.

The full list, with each provider's role and location, is at sub-processors, and it changes only on 30 days' notice.

We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined in California law. We have never done either and the product has no advertising in it.

5. How long

6. California

For the twelve months preceding the date of this notice, and going forward:

We do not use sensitive personal information to infer characteristics about anyone, and we use it only for the purposes permitted without a right to limit under the CCPA - that is, to perform the service asked for. There is therefore nothing for a "limit the use of my sensitive personal information" request to switch off, and we say so rather than offering a control that would do nothing.

Your rights are to know what is collected, to access it, to have it corrected, to have it deleted, to opt out of sale or sharing (there is none), to limit the use of sensitive information (see above), and not to be discriminated against for exercising any of them. Exercising a right never changes your price or your service.

How to exercise them: email nikita@appointomat.com. If you are a client of a practice, send your request to that practice - they hold the decision and we hold only the tools. We will ask for enough information to be satisfied you are who you say you are, and no more. An authorised agent may act for you with written permission. We answer within 45 days and may extend once by a further 45 days, telling you why.

7. Washington, and other state consumer health laws

This is the section that most likely applies to you, and the one that does not go away because you are not covered by HIPAA.

Washington's My Health My Data Act reaches consumer health data, which includes information identifying a person's past, present or future health status - and an appointment with a wellness provider is within it. The Act applies to any regulated entity doing business in Washington or targeting Washington consumers, with no revenue or volume threshold, and it carries a private right of action under the Consumer Protection Act. Nevada's SB 370 is similar in shape. Connecticut, Colorado and a growing number of other states treat health data as sensitive data requiring consent.

What that means here:

• The practice is the regulated entity and we are its processor. The practice decides what consumer health data to collect and for what, and the obligations that attach to a regulated entity - publishing a consumer health data privacy policy, obtaining consent, honouring requests - are the practice's. We process only on its instructions, under the addendum.
• We never sell consumer health data, as Washington defines a sale, and we would not do so on any authorisation. There is no price for it.
• We collect only what is necessary to provide the service the person asked for, which is the boundary the Act draws around collection without consent.
• We help the practice answer a request - to access consumer health data, to withdraw consent, or to delete - through the export and deletion tools in the application. Deletion means deletion: the appointments go too, not a record with the name removed.
• A request from a consumer goes to the practice. If one reaches us we pass it on without delay and do not answer it ourselves.

If you run a practice in one of these states, the useful summary is that not being a HIPAA covered entity does not put you outside health privacy law - it puts you inside a different one, which is why section 4 of the terms excludes covered entities and this section exists for everybody else.

8. Security

Data is encrypted in transit and at rest. One practice's data is unreachable from another's session by the structure of the database rather than by a condition in a query. Clients have no accounts and therefore no passwords to steal; the links in messages are single-use secrets tied to one appointment and verified cryptographically before any database lookup. Every read of a client list and every export is logged. The detail is in section 8 of the addendum.

9. Cookies and analytics

Without your consent, this website stores nothing in your browser and loads nothing from Google. Consent covers one thing: the Google Ads tag.

On a first visit the site asks whether to load the Google Ads tag. Declining is as easy as accepting; without consent, no request goes to Google. Once you accept, Google sets cookies (_gcl_*) and learns that a visit from an ad ended with a click on a sign-up button - only so that we can count how many accounts a campaign brings. Ad personalization stays off. You can withdraw consent at any time with the "Cookie settings" link in the footer, which also deletes those cookies. Google handles this data as an independent controller under its own privacy policy. Your answer itself is kept in browser storage so the site doesn't ask on every page; that is strictly necessary and needs no consent.

Once you accept, the site also remembers in your browser, for at most 90 days, the ad click ID (gclid) and campaign tags (utm_*) from the address the ad led to, and adds them to the sign-up link. If an account is opened, we store them with the practice and send Google only the click ID and the time the account was opened - so the campaign counts accounts opened rather than clicks. Withdrawing consent removes them from your browser; those stored with a practice are deleted with it.

Traffic is measured with Umami, software we run ourselves on Google Cloud in Belgium (region europe-west1); nothing goes to its authors. It sets no cookies and uses no browser storage. Visitors are counted using a hash computed server-side from the IP address and browser header together with a key that changes daily. The IP address itself is not stored: it is used to look up an approximate location and then discarded. Each reading stores the time, the page address and title, how long the page was read while on screen, as a range such as 30-60 seconds and only after 10 seconds, the referring page, query parameters, country, region and city, browser language, operating system, browser and device type, plus clicks on sign-up and demo links, FAQ questions opened, and the topic of a contact form sent (never its content). A browser that sends Do Not Track or Global Privacy Control is not counted.

The application is different and is described separately. The practice application at app.appointomat.com stores a sign-in token and three small per-device settings: chosen language, dismissal of the setup checklist, and a plan selected while signing up. All are strictly necessary or set deliberately, none is used for tracking, and none leaves the browser. While an account is being opened it also holds the ad tags described above - only if consent was given on this website. Public booking pages store nothing in your browser.

Practices' public booking pages do not use this measurement. There we count only arrivals at the first booking page from outside it, to know whether promoting it brings visits. Each arrival is one record: the time, the practice, the referring site's domain (never the page), the link's utm_source, utm_medium and utm_campaign tags if it has them, and the country, looked up from the IP address on our own server using the DB-IP database (IP Geolocation by DB-IP). We record no IP address, browser, device, identifier or hash, so a record cannot point to a person or link two of their visits.

10. Changes

A change is published here with a new version and effective date. A material change - a new category of information, a new purpose, a new sub-processor, or a narrowing of rights - takes at least 30 days' notice by email to the address on the account.

This notice is information, not a contract: it needs no acceptance and its change asks nothing of anyone. The contracts are the terms and the data processing addendum.