Privacy Policy
How SpinaDesk processes, stores, and protects practitioner and patient operational scheduling data.
Effective Date: October 6, 2026
At SpinaDesk ("we", "us", "our"), we respect your privacy and are committed to protecting the personal data of our clinic customers ("Practices") and their authorized users, as well as handling patient scheduling metadata with the utmost confidentiality.
This Privacy Policy describes how we collect, process, store, and share information when you use our website, platform, and automated messaging tools (the "Service").
1. Categories of Information We Collect
1.1. Account & Registration Data: When you create an account, register for a demo, or subscribe to a plan, we collect your name, practice name, business email address, phone number, and account credentials.
1.2. Billing Data: Payments are securely processed through our Merchant of Record partners (Lemon Squeezy or Paddle). We do not store full credit card numbers or banking credentials on our servers. Your payment details are processed under the respective MoR’s privacy policy.
1.3. Practice Operational & Scheduling Data: When you connect calendar tools (such as Jane App, Google Calendar, or Doctolib), our platform processes appointment availability, booking time slots, cancellation events, and contact data (name, phone number, email) strictly necessary to execute automated waitlist re-engagement and review requests.
1.4. Technical & Telemetry Data: IP addresses, browser types, device identifiers, and session events collected via necessary cookies and analytics for system performance and security.
2. How We Use Your Information
We process data solely to:
- Provide, maintain, and execute calendar synchronization and waitlist dispatching;
- Send appointment recovery and notification SMS/emails on behalf of the Practice;
- Manage billing, verify accounts, and prevent fraud;
- Provide customer support, system updates, and security alerts;
- Comply with applicable legal, carrier (A2P 10DLC), and regulatory obligations.
3. Patient Data & Healthcare Roles (HIPAA / GDPR)
Role as Data Processor / Service Provider: With respect to patient contact and scheduling information, the Practice is the Data Controller / Covered Entity, and SpinaDesk acts as a Data Processor / Business Associate.
No Medical Records: SpinaDesk processes operational metadata (names, phone numbers, timestamps, appointment categories). We do not request, process, or store clinical medical histories, treatment notes, diagnostic images, or prescription records.
Consent: Practices remain responsible for obtaining all lawful patient consents required to communicate via automated SMS and email.
4. Sharing & Disclosure of Information
We never sell, rent, or trade your personal data. We disclose information only to:
- Merchant of Record & Payment Providers: (Lemon Squeezy / Paddle) to facilitate billing, fraud checks, and tax compliance;
- Infrastructure & Messaging Sub-processors: Secure cloud providers (e.g., AWS, Supabase, Vercel) and licensed telecommunications carriers (e.g., Twilio) strictly to transmit authorized messages;
- Legal & Regulatory Authorities: When required by subpoena, court order, or applicable law to protect rights, safety, and system integrity.
5. Security & Data Retention
We implement industry-standard administrative, physical, and technical safeguards (including AES-256 encryption at rest and TLS encryption in transit) to protect data from unauthorized access or disclosure. We retain data only as long as necessary to provide the Service or satisfy legal obligations. Practices may request deletion of their account data at any time.
6. Your Rights
Depending on your location (e.g., California under CCPA/CPRA, or the European Economic Area under GDPR), you may have rights to access, correct, export, or delete your personal information. To exercise any of these rights, email us at support@spinadesk.com.
7. Changes to this Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via your registered email or a prominent notification within the dashboard.
8. Contact Us
Des questions sur nos mentions légales ?
Notre équipe juridique est disponible pour répondre à vos demandes de conformité.