Appointment data can reveal health information. We treat patient identity, appointment context, templates, provider identifiers, and delivery data as sensitive unless it is clearly operational-only.
Clinic usersNames, email addresses, login identity, workspace roles, billing authority, support requests, and audit records for account activity.
Clinic setupClinic name, timezone, sender and reply-to details, phone, website, booking link, templates, merge fields, and automation rules.
Booking-calendar connectionCliniko API keys and Calendly OAuth credentials are handled as backend secrets. The database stores secret references, fingerprints, connection status, verification details, and the setup data needed for the connected workflow.
Imported email designs and imagesWe store saved email designs and images included in supported imports. Hosted images have public web links so email apps can display them without a sign-in. They are intended for clinic logos, photos and other public design assets, not patient information or confidential documents. Images can remain available for previously delivered emails when a design is updated.
Cliniko patient formsWhen an automation includes a Cliniko form link, we use the patient and chosen form references to find or create the appropriate form and check whether it is complete. Forms and their answers remain in Cliniko. Secure form links are used when preparing the email and are not saved in our database or operational logs.
Patient and appointment dataFetched from the connected Cliniko or Calendly account when needed to match rules, schedule messages, render merge fields, or confirm send eligibility. This can include names, email addresses, provider IDs, booking time and type, practitioner or host, location, booking status, timezone, and any communication preferences the provider supplies.
Campaign audience and consentWhen a clinic uses Campaigns, we store the synced recipient name, email address, provider ID, audience status, consent source and evidence, and the available fields used for filtering. Cliniko marketing preferences can be synchronised. Calendly does not provide a marketing preference, so invitees remain ineligible until a clinic user records permission or confirms that selected Calendly event types already collect it.
Email delivery dataScheduled-message and campaign-recipient state, test-send details, provider message IDs, delivery outcomes, skip reasons, bounces, complaints, opens, clicks, unsubscribes, and redacted operational logs.
Patient feedbackWhen you choose to answer a clinic’s feedback survey, your response is saved separately from the invitation. It contains the clinic, a 0–10 score, an optional encrypted comment, and the day of the response, without a link to your patient record, email address, appointment or survey link. Clinic staff can see scores and reports; only clinic owners and administrators can read comments. Please leave out names, contact details and medical information: details you write may identify you to the clinic. Invitations are stored separately to manage delivery, prevent repeat answers and expire links after 90 days.
Recall resultsTo show whether a patient booked after a recall, we keep internal patient and appointment references, the recall date, and booking dates. These reports do not require us to store a patient’s name, email address, or clinical notes.
Billing dataStripe customer, subscription, checkout, portal, invoice, trial, and plan metadata. Payment card details are handled by Stripe, not stored by MyHealthFollowup.