Privacy Policy

1. Introduction

MyAppointments.io ("we", "us", "our") is committed to protecting and respecting your privacy. This policy explains how we collect, use, store, and protect your personal data when you use our appointment management platform.

We are the data controller for the personal data we process. If you are a business owner using our platform, you act as a data controller for your customers' data, and we act as your data processor.

2. Data We Collect

Account Information

• Name, email address, and password (via Firebase Authentication)
• Business name, address, phone number, and VAT number
• Job title and role within a business

Customer Data (entered by business owners)

• Customer names, email addresses, and phone numbers
• Appointment history and notes
• Invoice and payment records

Technical Data

• IP address (anonymised after 30 days)
• Browser type and version
• Web performance metrics (Core Web Vitals)
• Error logs and diagnostics

3. How We Use Your Data

We process your data for the following purposes:

• Service delivery: Managing your account, appointments, invoices, and business operations
• Communication: Sending appointment reminders, invoice notifications, and system alerts
• Payment processing: Facilitating payments through Stripe (we do not store card details)
• Service improvement: Analysing performance metrics and error data to improve reliability
• Legal compliance: Meeting our obligations under applicable law

Our legal bases for processing under GDPR Article 6 are: contract performance (6(1)(b)), legitimate interests (6(1)(f)), and consent (6(1)(a)) where you have opted in to marketing communications.

4. Sub-processors

We use the following third-party services to operate the platform:

5. Data Retention

• Account data: Retained while your account is active; deleted upon account deletion
• Error tracking data: Automatically deleted after 90 days
• Email audit logs: Retained for 1 year
• Web performance metrics: Retained for 90 days
• Booking session data: Automatically cleaned up on expiry
• IP addresses in logs: Anonymised after 30 days

6. Your Rights

Under GDPR and UK GDPR, you have the following rights:

• Right of access: Request a copy of all your personal data (available in Settings > Privacy)
• Right to rectification: Update your personal information at any time
• Right to erasure: Delete your account and all associated data
• Right to data portability: Export your data in a machine-readable format (JSON)
• Right to withdraw consent: Revoke marketing or cookie consent at any time
• Right to object: Object to processing based on legitimate interests
• Right to lodge a complaint: Contact the Information Commissioner's Office (ICO) at ico.org.uk

7. Cookies

We use essential storage required for authentication and core site functionality. We also offer optional Google Analytics to help us understand site traffic and improve the service. Analytics loads only after you explicitly choose "Accept analytics"; choosing "Essential only" does not enable it. You can change your choice by clearing this site's stored consent and selecting again.

8. Data Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS/SSL via Cloudflare), secure authentication (Firebase), rate limiting, and regular security reviews. Payment card data is handled entirely by Stripe and never touches our servers.

9. International Transfers

Our primary infrastructure is hosted in AWS eu-west-2 (London). Some sub-processors (Firebase, Stripe) may process data in the US under appropriate safeguards including Standard Contractual Clauses and adequacy decisions.

10. Contact

For privacy-related enquiries, data subject requests, or complaints, please contact us at [email protected].