Privacy Policy

We collect only what books a patient.

What we collect

• Full name, scheme, membership number, dependant code (medical aid) or name + surname (cash)
• Appointment service, date, time, status, notes
• Voice transcription text (audio deleted per retention)
• WhatsApp phone ID, Telegram chat ID, Google Calendar ID (clinic settings)

Where it lives

Secure cloud infrastructure (Railway + Cloudflare edge). Encrypted at rest and in transit. Not stored in South Africa as you clarified — on secure server. Access via admin dashboard at bookabl-api-production.up.railway.app/admin with Clinic switcher.

Masking

Bookings list masks patient name and medical-aid numbers (first letter + stars). Telegram lists show time + first name initials only. Full identity on patient profile if needed.

Rights

POPIA S23 — access, correction, deletion, objection. Email [email protected]. Ross is only dashboard user.