Privacy Policy

Effective Date: May 12, 2026 · Last Updated: May 12, 2026

PracticeBook is designed with privacy at its core. Patient data processed through the PracticeBook tool is stored within your own website environment and is never sold, shared, or used to train AI models. This policy explains how we handle data in connection with the PracticeBook service itself.

1. Who We Are

PracticeBook ("PracticeBook," "we," "us," or "our") is an AI-powered booking and patient communication tool for medical and professional practices. Our service is accessible at practicebook.ai.

This Privacy Policy applies to:

Visitors to our website at practicebook.ai
Practices and businesses ("Clients") that subscribe to and use PracticeBook
Individuals who interact with PracticeBook's chat interface on a Client's website ("End Users" or "Patients")

2. Information We Collect

Information from Clients (Practice Administrators)

When you register for or use PracticeBook, we may collect:

Account information — name, email address, practice name, specialty, and billing details
Configuration data — your API key (stored encrypted), Google Calendar OAuth credentials, and knowledge base settings
Usage data — conversation volume, booking counts, feature usage, and dashboard activity
Technical data — IP address, browser type, device information, and access logs

Information from End Users (Patients)

When a patient interacts with PracticeBook's chat widget on a Client's website, the following data may be collected and stored within the Client's own website environment:

Name, phone number, and email address (if provided during booking)
Appointment preferences and scheduling details
Questions asked and conversation history
Procedure or service interests as expressed in conversation

PracticeBook does not have access to end user data beyond what is necessary to facilitate the service. Patient data resides within the Client's own infrastructure, not on PracticeBook's servers.

Information Collected Automatically on Our Website

Cookies and similar tracking technologies
Pages visited, time on site, and referral sources
Device and browser information

3. How We Use Your Information

We use the information we collect to:

Provide, operate, and improve the PracticeBook service
Process account registrations and authenticate users
Send transactional emails — account confirmation, billing receipts, service updates
Respond to support requests and inquiries
Analyze aggregate usage patterns to improve performance and features
Comply with legal obligations
Prevent fraud and protect the security of our service

We do not use your data or your patients' data for advertising purposes, and we do not sell data to any third party.

4. Patient Data & HIPAA Considerations

PracticeBook is designed with healthcare compliance in mind. Patient conversations, booking data, and personal health-adjacent information are stored within the Client's own website environment and are not transmitted to or stored on PracticeBook's central servers.

Clients using PracticeBook in a healthcare context are responsible for ensuring their use of the tool complies with applicable laws, including HIPAA where applicable.

Key privacy protections built into PracticeBook:

Data locality — Patient data is stored within the Client's own environment, not exported to third-party systems
No AI training use — Conversation data is never used to train or fine-tune OpenAI or any other AI model
Configurable retention — Clients can configure how long conversation data is retained and can delete records at any time
Audit logs — All conversations and system events are logged for compliance review
Access controls — Only authorized practice administrators can access conversation data through the admin dashboard

If you require a Business Associate Agreement (BAA), please contact us at privacy@practicebook.ai.

5. Data Sharing & Third Parties

We do not sell, rent, or trade personal information. We may share data only in the following limited circumstances:

Service Providers

OpenAI — The AI model powering conversation responses. Conversation content is transmitted to OpenAI for processing in real time under zero-data-retention API settings where available, and is not used for model training.
Google — Calendar integration via OAuth 2.0 for appointment scheduling. Access is limited to calendar read/write permissions explicitly authorized by the Client.
Payment processors — For billing and subscription management. We do not store full payment card details.
Hosting infrastructure — Our website and dashboard are hosted on secure cloud infrastructure.

Legal Requirements
We may disclose information if required by law, court order, or governmental authority, or to protect the rights, safety, or property of PracticeBook, our users, or the public.

Business Transfers
In the event of a merger, acquisition, or sale of assets, user data may be transferred as part of that transaction. We will notify affected users prior to such a transfer.

6. Data Retention

We retain Client account data for as long as your subscription is active and for a reasonable period thereafter for legal and business purposes. Upon written request, we will delete account data within 30 days, subject to legal retention requirements.

Patient conversation data stored within the Client's website environment is subject to the Client's own retention settings. Clients can configure automatic data purge policies from the PracticeBook admin dashboard.

7. Security

We implement industry-standard technical and organizational measures to protect the information we handle, including:

Encryption of data in transit using TLS 1.2+
Encrypted storage of sensitive credentials (API keys, OAuth tokens)
Access controls and authentication requirements for admin functions
Regular security reviews and vulnerability assessments

No method of transmission over the internet is 100% secure. We will notify affected users of any breach as required by applicable law.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Access — Request a copy of the personal data we hold about you
Correction — Request correction of inaccurate or incomplete data
Deletion — Request deletion of your personal data, subject to legal retention requirements
Portability — Request a machine-readable export of your data
Objection — Object to certain types of processing
Withdrawal of consent — Where processing is based on consent, you may withdraw at any time

To exercise any of these rights, contact us at privacy@practicebook.ai. We will respond within 30 days.

California Residents (CCPA)
California residents have additional rights under the CCPA, including the right to know what personal information is collected, the right to deletion, and the right to opt out of sale. We do not sell personal information.

9. Cookies & Tracking

Our website uses cookies to maintain session state, analyze traffic, and remember your preferences. You can control cookies through your browser settings. We do not use advertising or cross-site tracking cookies.

The PracticeBook chat widget embedded on Client websites does not set third-party cookies on patient browsers.

10. Children's Privacy

PracticeBook is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided personal information through our service, please contact us at privacy@practicebook.ai and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this page and notify active Clients by email. Your continued use of PracticeBook after any changes constitutes your acceptance of the updated policy.

12. Contact Us

For privacy questions, requests, or to inquire about a Business Associate Agreement:

Email: privacy@practicebook.ai
Website: practicebook.ai