Privacy Policy

What HealthSync is

HealthSync is a tool for clinics and practitioners. It watches the clinic's Google Calendar for upcoming appointments, checks whether each client has a recent signed health declaration, and helps the clinic manager send the client a link to sign one online.

Information we handle

• Clinic account: the email address and password used to sign in, and the clinic name.
• Google Calendar (read-only): when a clinic connects its Google account, we read the titles, descriptions, locations and start times of upcoming calendar events, only to find client names and phone numbers and to detect which appointments need a declaration. We never create, change or delete calendar events.
• Google Drive (app-created files only): we create a "HealthSync backups" folder and store encrypted backups and copies of signed declarations in it. The drive.file permission only gives us access to files and folders HealthSync itself created, not the rest of your Drive.
• Client records: name, phone number, appointment times, and the health declaration a client fills in and signs (answers, signature, date, and the generated PDF).
• Notifications: a browser push subscription so the manager is notified when a client needs a declaration.

How we use it

Only to provide the service described above to the clinic that connected it: spotting appointments, tracking declaration validity, notifying the manager, collecting and storing signed declarations, and keeping backups. We do not sell data, use it for advertising, or share it with third parties for their own purposes.

Google user data

HealthSync's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google Calendar data is read only to provide the features above; it is not used to develop or train generalized AI or machine-learning models, is not transferred to others except as needed to run the service, and is not read by humans except where needed for security, to comply with law, or with the clinic's consent.

Where data is stored and who processes it

• Supabase (database, file storage and sign-in) stores account, client and declaration data.
• Vercel hosts the application.
• Google provides Calendar and Drive access, and delivers browser push notifications.
• Google's Gemini API may be used when a clinic asks the app to suggest declaration questions. Only the short activity description the manager types is sent, never client data.

Each clinic's data is kept separate from other clinics'. Database backups are encrypted before they are stored.

Retention and deletion

Data is kept while the clinic uses HealthSync. A clinic can disconnect Google at any time from Settings. Disconnecting immediately and permanently deletes the Google access token, the connected email address and the Drive folder reference we stored, and HealthSync stops reading the calendar and writing to Drive. Files already saved in the clinic's own "HealthSync backups" Drive folder stay in the clinic's Drive, which it can delete at any time. To also revoke HealthSync's access on Google's side, remove it at myaccount.google.com/permissions. To have a clinic's account and data deleted, or to ask about a client's record, email us at the address below.

Security

Connections use HTTPS, Google access tokens are stored encrypted, signed declaration files are kept in private storage, and access to client data requires a signed-in clinic account.

Changes and contact

We may update this policy and will change the date above when we do. Questions or requests: nirsela993@gmail.com.