Want the detail? It's below.
ALOHA, Inc. makes software for healthcare practices. Your provider is our customer. When you use their booking page, receive their reminder messages, pay them, or get a review invitation from them, our software is doing that work for your provider, under a contract with them.
Under that contract we act as your provider's business associate — a role defined by federal health privacy law (HIPAA). In practical terms: your provider decides what information gets collected and how it's used, we're bound to use it only for the work they've asked us to do, and we're legally accountable to them for protecting it.
You may review our full Privacy Notice to see how ALOHA, Inc. processes other information.
When you book an appointment Your provider collects your name, phone number, email address, date of birth, and the appointment date and time through our software. If your provider's form asks for it, the reason for your visit or whether you're a new patient. Our software also records that you submitted the form, and basic technical information your browser sends automatically (IP address, browser and device type).
The online booking form does not collect your precise location. (It does receive your IP address, as noted above, which can sometimes indicate an approximate location, such as your city.) If you separately use our Scheduling App and turn on location services there, that app may collect your location — that's covered by the app's own privacy information, not this notice.
When your provider sends you reminders or messages using our software, we process your phone number and email address, whether a message was delivered, and your replies if you write back — for example, to confirm or reschedule.
Text messages travel over the ordinary mobile network, which isn't a private channel. For that reason these messages are kept to scheduling basics. If you need to discuss anything about your health or your care, call the office.
When you make a payment If your provider offers online payment and you choose to pay online, your card details go to our payment processor to complete the charge on your provider's behalf. We keep a record of the amount, date, and status so your provider's account is accurate.
When you receive a review request Your provider uses our software to invite you to leave a review. That involves us processing your name and contact information, and tracking whether you opened the invitation. If you choose to write a review, you write it on the site you pick — and those are your words, posted publicly by you, under that site's own rules. We don't write or post reviews for you.
Your provider's booking form, which runs on our software, uses a small number of cookies to keep your session working while you pick a time and submit the form. We don't use advertising cookies or tracking pixels on the booking form, and we don't let advertising networks collect information there.
Your provider's own website is separate from the booking form and may use its own cookies and analytics. Their privacy notice covers that, not this one.
To book, confirm, remind, reschedule, and record your appointments. To process a payment you choose to make. To send the messages your provider has asked us to send. To keep the service secure and working, and to meet our legal obligations.
We also look at how our tools are used so we can improve them. When we do that, we work from information with the details that identify you removed.
A small number of companies help us run the service — hosting and storage, text and email delivery, and payment processing. They're allowed to use your information only to do that work for us, and they're held to the same protections we are.
We also share information when the law requires it, or to protect someone's safety.
Your provider, of course, sees your information. It's theirs.
We keep your appointment and message records for as long as your provider uses our service and needs them, and for a limited period afterward for backup, accounting, and legal reasons. When your provider asks us to delete information, we delete it, unless the law requires us to keep it.
Our systems are located in the United States, so your information is stored here.
Your provider asks for your permission before texting or emailing you, usually when you book or fill out their forms.
You can stop messages at any time:
Appointment reminders and confirmations aren't marketing. If you turn those off you may miss information about your visit, so it's worth telling the office directly so they can reach you another way.
To see, correct, or delete your information, start with your provider's office. They hold the relationship and the records, and they direct us. If you contact us instead, we'll pass your request to them and help them respond.
We answer requests within 45 days. If we need longer, we'll tell you why and how much longer we need.
Asking about your privacy costs you nothing. Your care, your appointments, and the service you get will not change because you asked a question about your information or asked us to delete it.
Depending on where you live, you may have additional rights over your personal information. Your provider's Notice of Privacy Practices explains your rights regarding your health records.
Our booking tools are meant to be used by adults. If you're booking, paying, or replying on behalf of a child or another person you care for, you're telling us you're allowed to do that, and we handle that person's information the same way we handle yours.
Children shouldn't use the booking form on their own — a parent or guardian should.
We protect your information with encryption in transit, access controls, and monitoring, following generally accepted industry standards. No system is perfect. If something goes wrong, we notify your provider promptly so they can meet their obligations to you, and we notify the appropriate authorities within 72 hours where the law requires it.
Your provider's office is the fastest route for anything about your appointment or your records.
For questions about this notice, email support@getaloha.com, or write to ALOHA, Inc., Attn: Privacy, 300 East Davis St., McKinney, TX 75069.
If we change how our patient-facing tools handle information, we'll update this notice and change the date at the top.