Privacy Policy

This Privacy Policy explains how Booklify (“Booklify”, “we”, “us” or “our”) handles personal information. Booklify is an online appointment-management platform used by healthcare practices (such as medical and optometry clinics) to schedule appointments, send reminders and manage patient recalls.

We are committed to protecting your privacy and to handling personal information in accordance with the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles (APPs); for individuals and practices in New Zealand, the Privacy Act 2020 (NZ), its Information Privacy Principles (IPPs) and the Health Information Privacy Code 2020; and, for individuals and practices in South Africa, the Protection of Personal Information Act, 2013 (POPIA) and its eight conditions for the lawful processing of personal information.

1. Our role: who controls your information

Booklify operates on two levels, and our privacy obligations differ depending on the relationship:

• For healthcare practices using Booklify (our customers): we collect and hold information about the practice and its staff so we can provide the platform. For this information we are the entity primarily responsible.
• For patients of those practices: the practice decides what patient information is collected and why. The practice is the entity primarily responsible for that information — the APP entity in Australia, the agency under New Zealand’s Privacy Act 2020, and the responsible party under POPIA in South Africa — and Booklify holds and processes it on the practice’s behalf and on its instructions (as a service provider or agent under those laws, and an operator under POPIA sections 20 and 21). Our Terms of Service, section 5, set out that arrangement. If you are a patient and want to access, correct or delete your information, the quickest path is usually to contact your practice directly. You may also contact us using the details below.

2. Information we collect

Practice and staff information

• Practice name, address and contact details;
• staff account details — name, email address, role (administrator, receptionist or practitioner) and an encrypted (hashed) password;
• practice configuration such as locations, services, working hours and settings.

Patient information

• Name, email address, phone number, date of birth and, where the practice uses one, a file number; whether the patient has visited the practice before; if they give them, their medical aid or health fund name, plan and membership number; for a dependant, the name of the parent or guardian who receives messages on their behalf;
• preferred location, appointment, booking, recall and reminder history, and any scheduling notes the practice records;
• communications we send or schedule on the practice’s behalf (for example appointment confirmations, reminders and recall notices) and related delivery status;
• for patients who use a practice’s online booking portal, the email address they sign in with and whether it has been confirmed. Patients sign in with a one-time code emailed to them; no password is stored.

Information about a person’s health, or that they are a patient of a particular practice, is sensitive information under the Privacy Act 1988 (Cth), health information under New Zealand’s Health Information Privacy Code, and special personal information under POPIA section 26, and attracts a higher level of protection. We only handle this information to provide the platform to the relevant practice.

Technical information

• Log data, device and browser information, IP address and similar information automatically generated when the platform is used, which we use for security, troubleshooting and to keep the service reliable.
• Cookies and similar technologies that are strictly necessary to keep you signed in and to operate the service. We do not use the platform for third-party advertising.

3. How we collect information

We collect information directly from practices and their staff when they register and use Booklify, and from patients when they book or register through a practice’s online booking portal. We also receive patient information from practices when staff enter or import it into the platform. Where it is reasonable and practicable, we collect personal information directly from the individual concerned.

4. Why we use information

We use personal information to:

• provide, operate, maintain and secure the Booklify platform;
• schedule, confirm, reschedule and cancel appointments, and send appointment reminders, recall notices and follow-up messages on the practice’s behalf;
• authenticate users and maintain an audit log of actions for security and accountability;
• answer staff questions about their own practice’s schedule, patients, recalls and messages through the staff assistant described in section 8;
• provide customer support and respond to enquiries;
• improve the reliability, performance and security of the platform;
• comply with our legal obligations.

We do not sell personal information, and we do not use patient information for our own marketing.

5. Notifications and messages

Booklify sends messages by email and, where enabled, SMS, on behalf of the practice, in three categories:

• Account messages — the one-time code you ask for to sign in to the practice’s online booking portal, and a notice when the practice adds you or changes the email address on your record, so you know which address it holds. These are service messages about your record and access, not marketing.
• Appointment communications — confirmations, reschedule and cancellation notices, and reminders for visits you have booked. These are part of the care and scheduling service the practice provides and are sent while you have appointments with the practice.
• Recall and follow-up messages — invitations to book your next visit and post-visit follow-ups. Every such email includes an unsubscribe link, every such SMS tells you that you can reply STOP, and patients with a portal account can also manage this preference from their profile. You can opt out at any time without affecting your appointment communications; you can also ask your practice to change it for you. We record your choice and the practice cannot send you these messages once you have opted out. This is how we and practices meet the Spam Act 2003 (Cth), the Unsolicited Electronic Messages Act 2007 (NZ) and section 69 of POPIA.

Messages are sent by the practice, in its name, and any reply goes to the practice. Booklify keeps a delivery record (sent, delivered, bounced, failed) so the practice can see whether you were reached; a bounced email address is not written to again until it is corrected, except for a sign-in code you ask for yourself.

6. Disclosure of information

We may disclose personal information to:

• the healthcare practice that holds your record (for patient information);
• trusted service providers who help us operate the platform under contract — for example cloud hosting and database providers, and email and SMS delivery providers — who are only permitted to use the information to provide their service to us;
• law enforcement, regulators or others where we are required or authorised by law to do so.

7. Storage, hosting and overseas disclosure

We hold personal information in secured databases and take reasonable steps to protect it from misuse, interference, loss, and unauthorised access, modification or disclosure — including encryption of passwords, encryption of data in transit (TLS/SSL) and access controls that scope every practice’s data to that practice only.

Booklify uses reputable cloud infrastructure and sub-processors to operate the platform:

• Vercel (United States) — application hosting, on servers in Sydney, Australia;
• Neon — database hosting of practice and patient records, in Sydney, Australia;
• Amazon Web Services (SES) — email delivery of the messages described in section 5, and the delivery and bounce reports for them, from Sydney, Australia;
• SMSPortal (South Africa) — SMS delivery of the messages described in section 5 to South African mobile numbers, including STOP replies. Where a practice sends SMS to other countries, we will name the provider here before doing so;
• Stripe — payment processing for practice subscriptions and prepaid message balances. Card details are entered on Stripe’s pages and are never stored by Booklify;
• Upstash — scheduling of reminder and recall jobs (message queues carry record identifiers, not patient details) and security rate-limiting;
• Google (Google Calendar) — only where a practice chooses to connect its own Google Calendar, appointment details (including patient names) are synchronised to that calendar.
• Anthropic (United States) — the language model behind the staff assistant described in section 8. Only the practice data needed to answer a staff member’s question is sent, under a data-processing agreement. It is never used to train models, and Anthropic deletes it within 30 days (longer only where its automated safety systems flag a request for review under its usage policy).

Practice and patient records are stored in Sydney, Australia. Some of these providers process information on servers located outside Australia, New Zealand and South Africa (including in the United States). Where information is disclosed to an overseas recipient, we take reasonable steps to ensure it is handled consistently with the APPs (APP 8), applicable New Zealand law (IPP 12) and, for South African personal information, section 72 of POPIA — including contractual commitments from each provider that offer a substantially similar level of protection. Practices authorise these transfers under our Terms of Service, section 5, and should tell their patients that their information may be held overseas.

8. The staff assistant (artificial intelligence)

Practices can use a built-in assistant that lets their staff ask questions about the practice’s own schedule, patients, recalls and messages in plain language. When a staff member asks a question, we send the question, the practice’s name and timezone, the staff member’s name and role, and the practice data needed to answer it (for example the appointments or patient records matching the question) to Anthropic, the provider of the language model, which processes it in the United States on our instructions as a sub-processor under a data-processing agreement. Within a conversation, the earlier questions and the information looked up for them are sent again with each later question, so the assistant can follow the conversation. Anthropic never uses this information to train its models, and deletes it within 30 days of receiving it — it is kept longer (up to two years) only where Anthropic’s automated safety systems flag a request for review under its usage policy.

The assistant looks information up, and it can prepare two kinds of change: a new booking, and a new time for an existing appointment. It never makes either change itself. It shows the proposed booking or time on a card, and nothing is saved until the staff member reviews it and confirms; a confirmed change goes through the same checks, records and patient notifications as one made on the calendar. It cannot cancel appointments, edit patient records or send messages of its own, and it makes no decisions about patients — no decision affecting a patient is made by automated means (section 71 of POPIA). It never sends free-text clinical or personal notes, and every question is limited to the practice the staff member belongs to. The assistant tells staff that it is artificial intelligence and can make mistakes, and staff must check its answers against the record. Conversations are private to the staff member who had them, are kept for 30 days and then deleted; a record of usage (not content) is kept for billing and security. Each practice decides whether its staff use the assistant.

9. Data retention

We retain personal information for as long as needed to provide the service to the relevant practice, and afterwards only as required to meet the practice’s legal and record-keeping obligations or our own. Practices are responsible for the retention periods that apply to their patient records — for example the Health (Retention of Health Information) Regulations 1996 in New Zealand, state and territory health-records laws in Australia, and the Health Professions Council of South Africa’s guidelines — and for exporting records before a subscription ends. When information is no longer required, we take reasonable steps to delete or de-identify it (APP 11.2, IPP 9, POPIA section 14).

10. Accessing and correcting your information

You have the right to request access to the personal information we hold about you and to ask us to correct it if it is inaccurate, out of date or incomplete (APPs 12 and 13, IPPs 6 and 7, and sections 23 and 24 of POPIA). In South Africa you may also object to processing on reasonable grounds (section 11(3) of POPIA) and ask for deletion of information we are not required to keep (section 24). If you are a patient, please contact your practice first, as it controls your record; the practice can update or remove your details directly in Booklify. For practice and staff information, or if you cannot reach the practice, contact us using the details below. We will respond within a reasonable period — within 30 days where the law sets that period — and may need to verify your identity first. There is no charge for a request unless the law allows one.

11. Data breaches

We maintain procedures to detect, contain and assess suspected data breaches. Where a breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme, the Office of the Privacy Commissioner (New Zealand) where the NZ Privacy Act applies, and the Information Regulator (South Africa) in accordance with section 22 of POPIA where South African personal information is affected. Where we act as a service provider (operator) to a practice, we will also notify the affected practice without undue delay so it can meet its own obligations.

12. Children’s information

Practices may use Booklify to manage appointments for patients of any age, including children, where the practice has the necessary authority or consent (for example from a parent or guardian — the competent person whose consent section 35 of POPIA requires). A child’s record is linked to that guardian, and messages about the child go to the guardian. Booklify is not directed to children as direct users, and the online booking portal is for adults booking for themselves or for those in their care.

13. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page shows when it was last revised. Material changes will be notified through the platform, which may ask you to accept the updated policy before continuing, or by other reasonable means.

14. How to contact us

If you have a question, request or complaint about how we handle personal information, please contact our Privacy Officer:

• Email: privacy@booklify.co.za
• Post: Privacy Officer, Booklify

We will acknowledge your complaint and aim to resolve it promptly. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC); in New Zealand, the Office of the Privacy Commissioner; or, in South Africa, the Information Regulator (South Africa).