Privacy policy

This policy explains how SyncDiary (“we”, “us”) handles personal data. SyncDiary is operated by Carey Webb, trading as Sync Diary, 4 Underhill Road, Benfleet, Essex, SS7 1EW. We are registered with the Information Commissioner's Office as Mr Carey Webb, registration reference ZC271061 — you can check it on the ICO's register. You can contact us about anything in this policy at support@syncdiary.co.uk.

Who is responsible for which data

• Your account. For the details of your own account — your name, email address, practice details and billing — we are the controller.
• Your clients' information. The records you keep about your clients — their contact details, appointments, session notes and payments — are yours. You are the controller of that data and we process it on your behalf, only to provide SyncDiary to you, under our terms of service.

What we collect

• Account details: your name, email address and password (stored by Firebase Authentication, never by us in readable form).
• Practice details you enter, such as your practice name, address, rooms and rates.
• Diary and client records you create or import: appointments, availability, clients, wait-list entries, tasks and session notes.
• Financial records you enter or that follow from your appointments: fees, payments, expenses, statements and tax estimates.
• Data from accounts you connect — see the next section.
• Technical data needed to run the service securely, such as error logs and a session cookie that keeps you signed in.
• Support conversations. What you write to us in Support and our replies, the app version and page you wrote from (so we can find the problem), and notes we keep while helping you, which only we can see. When you write, we are told by email that there is something to answer — the email names your account but does not contain your message. When we reply, we email you to say so, without the reply in it. Please do not put your clients' details in a support message: the date and time of a session is enough for us to find it.
• Emails during a trial. While your free trial runs we send a few tips — getting started, halfway, and when your first month's statement is ready — which you can switch off at any time in Settings → Subscription, as each of them says. Before a trial or a free year ends we tell you, whatever that setting: that email is about your account, not marketing.
• The Apple iCloud waiting list. If you join it, your email address and any note you add. We use it only to email you once, when we have decided whether SyncDiary will work with Apple iCloud, and then delete it — or sooner, if you ask us to. Our lawful basis is your consent, which you can withdraw at any time by emailing us.

Data from Google and Microsoft accounts

If you connect a Google or Microsoft account, we ask for these permissions and use them only as described:

• Calendar — to read and write the events in the calendars you choose, so your appointments stay in step between SyncDiary and your calendar; to list your calendars so you can choose them; and to create a dedicated SyncDiary calendar.
• Contacts — to import your clients from your address book, and to create and update a contact when you add or edit a client in SyncDiary.
• Tasks — to show your tasks in SyncDiary and to create, update, complete and delete them.
• Your name and email address — to identify which account is connected.
• Sending email — only if you allow it, the first time you choose to email a client: to send an email you have written to one of your clients, from your own mailbox, when you press Send. SyncDiary cannot read your mailbox. We keep a note on the client's record that an email was sent, not the email itself.

We do not use this data for advertising, we do not sell it, we do not use it to build profiles, and we do not use it to train artificial intelligence or machine learning models. People do not read it, except with your permission, where it is needed for security, or where the law requires it. Access tokens for connected accounts are stored so that only our servers can read them. You can disconnect an account at any time in Settings; you can also remove SyncDiary's access from your Google or Microsoft account settings.

SyncDiary's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Why we use it, and our lawful basis

• To provide the service you signed up for — contract.
• To keep it secure, fix faults and prevent misuse — our legitimate interests.
• To take payment and keep financial records — contract and legal obligation.

Records about your clients may include health information. You decide what you record and are responsible for having a lawful basis to record it; we process it only on your instructions.

Where it is stored and how it is protected

• Your data is stored with Google Cloud (Firebase) in London, United Kingdom.
• The app itself runs on Google Cloud servers in the Netherlands, in the EU. They handle your data while you use SyncDiary but do not keep it. The UK recognises the EU as giving equivalent protection.
• Session notes are encrypted before they are stored. An appointment's event notes are not: they are written into the event in your own calendar, so keep clinical detail in session notes.
• Data is encrypted in transit and at rest, and each account can reach only its own records.
• The database can be restored to how it was at any moment in the last 7 days, to recover from a mistake or a fault. So data you delete can be recovered for up to 7 days, and not after.

Who we share it with

We share data only with the providers we need to run the service, each acting on our instructions:

• Google Cloud / Firebase — hosting, the database, sign-in (Firebase Authentication) and protection against automated abuse (reCAPTCHA).
• Google Workspace — the emails we send, from support@: replies to your support messages, reminders during a trial, and the notes that tell us someone has signed up or written to us.
• Google and Microsoft — only for the accounts you choose to connect.
• The calendar app you subscribe with — if you turn on the calendar feed, the app you give its link to (for example Apple Calendar) fetches your appointments from its own servers. You choose how much each appointment says, and you can replace or turn off the link at any time.
• Stripe — to take subscription payments. Your card details are held by Stripe; we never see or store them.

The website and the app load their fonts from Google Fonts, which means your browser contacts Google when you visit.

How long we keep it

We keep your data for as long as your account is open. When you ask to delete your account, deletion is scheduled for 30 days later so that a mistake can be undone; after that your data is permanently deleted. If a subscription lapses, your account becomes read-only for 7 days and is then locked — your data is kept, and you can export it, until you delete the account.

Asking to delete your account stops your subscription renewing, so nothing more is charged; it is cancelled when the account is deleted. We keep billing records — invoices and payment dates, with no client information — for six years, as HMRC requires.

Support conversations are deleted 12 months after they are resolved, together with our notes about them — or with the rest of your data when your account is deleted, if that comes first.

If something goes wrong

If a security incident affects your data, we will tell you without undue delay: what happened, what data it involved, and what we are doing about it. Where the law requires, we report it to the Information Commissioner's Office within 72 hours. For your clients' records, you are the controller, so we give you what you need to decide whether to tell them and the ICO yourself.

Your rights

You have the right to access your data, to have it corrected, to have it deleted, to restrict or object to its use, and to receive it in a portable form. You can export your data and delete your account yourself in Settings, or contact us. If you are a client of a practitioner who uses SyncDiary, please contact your practitioner first — they control your records. You can complain to the Information Commissioner's Office at ico.org.uk.

Cookies

We use one essential cookie to keep you signed in, and your browser's storage to remember a few display preferences, such as which tab you last had open. We do not use advertising or analytics cookies.

Children

SyncDiary is for professionals and is not intended for anyone under 18.

Changes to this policy

If we change this policy in a way that matters, we will tell you by email or in the app before the change takes effect.