Your clients’ information, looked after

• Your clients’ records are yours. You’re the data controller; SyncDiary is your processor, acting only on your instructions, to provide SyncDiary to you.
• Your own account — your name, email and billing — is ours to look after, as controller.
• We’re registered with the Information Commissioner’s Office: ZC271061. Check it on the ICO’s register
• A data processing agreement sets out how we look after your clients’ records. Ask us for a copy.

Stored on Google Cloud in London. The app itself runs on Google Cloud servers in the Netherlands, in the EU: they handle your data while you use SyncDiary but don’t keep it, and the UK recognises the EU as giving equivalent protection.

• Session notes are encrypted with AES-256-GCM, using a key made for your account alone. More about session notes
• Everything else is encrypted too — on its way to you, and where it’s stored.
• Your records are yours alone. Each account can reach only its own records, and the sign-ins to your calendars are kept where only SyncDiary’s server can read them.
• We never see your password. It goes straight from your browser to Google’s Firebase Authentication, which keeps only a secure hash of it.
• Automated abuse is kept out — sign-in and the website’s forms are protected against bots.
• Mistakes can be undone. The database can be put back to how it was at any moment in the last 7 days.

• It isn’t zero-knowledge. The key to your notes lives on the server, so SyncDiary can show a note back to you. An export you ask for is plain text.
• Your calendar is your calendar. An appointment’s event notes are written into your own Outlook or Google calendar as plain text, so keep clinical detail in session notes.

Each session appears with its time and a title you choose — by default the service and the client’s initials. No attendees, no location, nothing from your session notes. If you subscribe your phone’s calendar to your sessions, you choose how much each one shows: initials, just busy, or in full.

Your clients’ records are never sold, never used for advertising, and never used to train AI. We share data only with the providers we need to run SyncDiary — Google Cloud, Google Workspace for the emails we send, and Stripe for payments — and people don’t read your data except with your permission, where it’s needed for security, or where the law requires it.

• Access and portability — export everything you’ve put in, whenever you like, from Settings → Backup & Restore.
• Erasure — erase a client and their identifying details are removed. You decide whether their session notes go too. Your income records stay, showing initials only.
• Your privacy notice — suggested wording, in Help inside SyncDiary, for telling your clients how their information is kept.
• Leaving — close your account and it’s deleted 30 days later, so a mistake can be undone. Export first if you want to keep a copy.
• If something goes wrong — we tell you without undue delay what happened and what we’re doing about it, report it to the ICO within 72 hours where the law requires, and give you what you need to decide whether to tell your clients.

Privacy policyTerms of serviceAsk a question