Health information and your privacy policy

Some states, Washington and Nevada among them, have laws about the health information a business collects from its clients — not only medical practices. If your clients tell you about their health, for example on an intake form, these laws may apply to your business. This article says how Schedulign helps. It isn't legal advice: whether and how these laws apply to your business is yours to decide, with your own advisor if you need one.

What Schedulign does for you

• Handles the information only for you. For what your clients give you through Schedulign, Schedulign is your processor: it handles it only to run your bookings and forms, under the processor terms in Schedulign's Terms of Service, and never sells it, shares it or uses it for advertising.
• Asks for consent on intake forms. Before an intake form is sent, it tells your client what it collects, why, who receives the answers and how to withdraw, then asks for their consent.
• Lets a client withdraw. From the form's own link, Withdraw my consent deletes the answers they sent through it. You're emailed, and Bookings shows Consent withdrawn.
• Keeps answers safe. Intake answers are encrypted before they're stored, never go into an email, and every opening is recorded with who opened them.
• Links your privacy policy. Once you add one, each intake form links it beside the consent, and your booking pages link it too.

Your privacy policy

Add it while you build an intake form: in Settings → Forms & waivers, open or create an intake form, and under the signature choose Privacy policy:

• A link to your own policy — when your website already has one. The link must start with https://.
• Write one here — Start from the template fills in a policy written for how Schedulign works, in your business's name, with your booking contact email (or your account's email when you have none). Read it through and change anything that isn't true for you — for example, if you share information with another provider who treats your client.

Save changes saves it with the form. It's one policy for all your intake forms; a policy written here is published at schedulign.com/consumer-health-data/ followed by your booking link's name, dated from your last change. If you have a website of your own, link the policy from it too.

Collect with care

• Ask health questions on an intake form, where your client sees what is collected and why and gives their consent, rather than among your booking questions.
• Ask only what you need for the sessions your client booked.
• Choose event names that don't reveal a condition: an event's name travels with each booking, into emails, calendar entries and Stripe's records.
• On a team, See clients' intake forms is off for every member; turn it on only for the people who need it.

Answering a client's request

A client may ask you to confirm whether you hold their health information and to see it, to correct it, to delete it, or to withdraw their consent. Where these laws apply, answer within 45 days — you may extend once by 45 days more if you tell them why — free of charge up to twice a year, and let them appeal a refusal.

• To show them their information: their contact page lists their bookings, forms and signatures; an intake form's reader has Print or save as PDF; and the owner can download everything from Settings → Danger zone → Your data.
• To delete it: Delete contact on their contact page removes their details from every booking, with their intake forms and the record of who opened them; Delete client data on a past or canceled booking removes them from that booking.
• If they write to Schedulign instead, Schedulign passes the request to you within 5 business days and helps you answer it.

Never sell a client's health information, and don't share it with anyone without first getting their consent to share it.