Privacy policy

Who is responsible for what

• Practitioners (people who sign up to run their practice on PranaDesk): we are responsible for your account data.
• Clients (people who book a practitioner): the practitioner you book is responsible for your data and decides how it is used. We store and process it on their behalf, only to provide the service. For questions about your booking or your data, contact the practitioner first; you can also contact us.

What we collect

From practitioners

• Account details: name, email address and password (stored only as a secure hash).
• Practice details you enter: business name, category, timezone, currency, contact email and phone, website, address, booking page text, services, prices, working hours, days off and booking policies.
• Records you create: clients, appointments, private notes, payments and refunds.
• Sign-in sessions: the time, IP address and device/browser type of each sign-in, used to keep your account secure.

From clients

• What you enter when booking: name, email address, optional phone number, optional message, and your timezone.
• Your appointments with the practitioner, their status, and any payments for them.
• Anything the practitioner records about you, such as general notes.

What we do not collect

• We do not use advertising or analytics trackers, and we do not sell or rent personal data.
• We never see or store full card numbers. Online card payments are handled by Stripe.
• We do not record or access video sessions.

How we use it

• To provide the service: showing booking pages, preventing double bookings, managing appointments, clients and payments.
• To send service emails: booking confirmations, changes, cancellations, reminders, receipts, video links and password resets. Practitioners choose which client emails are sent.
• To keep the service secure: authentication, rate limiting, preventing abuse, and an internal log of important actions.
• To support you when you contact us. Authorised members of our team can view account and client data only when needed for support, security, abuse prevention or legal requests, and every such access is logged.

We rely on performing our contract with practitioners, on the practitioner's instructions for client data, and on our legitimate interest in keeping the service secure. Where the law requires consent, we ask for it.

Service providers

We use a small number of providers who process data for us under their own security commitments:

• DigitalOcean: hosting and database. Data is stored in DigitalOcean's Bangalore, India region.
• Resend: sending emails.
• Stripe: online card payments, when a practitioner turns them on. Stripe receives your payment details directly.
• Jitsi Meet (meet.jit.si, run by 8x8): free video rooms for online sessions, when the practitioner uses them. We only create the room link; the call itself happens on Jitsi and is subject to its privacy policy.

Some of these providers may process data outside India. We only use providers that protect personal data to a standard comparable to this policy.

How long we keep data

• Practitioner data is kept while the account is open.
• A practitioner can delete a client at any time, which removes that client's personal details.
• When a practitioner deletes their account, their login is removed and the personal details of their clients are erased. Anonymised financial records (amounts and dates, with no names or contact details) are kept where needed for accounting and legal obligations. See Delete your account.
• Sign-in sessions expire automatically.

Your rights

Depending on where you live (including under India's Digital Personal Data Protection Act, 2023 and the EU/UK GDPR), you can ask to access, correct, export or erase your personal data, withdraw consent, and nominate someone to act for you. Practitioners can do most of this themselves in Settings (export all data, edit details, delete account). Clients can ask the practitioner, or email us at [email protected]. We reply within 30 days. You may also complain to your data protection authority.

Security

All connections use HTTPS. Passwords are hashed, each practice can only see its own data, and access is logged. No system is perfectly secure; if we become aware of a breach affecting your data, we will notify you and the authorities as required by law.

Children

PranaDesk is for adults. Practitioners must be 18 or older. Practitioners who see clients under 18 are responsible for obtaining a parent or guardian's consent before booking them.

Health information

PranaDesk is not a clinical or medical records system. Practitioners should keep only general notes here and use a dedicated, compliant system for clinical records.

Changes

If we change this policy in a meaningful way, we will update the date above and tell practitioners by email or in the app before the change takes effect.

Contact and grievances

Questions, requests or complaints about privacy: [email protected]
Prashant Srivastava, trading as Progressive AI Data, India