Privacy Policy

One Schedule (oneschedule.health) brings a therapist's calendars from services such as Google Calendar, Jane, Owl Practice, Acuity, SimplePractice and Outlook into one view. This policy describes our handling of personal information with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial privacy laws in mind. Which laws and obligations apply depends on your province, professional role and practice setting; this policy is not a certification of compliance or legal advice.

Practitioners remain responsible for their clients' information and for determining whether One Schedule is appropriate for their practice. We process calendar information to provide the combined schedule, not to sell it or use it for advertising. Connecting a calendar authorizes One Schedule to retrieve the information made available through that link.

When the app loads or you refresh a calendar, your browser sends its calendar subscription link to One Schedule's server. The server retrieves the feed from the calendar provider and processes it in working memory, including expanding repeating appointments. It then sends the resulting appointment information to your browser for display. Feeds are not retrieved and processed exclusively in your browser; this server step also works around calendar providers' browser cross-origin restrictions.

The calendar-reading code does not write raw feeds or full appointment records to our database or deliberately save them to server files. Appointment information is held temporarily in server memory during processing and in browser memory while you use the app. This is processing of potentially sensitive personal information, even without saving full records. Appendix B summarizes how this design was checked across error reports, analytics, caches, backups and browser storage. Appointment-related settings can contain identifying information and are saved separately as described in section 3.

• Account details (if you sign in): your email address and optional display name.
• Your settings: calendar links (which contain private access codes), calendar nicknames, appointment tags, hidden appointments, "notes done" and attendance marks, time zone and Screen Shield preference. Hidden-appointment settings include the appointment title, start time and calendar name. Title-based tags retain normalized appointment titles; other markers use appointment identifiers and may include dates or timestamps. These settings can identify clients or reveal appointment-related information. They are saved in your browser and, when account sync is enabled, in our database for your account. Guest settings stay in the browser, but guest calendar feeds still pass through our server as described in section 2. The notes feature records only whether notes are done; it is not a place to write clinical notes.
• Anonymous visit statistics: referring site, campaign tags, device and browser type and an anonymous visit ID, used to understand how people find the app and to filter out bots.
• Feedback you choose to send us through the Beta Feedback button.

Only to provide the service: showing your combined schedule, keeping your settings available across devices, improving the app, and responding to you. We do not sell personal information or use it for advertising.

By creating an account you consent to the collection and use described here, including the cross-border handling described in sections 7 and 8. You may withdraw consent at any time by deleting your account (see section 9).

• Encryption in transit: traffic between calendar providers, our server and your browser uses HTTPS.
• Memory-only feed processing: the calendar-reading code holds feed contents only in working memory for the duration of a request and does not write them to our database or deliberately save them to server files.
• Account-level access controls: saved settings are protected by database access rules so only your signed-in account can read or change them.
• Provider security: our hosting and database providers operate professionally managed data centres; storage-level protections are provided by those providers.
• On-screen privacy: Screen Shield hides client details on screen in shared spaces. It is a display control only: it does not remove or redact identifiers before information is transmitted or processed, so feed contents (including client names) still reach our server relay and your browser exactly as your calendar provider sends them.
• Deletion: you can delete your account and saved settings immediately from the account menu.

No safeguard eliminates all risk. Calendar links contain private access codes; treat them like passwords and reset them with your calendar provider if you believe one has been exposed.

One Schedule uses a small number of well-known infrastructure providers. Here is who they are, where they operate, and what they handle:

• Calendar sources (e.g. Jane): Your scheduling service stores and generates your calendar feed. Jane hosts Canadian clinics on Amazon Web Services in Canada (Montreal, Quebec); other providers such as Google, Owl Practice, Acuity, SimplePractice and Microsoft host their services in their own data centres, typically in the United States.
• One Schedule app and calendar relay (Cloudflare): Our application and the temporary calendar-feed relay run on the Cloudflare edge network, which includes data centres in Canada (Toronto, Montreal, Vancouver and Calgary) and the United States. Calendar feeds are processed in working memory only and are not saved to disk or a database (see section 2).
• Database and accounts (Lovable Cloud on Amazon Web Services): Your account email, sign-in link, saved calendar links and app settings (attendance marks, time zone, Screen Shield and hidden-appointment preferences) are stored in the United States (Oregon). Full appointment histories, client names and raw calendar feeds are not stored here.
• Supporting services (Google): If you use "Sign in with Google", Google verifies your identity from the United States. The privacy@oneschedule.health inbox is hosted on Google Workspace, and feedback sent through the Beta Feedback button is delivered by an email delivery service.

In summary, account data and settings are stored in the United States, and temporary server-side processing of calendar feeds may also take place outside Canada. One Schedule does not currently offer a Canada-only processing or storage guarantee. Information processed abroad may be subject to the laws and lawful access requirements of those countries. Consider these arrangements alongside your professional, contractual and legal obligations before connecting a calendar.

Personal information handled by One Schedule is transferred to, stored in, or processed in countries other than Canada:

• Stored in the United States: account details, calendar links (with their private access codes) and saved settings, including appointment-related markers described in section 3.
• Processed temporarily in Canada or the United States: calendar feeds, in working memory, depending on which data centre handles the request. We cannot choose or guarantee a Canadian data centre for each request.
• Sign-in and email in the United States: optional Google Sign-In, the privacy inbox and Beta Feedback delivery.

While information is outside Canada, it is subject to the laws of that country. Courts, law enforcement and national security authorities there may be able to obtain access to it under those laws (for example, United States laws such as the CLOUD Act), in some cases without notice to us or to you. We rely on the contractual and security commitments of our service providers and the safeguards in section 6; these reduce but do not remove that risk.

If your province, employer, regulatory college or contracts restrict out-of-country storage or processing, or require an assessment before using such a service, please complete those steps before connecting a calendar. Questions about these arrangements can be sent to our privacy contact (section 11).

You can view and change your settings in the app at any time, and copy them with "Use on Phone". You can permanently delete your account and all saved settings from the account menu ("Delete account & data"). Deletion takes effect immediately.

Account data and settings are kept until you delete your account. Anonymous visit statistics are kept only as long as they are useful for improving the service.

Our privacy officer can be reached at privacy@oneschedule.health. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca).

We will post any updates to this policy on this page with a new date.

A one-page overview for practitioners, clinic owners and privacy officers. It summarizes sections 2, 3, 6, 7 and 8 and does not replace them.

• Stored in the United States: account details, calendar links and settings.
• Processed temporarily in Canada or the United States: calendar feeds, in working memory only.
• Safeguards: HTTPS encryption in transit, account-only access to saved settings, Screen Shield, and immediate account deletion.
• No Canada-only guarantee: information handled abroad may be subject to foreign laws and lawful access requirements.
• Contact: privacy@oneschedule.health

Section 2 states that calendar feeds are processed in working memory and are not written to databases, disks or server logs. This appendix summarizes how that design was checked across the other systems the app uses. It is based on a review of the app's own code, not an independent third-party audit.

If you have questions about any of these checks, contact us at privacy@oneschedule.health.

This protocol explains what we do if personal information handled by One Schedule may have been lost, accessed, disclosed or used without authorization (a "privacy breach"), or if a security event could lead to one. It applies to account details, saved settings (including private calendar links) and information passing through our feed relay.

1. Roles

• Incident lead: the One Schedule privacy contact (privacy@oneschedule.health) coordinates the response, keeps the record and makes notification decisions.
• Technical responder: investigates, contains and fixes the issue, working with our hosting, sign-in and email providers as needed.
• Clinicians: remain responsible for their own obligations to clients and, where applicable, to their regulatory college or provincial privacy commissioner. We support them with the information they need.

2. Reporting a suspected incident

Anyone — clinicians, clients, providers or researchers — can report a suspected incident to privacy@oneschedule.health. Please include what you noticed, when, and which account or calendar link is involved. Do not send client health information in the report. We acknowledge reports within 1 business day.

3. Response steps and target timelines

4. What a notification to clinicians includes

• A description of what happened and when (or the estimated time period).
• The kinds of information involved, as far as we know.
• What we have done to contain the incident and reduce the risk of harm.
• Steps the clinician can take — for example resetting calendar links in Jane, Google or other sources, changing passwords, or reviewing account activity.
• Whether the incident has been reported to the OPC or another authority.
• A contact for questions: privacy@oneschedule.health.

5. Help we provide to clinicians

• A written summary of the facts suitable for the clinician's own breach assessment, client notifications, and reports to a provincial commissioner or regulatory college.
• Reasonable cooperation with the clinician's investigation and questions.
• Guidance on containment steps, including resetting private calendar links at the source.
• Updates as the investigation progresses and when the incident is closed.

6. Service providers

If an incident starts at one of our providers (hosting, sign-in, email or an upstream calendar service), we work with that provider under its own incident terms and pass on relevant information to affected clinicians. Incidents inside a calendar source such as Jane are handled by that provider; we will help clinicians limit any effect on One Schedule.

7. Records

As required by PIPEDA, we keep a record of every breach of security safeguards involving personal information — whether or not it was reportable — for at least 24 months, and provide it to the OPC on request.

8. Review of this protocol

We review this protocol at least once a year and after any significant incident. Timelines above are targets; we act faster where the risk requires it.