Clear terms for data, AI, and service use.

Last updated: 3 October 2026. aseschedule collects, uses, stores, and discloses personal information to provide booking, scheduling, reminders, client management, payments, support, and AI-assisted documentation services.

Information we may process includes account details, practitioner and staff details, patient or client contact details, appointment history, notes entered by authorised users, uploaded files, messages, invoices, payment status, device and log data, and support communications. Health information is treated as sensitive information where applicable.

We use this information to operate the service, secure accounts, send transactional appointment messages, support customers, improve reliability, meet legal obligations, and process AI-assisted drafts when enabled by an authorised user.

Service providers help us deliver these features and may process relevant personal information, including health information where a feature requires it. See our service provider information for names, purposes and location information, and our AI processing information for the data used by AI features, provider routes and retention conditions.

Customers are responsible for ensuring they have authority to enter patient or client information into aseschedule and to configure their own privacy notices, consent flows, retention settings, and exports. aseschedule does not sell patient or client information.

For privacy enquiries or complaints, or requests to access or correct personal information handled by ASEschedule, contact shxjcl0703@gmail.com. Requests about clinical records should ordinarily be directed to the treating clinic, which is responsible for those records; you may also contact ASEschedule for help directing your request. Export or deletion requests may be made through the relevant business or ASEschedule where appropriate. Please do not include clinical records, identity documents, or passwords in your initial email. Some records may need to be retained where required by law, professional obligations, billing, security, or dispute handling.

aseschedule provides software for online booking, calendar management, client records, reminders, billing workflows, and optional AI-assisted note drafting. It is not a medical provider and does not provide professional advice, diagnosis, treatment, emergency support, or professional supervision.

Customers must maintain their own professional registrations, insurance, consent processes, record obligations, billing terms, refund terms, and compliance with applicable Australian laws and professional standards.

Users must keep login credentials secure, only access information they are authorised to access, maintain accurate account details, and avoid using aseschedule for unlawful, harmful, misleading, or unsafe purposes.

aseschedule may update, suspend, or restrict parts of the service to protect security, reliability, legal compliance, or other users. Paid subscriptions, failed payment handling, trials, promotions, upgrades, downgrades, and cancellations are managed through the billing settings and payment provider terms.

Nothing in these terms excludes, restricts or modifies any rights, consumer guarantees or remedies under the Australian Consumer Law or other applicable law that cannot lawfully be excluded, restricted or modified. Payment provider terms do not replace these rights.

AI features generate draft content only. AI outputs can be incomplete, inaccurate, outdated, biased, or unsuitable for a particular patient, client, or professional context.

Practitioners must review, edit, verify, and approve all AI-generated content before it is saved, sent, copied into a patient record, or relied on. AI must not be used as the sole basis for diagnosis, treatment, triage, urgent care, referral decisions, or professional judgement.

aseschedule does not diagnose patients, recommend treatment, or replace practitioner review. Customers remain responsible for professional decisions, record accuracy, patient or client communication, consent, and compliance with their professional obligations.

When AI is enabled, relevant prompts, source notes, generated drafts, user edits, timestamps, and audit events may be processed to provide the feature, investigate support issues, and improve safety and reliability where permitted by law and account settings.

Information processed by AI

Depending on the feature and the information supplied, AI processing may include patient or client details, current and previous notes, appointment context, message text, letter or form content, template examples, uploaded documents or images, receipts, and audio submitted for transcription. This information is used to provide the requested drafting, document analysis, transcription or assistance feature.

AI providers and feature-specific routes

ASEschedule supports the OpenAI API and a configured model server using LM Studio. The website support assistant has its own provider settings. Voice transcription uses OpenAI directly. Referrer contact discovery also uses OpenAI directly for web searches using supplied practitioner and medical-centre contact details. Healthcare-update summaries use OpenAI directly with public news source material. Document or receipt analysis and patient appointment-message drafting can also use OpenAI through feature-specific fallback routes, including when a general fallback setting is off. Choosing a model server for some AI features does not mean every AI request stays on that server or on your own computer.

Training, storage and deletion

OpenAI's published API data controls state that API data is not used to train its models unless the customer opts in. Its standard abuse-monitoring logs may retain content for up to 30 days, with exceptions, and some features retain additional application data. These are the provider's published defaults; the conditions for a particular service also depend on the applicable account settings, feature and contract.

A model server's location and its handling of requests, logs and backups depend on how that server is operated. AI processing may occur outside Australia. Content saved in ASEschedule is subject to the record, file and retention arrangements described on this page, separately from any provider's processing records. Contact ASEschedule for the provider, country, training, retention and deletion conditions relevant to the feature you use.

For customer data, the customer is generally the controller or accountable service provider for the information it enters, and aseschedule acts as a service provider processing data on the customer's instructions.

aseschedule processes customer data to provide the subscribed services, support the account, maintain security, troubleshoot issues, create backups, meet legal requirements, and use approved subprocessors. aseschedule will not use customer data for unrelated advertising or sale.

aseschedule applies administrative, technical, and organisational measures designed to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. Customers must configure user access, exports, retention, and client-facing notices appropriately.

On termination, customers may request export of available records. After the account closes, aseschedule may retain backup, audit, billing, legal, or security records for limited periods before deletion or de-identification.

aseschedule may use essential cookies or local storage for login sessions, security, preferences, and service operation. Optional analytics or marketing technologies should only be enabled with appropriate notice and consent where required.

Public pages use Cloudflare Web Analytics for aggregate page and performance measurement and a first-party, session-scoped acquisition record for the signup funnel. Acquisition measurement stores only approved campaign fields, page categories and milestone flags; it does not collect patient details, clinical content, form text, session replay or DOM content.

Public website pages also load Google Analytics 4 (GA4) for website measurement. Our Analytics account enables sharing measurement data with Google to help improve its products and services, and is linked to Google Ads for advertising measurement. Signup-email verification measurement can send tag-generated client and session identifiers, verification timing, consent states and the signup verification event to Google. This event payload does not add email addresses, patient identifiers or clinical content. See Google's privacy policy for its handling of information.

Users can control many cookies through browser settings. Disabling essential cookies may prevent login, booking, account security, or preference features from working properly.

aseschedule uses role-based access controls, authentication safeguards, audit records, monitoring, error logging, least-privilege access practices, and secure operational procedures.

Operational targets include daily database backups, periodic restore testing, local backup tooling for operators, incident review, and disaster recovery procedures designed to restore service after infrastructure, data, or deployment incidents.

No internet service can guarantee uninterrupted availability or perfect security. aseschedule will investigate security incidents, take reasonable containment steps, and notify affected customers where required by law.

Customer data belongs to the customer or the relevant patient/client as determined by applicable law, professional obligations, and the customer's own terms. aseschedule does not claim ownership of customer records.

Customers can export supported patient, client, appointment, billing, and record data from available export tools or by support request. Export format and completeness may depend on the account plan, feature area, and technical availability.

Retention depends on the record type, applicable law and professional obligations, continuing care, legal holds and any justified longer account retention setting. The clinic's saved location helps identify the applicable rules; its owner must also confirm the location, profession and facility type. Location alone does not establish compliance or authorise deletion.

For supported outpatient records, the retention assessment uses verified birth and last-service dates, together with the last record-entry date where a professional rule requires it. Rules that have not been verified for a jurisdiction, facility or record type require a separate assessment before permanent disposal. Existing retention dates are not automatically shortened when settings or a clinic's address change; historical clinic obligations must also be reviewed.

Archiving preserves a record and is not permanent disposal. Reaching a retention date makes a record eligible for review, not automatic deletion. An operator must separately review continuing care, legal or dispute holds, the accuracy of record dates, applicable obligations and the handling of files, backups and other copies before authorising disposal. Missing information or a recorded hold prevents authorisation.

Disposal review does not itself erase uploaded files, provider copies or local backups. A linked archived file must be absent before the archived database record can be disposed of. Other copies require verified secure deletion or de-identification, or documented restriction beyond use and subsequent destruction where individual deletion from a backup is not reasonably possible. A limited disposal register may retain the patient's name, period covered, disposal date and review details where required. Deletion from one system does not establish that every copy has been destroyed.

If a customer terminates its account, the customer should export records before closure. Protected archived records prevent permanent account deletion until their retention and disposal requirements have been resolved. Other inactive account information may be removed or de-identified after required retention and recovery periods, subject to applicable legal, billing, audit and security requirements.

Last reviewed: 3 October 2026. The list below describes core services and feature-dependent providers. The providers receiving information depend on the services, delivery routes and integrations used by your business; each listed provider does not receive every customer's information. Connected services may also process information under their own terms and privacy policies.

Core services and feature-dependent providers

Provider or service	Purpose and information processed	Location and privacy information
Supabase	Account authentication, application records and file storage. This includes account, patient or client, appointment and clinical-record information, and uploaded files.	The primary project region was verified as Sydney, Australia on 2 October 2026. Support and other processing can involve additional locations under Supabase's data processing terms.
Cloudflare	Website and application hosting, request delivery, security, supporting data services and analytics. Application request and response content, including personal or health information handled by the relevant feature, technical identifiers and operational records may be processed.	Global infrastructure and support; location depends on the service and configuration. See Cloudflare's data processing terms.
Stripe	Subscription billing, credit purchases and enabled clinic payment services. Depending on the payment flow, clinic or account identifiers, payer contact details, billing and transaction information, payment references and booking context are sent to Stripe.	International processing. Stripe's privacy policy describes transfers including the United States and India.
OpenAI	AI drafting, analysis, transcription and assistance, including feature-specific fallback. Relevant text, patient context, documents, images or audio may be processed.	Processing may occur outside Australia. Account and feature conditions apply; see AI processing information and OpenAI's data controls.
Configured model server / LM Studio	An alternative route for supported AI features. Relevant text and supported image inputs may be processed by the configured host.	The country and retention arrangements depend on the actual host. LM Studio is model-serving software; its use alone does not establish where a request is processed.
Resend / Amazon Web Services (SES)	Email delivery through the configured route, including supported fallback. Recipient and sender details, message content, selected attachments and delivery records may be processed.	Resend publishes United States storage. SES sending and other processing locations depend on the active service configuration.
Notifyre / ClickSend / Twilio	SMS delivery and supported inbound messages through the configured provider. Phone numbers, message content and delivery or conversation information may be processed.	Provider, carrier, support and routing arrangements determine the locations involved. Australian delivery or an Australian provider does not establish that all processing stays in Australia.
GoFax / Notifyre	Fax delivery when used, including supported fallback. Recipient fax details, document contents and transmission records may be processed.	Locations depend on the delivery provider, carrier and support arrangements.
Mailchimp	Marketing integration when connected. Selected contact names, email addresses and subscription status may be synchronised.	A connected external service; its account-specific processing and international-transfer conditions apply.
Meta (WhatsApp / Messenger / Facebook / Instagram)	Messaging integrations when connected, and optional Facebook or Instagram account connections for enabled social features. Recipient identifiers, message content, delivery information and connected Page or account details may be processed.	Connected international services; locations depend on the service and account arrangements.
LINE / LY Corporation	LINE Official Account messaging when connected. Recipient identifiers, message content, appointment links, connection details and delivery information may be processed.	Processing may occur outside Australia and depends on the service, account and provider arrangements. The exact storage and access countries for connected accounts have not been verified. See LY Corporation's privacy policy.
Zoom	Telehealth meetings when connected. Meeting host details, timing and appointment references may be processed.	A connected external service; meeting, account, support and any recording arrangements affect processing locations and retention.
Google	Public website analytics, advertising measurement and font delivery; Google sign-in when chosen; Google Calendar where connected. Website technical or measurement identifiers, sign-in account, profile and email details, and selected calendar information may be processed for those services. Analytics measurement data may also be shared with Google for product and service improvement.	International services. Website measurement and connected calendar processing serve different purposes and have service-specific conditions.

Stripe payment processing

Depending on the payment flow, booking context sent to Stripe can include appointment type or service description, practitioner, appointment timing and duration, booking or group-session references, series count and selected reminder-channel preferences. A service description combined with identifying details can reveal health-related information.

Stripe also collects payment-method and technical information, including device identifiers and information collected through cookies or similar technologies, when you use its payment or account pages. Depending on the activity, Stripe processes information on payment instructions or determines its own processing purposes. Its data processing terms describe this distinction.

Stripe's published privacy information describes uses including payment authentication, fraud and loss prevention, legal compliance and service improvement. It also describes using personal and transaction data to train AI models for fraud prevention and other payment-service purposes. This does not establish how every field sent by ASEschedule is used or which account-specific controls apply. These activities have their own conditions and are separate from the OpenAI API data controls explained in our AI processing information. See Stripe's Privacy Center.

Stripe may retain information after a transaction or account closure for legal, financial-record and fraud-prevention purposes. Deleting a record in ASEschedule does not automatically delete Stripe's records. Processing can involve countries outside Australia; the countries and any additional contractual restrictions for a particular account require separate confirmation.

Overseas processing and retention

Service delivery, support, logs and other processing may involve countries outside Australia, including the United States and India as described above. The location notes identify known information and relevant provider conditions; they are not a complete account-specific list of every processing country. A Sydney database region does not mean all email, SMS, AI, support or connected-service processing takes place in Australia.

Retention and deletion differ between application records, uploaded files, delivery records, provider logs and backups. For example, Resend publishes 30-day email and log retention for its Free, Pro and Scale plans; OpenAI's processing conditions are explained in the AI section. Provider defaults do not establish a single retention period for all ASEschedule information.

For the providers, countries, contracts and retention or deletion conditions relevant to your business or a particular feature, contact shxjcl0703@gmail.com. For questions about your clinical records and the treating clinic's use of connected services, contact that clinic or ask ASEschedule to help direct your enquiry.

Support is provided through the in-app support tools or contact channels listed on the website. Response times may vary by plan, severity, timezone, and early-access status.

Subscription and additional-user prices are in AUD and exclude GST. We add 10% GST to the subscription charge and show the subtotal, GST and total separately on invoices. Medical & Allied Health starts at $38 AUD per month plus $3.80 GST ($41.80 total) for the first active user. Optional credit packs and add-ons retain the tax treatment shown at purchase.

Subscriptions renew until cancelled. The account owner can turn off automatic billing or cancel in Settings → aseschedule plan. Ordinary cancellation takes effect at the end of the current trial or paid billing period, with access continuing until that date. A scheduled cancellation can be reversed before the period ends. This ordinary cancellation process does not limit any right to earlier termination or a remedy under applicable law.

Before increasing an existing customer's subscription price or making a materially adverse change to their subscription terms, we will email the account owner at least 30 days before the change takes effect, explaining the change, effective date and cancellation options. A subscription price increase will apply no earlier than the next renewal after that notice period and will not increase the price of a period already paid for. You can cancel before the affected renewal without a cancellation penalty. If another materially adverse change would take effect during a prepaid period, contact us before it takes effect to arrange termination without a cancellation penalty and a refund of the unused prepaid subscription period.

For billing errors, duplicate charges, service faults or requests for a remedy, contact shxjcl0703@gmail.com or use in-app support. We assess the facts and provide the repair, resupply, refund, cancellation or other remedy required by applicable law; a remedy required by law is not discretionary. Please provide the account email and invoice or transaction reference, without patient records, passwords or full card details. Prepaid fax credit does not expire and is non-refundable except where a refund is required by law.

Users must not upload unlawful material, misuse patient or client information, attempt unauthorised access, interfere with service operations, send spam, scrape the service, bypass usage limits, or use aseschedule to create unsafe, discriminatory, deceptive, or abusive workflows.

Transactional appointment messages may be sent where configured by the customer and permitted by law. Marketing SMS or email requires appropriate consent and must include a functional unsubscribe process where required.

Customers are responsible for message templates, recipient consent, opt-out handling, sender identification, and ensuring appointment reminders do not disclose unnecessary sensitive information.

Trials, discounts, and promo codes may be limited by account, plan, region, time, and eligibility. Failed payments may result in retry attempts, service restrictions, downgrade, suspension, or cancellation after notice where practical.