Privacy Policy

Therapy Session Scheduler is operated by Travis Miragliotta.

Questions, requests to see or delete information, and privacy concerns: citrarose@aol.com.

From signing in with Google

Your email address, your name and your Google account identifier, as Google provides them when you sign in. The app uses them to know who you are and to check that you were given access.

From your Google Calendar, only if you connect it

You decide whether to connect your calendar. If you do, you approve these two permissions:

• https://www.googleapis.com/auth/calendar.events.owned

  Create, change and cancel the appointment events the app makes for you, including their Google Meet links and the invitations sent to your clients. The app only works with events it created.

• https://www.googleapis.com/auth/calendar.events.freebusy

  See the times you are busy (not what the events are), so the app can stop you from booking two things at once.

Beyond those busy times, the app keeps only details of the events it created: the time, the time zone, the Google Calendar event identifier, the Google Meet link and its status. To keep you connected it stores a Google refresh token, encrypted. It never keeps your Google password.

What the therapist types in

For each client: a name, an email address, and optionally a phone number, a usual day, time and length, and a short scheduling note (such as “prefers mornings”). For each session: its time, whether it repeats, its status and which reminders were chosen.

What the app does not collect

Diagnoses, treatment notes, medical records or payment details. The app is a scheduling tool and is built not to store them; calendar events are titled simply “Appointment”. It has no advertising and no analytics or tracking tools.

Only to provide the scheduling features described on the home page: signing you in, showing your clients and sessions, creating, moving and cancelling calendar events and Meet links, and avoiding double-booking.

Therapy Session Scheduler's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Google user data is never sold and is never used for advertising.
• It is not used to develop, improve or train generalized artificial intelligence or machine learning models.
• It is not shared with anyone else except as described below, to provide the features above, or where the law requires it.
• People who run the app do not read it, except with your permission, to investigate abuse or a security problem, or to meet a legal duty.

The app runs on services from other companies, which handle information only to run it:

• Google: sign-in, Google Calendar and Google Meet. Google also emails the invitation to your client.
• Supabase: the database and sign-in service that store the records described above.
• Vercel: the web hosting that serves this app.

The app sends no emails of its own. Your client's invitation and any Google Calendar reminders come from Google.

• Every connection uses HTTPS.
• The Google refresh token is encrypted (AES-256-GCM) and kept where the public internet cannot reach it.
• Each therapist can see only their own clients and sessions. The database enforces this, not just the screens.
• Only people given access can sign in.

• Disconnect Google Calendar at any time in Settings. This asks Google to revoke the app's access and deletes the stored token. You can also remove access yourself in your Google Account under Security.
• Ending a client in the app makes them inactive so their session history is kept. It does not erase them.
• Deletion. Ask for your information to be deleted using the contact above, and it will be. Events the app already put on a calendar stay there until they are cancelled.

The app sets only the cookies it needs to keep you signed in and to complete signing in safely. It sets no advertising or tracking cookies.

This app is a scheduling tool, not a medical record, and it should not be used to store clinical information. A provider covered by a health privacy law is responsible for confirming that its use of this app, and of Google, Supabase and Vercel, meets that law, including any agreements those laws require.

The app is for therapists and is not directed at children.

If this policy changes, the date at the top changes with it.