Where your data lives and who has access to it.
Hosted in the European Union, encrypted in transit, and every company that handles data on our behalf named. If an answer is missing, ask us.
How we protect your data
GDPR, in practice
Digital consent forms with a date and time stamp, and an export of a client's data when they ask for it. Everyone else who handles the data is named: Cegid Vendus for invoicing, OpenAI for Mintu, AWS and Cloudflare for infrastructure.
Hosted in the European Union
Your data sits on AWS and Cloudflare infrastructure inside the European Union. Traffic between your browser and Appointmint is encrypted over TLS, so nobody along the way reads what passes.
Two-step authentication
Any user can turn on a second step at login. It is optional and decided per person, not for the whole account.
Change log
Changes to records are logged with the user and the date. If someone moves an appointment or edits a client's details, you can see who it was.
Backups
We back up the database. If you ever leave, residual copies are deleted or anonymised within 90 days, as written in the Terms.
Each practitioner sees what concerns them
A therapist sees their own clients and notes, reception sees the calendar, an administrator sees everything. The check is applied on every request, and there is no cross-access without someone authorising it.
Roles and permissions
Create roles for reception, finance, therapists or trainees, with permissions per module. Login is email and password, with a second step if you want one.
Certified invoicing
Invoices are issued through Cegid Vendus, software certified by the Portuguese tax authority under no. 2230/AT. Appointmint is not the certified software: it is who operates it for you.
Verified by third parties
Meta approved us as a Tech Provider. That is why your clinic can connect its own WhatsApp Business number through us.
Our customers' invoices are issued by software certified by the Portuguese tax authority, no. 2230/AT.
Payments are processed by EasyPay, an institution authorised by Banco de Portugal, special registration no. 8706.
Need the contract for your GDPR file?
Your clinic is the controller of your patients' data; we are the processor. The Data Processing Agreement exists, it is Annex A of our Terms, and we send it to you ready to sign — just ask.
Request the agreement and the security fileData protection
Fábio Cardoso is responsible for data protection at Appointmint — [email protected]. Supervisory authority: Comissão Nacional de Proteção de Dados (CNPD).