Privacy Policy

GildyFy is a product of Sunokrom LLC, a Florida limited liability company based in Deerfield Beach, Florida (“GildyFy”, “we”, “us”).

• For a business’s clients and patients, the business decides what information it collects through GildyFy and how it is used. We handle that information on the business’s behalf, as its service provider. If you are a client, questions and requests about your information should go to the business first.
• For business accounts, their teams and visitors to gildyfy.com and to the businesses’ websites on gildyfy.app, we decide how personal information is used, and this policy describes it.

Business accounts and their teams

• Name, email, phone number, role, profile picture, and sign-in details. Passwords are stored only as a hash by our authentication provider. If you sign in with Google, we receive your name, email and picture.
• Business details and settings you enter: business name, address, services, prices, hours, team members.
• What a business publishes on its GildyFy website: its team members’ names, roles, licenses and photos, client reviews it chooses to show, and photos of its work. The business decides what to publish and confirms it has permission.
• If a team member connects Google Calendar: permission to read availability and to create, change and remove the events GildyFy makes. The access tokens are stored encrypted.
• A log of actions taken in the account, and the content of support requests you send us.
• A record that you agreed to our terms: the version, the date and time, your email, and the IP address and browser you used. We keep this record after an account is closed, as evidence of the agreement.
• The business’s own GildyFy plan: it is billed by GildyFy through Stripe, separately from the business’s own clinic payments, and the owner’s card is entered on Stripe’s form and held by Stripe, not by GildyFy. We keep the plan’s status (trial, subscribed, payment failed, ended), any promotion code applied, the identifiers Stripe gives the subscription, and a record that the owner agreed to the monthly charge (the plan and price shown, the version of our terms, the date and time, the email, and the IP address and browser); like the record of agreeing to our terms, it is kept after an account is closed. We email the owner as the free trial comes to an end, and when a payment for the plan fails: that day, then every 5 days until it is paid or 30 days have passed.

Clients and patients of a business (handled for that business)

• Name, email, mobile number and, where the business asks for it, date of birth.
• Bookings: the service, date and time, the provider, whether it is online or in person, and, when someone books for another person, the contact details of the person who booked.
• Payment records: packages, payment plans, amounts, dates and status, refunds and corrections, and identifiers from Stripe. Card numbers are entered on Stripe’s pages and are held by Stripe, not by GildyFy. A client who chooses Klarna or Affirm at checkout applies with that company on its own pages; Stripe passes it the details it needs, and the client’s agreement with it covers what it does with them.
• For businesses that keep a chart: what the business or the client records, which can include weight and body measurements, lab results, medications and doses, treatments and injections (product, dose, lot number), symptoms and check-ins, doses taken at home as the client reports them (taken or skipped, and when), notes, and messages between the client and the business.
• Photos a business takes of its clients as part of their record, such as before-and-after photos and magnified scalp images, with the date, the view and the camera used. Location data saved inside a photo file is removed before upload. The photos are kept in our hosting provider’s storage, and only the business’s authorized team can view them.
• Forms the client fills in and signs for the business, such as consents and a medical history: the answers, the name typed as a signature, the date and time, the device’s IP address and browser, and how the person was identified.
• Files and text a team member gives to the staff assistant.
• Records of the texts and emails sent, including the address or number and whether delivery succeeded.

Visitors to our website

• Pages viewed, approximate location, device and browser, collected through Google Analytics on our marketing pages.
• Anything you send us by email or phone.

Technical information

• IP address, device and browser details, and error and security logs, used to run and protect the service.

• To provide the service: accounts, booking, reminders, payments, records, the portal and the assistant.
• To send messages on a business’s behalf: confirmations, reminders, verification codes, payment links, forms links, receipts, refund notices, sign-in links, and notices that forms were signed (to the client and to the business; they never include the answers).
• To keep the service safe: preventing abuse, limiting repeated attempts, investigating problems.
• To support customers and fix faults.
• To understand how the product and the website are used and to improve them.
• To meet legal duties and to enforce our terms.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not send marketing messages to a business’s clients.

The business. A client’s information is available to the business the client deals with and to the team members the business has given access.

Companies that provide services to us. Each receives only what its service needs and handles it under its own terms. The current list:

Google Calendar. When a provider connects a calendar, each booking creates an event there containing the client’s first name and last initial, the type of visit, the place if in person, and a link back to GildyFy. GildyFy asks Google for three permissions: the list of the provider’s calendars, so they can choose one; free/busy times, to offer open slots; and the events on calendars the provider owns, which GildyFy uses only to create, change and remove the visits it books. GildyFy’s use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements: calendar information is used only to run bookings, is never used for advertising, and is never sold or passed to anyone except as this policy says.

Check-in kiosk. When a business puts a GildyFy check-in tablet in its waiting room and you type your mobile number on it, GildyFy marks your visit as arrived and tells the business’s team: by a notice in the app, which shows the number and the name and profile photo of the business’s client it belongs to, or of each of them when several share it; and, for team members who turn it on, a push alert through ntfy that gives the time and type of the visit and the provider’s name but not your name or number. ntfy may pass these alerts through Google’s push service to reach Android phones, and keeps them for up to 12 hours. GildyFy keeps the number, with the time of the check-in, for 90 days. When the check-in is tied to one of the business’s clients (through their visit, their number, or the team choosing them), its date and time also stay on that client’s record, without the number. If the tablet is offline, the number waits on the tablet until it can be sent, for up to 24 hours.

Apps the business connects. When a business creates an API key in GildyFy for another system (for example an AI receptionist), that system can read the business’s services and free times, and book, find, move and cancel its clients’ visits, including each client’s name, phone number and email. It handles that information under the business’s own agreement with it; GildyFy does not choose or contract it. GildyFy keeps a record of the requests such a system makes for 90 days (when, which key, what it asked for and the result), and the business can see it in Settings.

GildyFy support staff. When our staff open a support session on a business’s account, they can see what the account owner can see, including client records, for as long as the session is open. Each session is logged, and the business can see it and end it.

Others, only when necessary. To comply with a law, court order or lawful request; to protect the rights, safety or property of clients, businesses, the public or GildyFy; and to a successor if GildyFy or its business is sold, merged or reorganized.

• Sign-in cookies, on the staff app and the client portal, to keep you signed in, and one that remembers where to send you after signing in with Google (up to 10 minutes).
• Booking cookies: one that holds a time slot while you finish booking (up to one hour), one that lets you return to a visit you verified, and one that remembers where to send you after signing in.
• Booking details in your browser: if you book, your name, email and phone are kept in your browser for up to 30 minutes so a second booking is quicker.
• Kiosk cookie: on a business’s check-in tablet, one that ties the tablet to that business (up to 400 days).
• Preference storage in your browser, such as the unit you chose for weight.
• Product analytics (PostHog) on the staff app: usage events, error reports and, for staff only, session recordings used to find faults, which can show what is on the staff member’s screen. Analytics on client-facing pages keeps nothing in your browser.
• Google Analytics cookies on our marketing pages (gildyfy.com and its landing pages) only.
• YouTube videos on a business’s website, where it adds them: the video’s picture loads from YouTube with the page, and the player loads from YouTube’s privacy-enhanced domain only when you press play. YouTube may then keep information in your browser under its own privacy policy.

You can block or delete cookies in your browser. Sign-in and booking will not work without their cookies.

When a team member uses the staff assistant on a client’s chart, GildyFy sends that chart (first name, date of birth, sex, measurements, conditions, medications, lab results, symptoms and notes) together with what the team member types or uploads to Anthropic to produce an answer. Voice dictation is sent to xAI to be turned into text. The assistant may search the web; the search terms are sent to Anthropic. A team member can also ask the assistant to draft a form; only the team member’s request and the form’s own text are sent to Anthropic, never a client’s information. A team member can also ask for help writing the business’s website text; only their answers about the business and its name, type and service names are sent to Anthropic. We do not use this content to train our own models. Changes the assistant proposes to a record are made only when a team member approves them, unless the business has turned on automatic changes for that action.

Texts and emails are sent on behalf of the business you deal with. They can include your first name, the time and type of your appointment and, for reminders a business sets, a short description of what the reminder is about. To stop receiving messages, tell the business or write to hello@gildyfy.com. Replies such as “STOP” are not processed automatically on every channel, so please contact the business or us directly. A message you send through a business’s website contact form is delivered to that business by email, and GildyFy stores no copy. Please don’t include health details in it.

We keep information for as long as the account it belongs to is open and for as long as it is needed for the purposes above, including legal, accounting and security needs. We have not yet set fixed deletion periods.

• Removing a client from a business’s list hides the record; it does not erase it.
• Signed forms are kept when a client is removed from a business’s list, as the record of what was agreed.
• When a business closes its account, or a client or business asks us to delete information, we delete it within a reasonable time unless the law or a legitimate need (such as a payment record) requires us to keep it. Copies may remain in backups until they are overwritten.

We use measures that are reasonable for a service of our size: encrypted connections (TLS) between your device and GildyFy; separation of each business’s data from every other’s; roles that limit what each team member can see and do; limits on repeated sign-in and booking attempts; a log of account actions; encrypted storage of connected-calendar credentials; and logged, time-limited access for our support staff. Payment card details are handled by Stripe.

No system is completely secure, and we cannot guarantee the security of information. If you believe an account has been compromised, write to hello@gildyfy.com at once.

Some businesses use GildyFy to record information about their clients’ health. GildyFy is not offered as a HIPAA-compliant service and does not currently sign Business Associate Agreements. Each business is responsible for deciding whether its use of GildyFy meets the health-privacy laws that apply to it. If you are a client and have questions about your health records, ask the business that holds them.

• Clients and patients: ask the business you deal with to see, correct or delete your information; it controls those records. You can also write to us and we will pass your request to the business and help it respond.
• Account holders and team members: you can see and correct most of your information in the app. To close an account or ask for a copy or deletion of your information, write to hello@gildyfy.com.
• Website visitors: you can block Google Analytics with your browser’s settings or an opt-out extension.
• Depending on where you live, the law may give you rights to know, correct, delete or obtain a copy of your personal information and to appeal a refusal. We will respond to requests as the law that applies to us requires, and we will not treat you unfairly for making one. We may need to confirm your identity first.

GildyFy is for businesses and is not directed to children under 13. A business may record information about a minor who is its client; the business is responsible for having the parent’s or guardian’s permission. We do not knowingly collect information from a child under 13 directly. If you believe we have, write to hello@gildyfy.com.

GildyFy is offered to businesses in the United States, and information is processed in the United States. If you use it from elsewhere, your information is transferred to and handled in the United States.

If we learn of a breach of security that affects personal information, we will notify the affected businesses and individuals, and the authorities, as the law requires.

We may update this policy. The date at the top shows when it last changed. For a material change we will email account owners before it takes effect.

Sunokrom LLC, Deerfield Beach, Florida. Email: hello@gildyfy.com. Phone: +1 754 714 8742.