Privacy Policy
Effective: 21 August 2026
Atlas Appointments ("Atlas") is an appointment, clinic workflow and reminder system for clinics. This policy explains what information Atlas processes, why it is processed, the service providers involved, and the choices available to clinics, staff and patients.
Information we process
Depending on how a clinic uses Atlas, information may include clinic and staff account details; patient names and phone numbers; appointment date and time; assigned doctor; appointment status; reminder language and settings; and limited technical, security and audit information needed to operate and protect the service.
Account and sign-in information
Atlas may use email magic links, passkeys, Sign in with Apple or Google authentication when those options are enabled. An identity provider may return a stable account identifier and basic profile information such as name and email address. Apple users may choose Apple's private email relay. Atlas does not receive an Apple Account password, Google password, iCloud mailbox contents or Gmail contents through these sign-in flows. Passkey authentication is performed by the user's device or credential provider; Atlas does not receive the private passkey key material.
How information is used
Atlas uses information to authenticate users; create and manage clinics and appointments; enforce clinic and doctor access boundaries; provide scheduling and queue tools; send or track appointment reminders when enabled; protect accounts and clinic data; troubleshoot the service; and maintain reliable operation.
WhatsApp reminders
When a clinic enables WhatsApp reminders, relevant phone-number and appointment-reminder information may be transmitted through a configured WhatsApp Business provider, including the WhatsApp Business Platform operated by Meta. Atlas may also receive delivery-status events so the clinic can know whether a reminder was sent or delivered. Clinics are responsible for using messaging in accordance with applicable consent and messaging rules.
Service providers
Atlas relies on infrastructure and service providers only as needed to operate the platform. These may include Vercel for hosting, Supabase for database and authentication infrastructure, Apple or Google for an authentication option chosen by the user, PostHog for privacy-minimized product analytics, and Meta/WhatsApp or another configured messaging provider for clinic reminders. Atlas does not sell clinic, staff or patient personal information. Providers that process personal information for Atlas are required to handle it under their applicable privacy, security and contractual obligations in a manner consistent with the protections described in this policy and applicable law.
Product analytics and diagnostics
Atlas records a limited, allow-listed set of product interactions and error categories so the service can be improved and kept reliable. These events use a random session identifier and categorical values such as the screen type, interaction outcome and interface language. Atlas does not place patient names, phone numbers, clinic-entered text, appointment details, email addresses, error messages or stack traces in these analytics events. Browser analytics are sent through Atlas so the analytics provider does not receive the clinic user's request headers or IP address directly from the app. Atlas does not use this information for advertising or cross-company tracking.
Apple health data and device permissions
The current Atlas app does not request HealthKit, Clinical Health Records, Contacts, Photos, camera, microphone or location access for its core appointment workflow. Atlas does not store personal health information in iCloud. If a future Atlas feature needs a protected device permission, Atlas will request it only for a disclosed feature and update this policy where appropriate.
Data retention and deletion
Information is retained only as reasonably needed for clinic operations, security, record integrity and applicable obligations. Clinics control their appointment records within Atlas. Patients should normally direct access, correction or deletion requests to the clinic that collected their information. Signed-in Atlas account holders can permanently delete their Atlas account from Settings → Account & deletion. A clinic owner must first transfer or delete owned clinics so a clinic workspace is not removed accidentally. See the Data Deletion page for details.
Security
Atlas uses access controls, tenant separation, encrypted network connections, authentication safeguards, and other technical and organizational measures designed to protect clinic and patient information. No online system can be guaranteed to be completely secure.
Your choices
Clinics can manage staff access and reminder settings. Account holders can delete their account in Atlas. Patients may ask their clinic to correct or remove information held for appointment purposes, subject to legitimate record-retention needs. Users may choose an available sign-in method and can remove Atlas access from an external identity provider using that provider's account controls.
Changes to this policy
This policy may be updated as Atlas develops. The effective date above will be updated when material changes are made.
Contact
Privacy questions may be sent to niazsarbastahmad2002@gmail.com.