A booking system holds contact details, visit history, staff notes and sometimes health information. Know where it is stored, limit who sees it, tell customers, and plan how you would leave. General information, not legal advice.

More than a calendar

An online booking system looks like a calendar with a button on it. Behind the calendar sits a customer database the business may never have looked at as one.

Every booking adds a name, a phone number, an email address and a time. Many systems also keep visit history, payments, answers to intake questions and notes staff write about each customer.

Some of it is sensitive: an injury, a pregnancy, a medication, a child's allergy.

It sits on another company's servers, under that company's terms, and the business remains responsible for it. What follows is general information, not legal advice.

What a booking system usually holds

The fourth is the one to read first. Notes are written by staff for staff, in whatever words came to mind, and they are personal information like everything else on the list.

Notes a customer could ask to read

Under PIPEDA, and the private-sector privacy laws some provinces have of their own, people can generally ask a business for the personal information it holds about them.

That includes notes. A note calling somebody difficult, always late and quick to haggle may one day be read by the person it describes.

Write notes as facts the business needs: prefers mornings, left knee injury, no kneeling exercises. Leave opinions out.

Health details belong only where the service genuinely needs them, visible only to the people providing it.

Where the records are stored

Most booking services keep customer records on servers of their own or a large hosting company's, often outside Canada.

That is generally allowed. The business usually stays responsible for information it hands to a provider, should protect it through the contract, and should tell customers it may be stored or processed abroad.

Read the service's privacy terms. Look for where records are held, which of its staff can see them, what it does with them itself, and how it would tell you about a breach.

Some booking services are also marketplaces, where customers open an account with the platform itself and may be shown other businesses. Know which kind you are using.

Who inside the business can see it

Default settings often give every staff login every customer record, notes and intake answers included.

Most systems offer roles. The front desk sees the schedule and contact details; each practitioner or instructor sees notes for their own clients; only the owner exports the whole list.

Check for people who have left. A former employee's login, or the app still signed in on their phone, is access nobody intended.

Check calendar syncing too. A system that copies appointments into staff members' personal calendars puts client names, and sometimes notes, on phones the business does not control.

What customers are told

The privacy policy on your website should mention the booking service: what it collects and why, that an outside company provides it, where records may be stored, and how long you keep them.

On the intake form, say why each question is asked, mark the optional ones, and ask for health details only where the service needs them.

Sensitive information generally calls for express consent: a clear statement and a box the customer ticks, rather than an assumption.

Keep reminders brief. A time and a place is enough; the reason for the visit does not belong on a phone's lock screen.

A worked example

A pilates studio with four instructors moved its class bookings online three years ago. New clients filled in an intake form when they first booked: injuries, surgeries, pregnancy, anything an instructor should know.

Every instructor's login could see every client's record, intake notes included, on the booking app on their phones. One instructor who had left in the spring still had a working login.

The studio's privacy policy, written before the booking system arrived, did not mention it.

When the owner chose a new booking service, she found the old one kept records after cancellation unless asked to delete them, and its standard export left out the intake answers.

She exported everything the new system needed, checked it was complete, and asked in writing for the old account to be deleted, keeping the confirmation.

Now instructors see notes for their own classes only, the intake form asks less, the former instructor's access is gone, and the privacy policy describes the service.

Leaving the service

The time to ask how you would leave is before signing up, and the second best time is now.

Find out whether every record can be exported, notes and intake answers included, in a format another system reads; what happens to records after you cancel; and whether deletion is confirmed in writing.

Export first, check the export, then cancel, then ask for deletion in writing.

Keep the export somewhere secure, not on a laptop's desktop, and decide how long past customers' records are kept.

A breach at the booking company

PIPEDA's breach rules take effect on November 1. From then, covered organisations must record every breach involving personal information under their control, and report the serious ones.

Records a provider holds on your behalf are generally still under your control. Where PIPEDA applies, a breach at the booking company may be yours to assess, record and possibly report.

The terms should commit the provider to tell you promptly. Check that they do.

The counter-case

A system holding only names, times and contact details, for services involving nothing sensitive, needs a lighter review: a line in the privacy policy, tidy staff logins, and an export you have tested.

None of this is a reason to stop booking online. A well-run online system is usually safer than a paper diary on the counter or a spreadsheet emailed between staff.

Know what your system holds, where it is kept, who can see it, what customers are told, and how you would leave.

This month

  1. List every field the booking system collects.
  2. Read the notes staff have written.
  3. Find out where the records are stored.
  4. Limit each login to what that person needs.
  5. Remove former staff and their phone apps.
  6. Describe the service in your privacy policy.
  7. Test the export before you need it.

Step four is the one default settings leave undone. Most systems can restrict what each login sees, and few are set up that way unless somebody asks.

Telling customers what you keep, and why, follows the same logic as recording customer calls and saying so.

Frequently asked questions

What does a booking system store about customers?

Usually contact details, visit history, payment records and reminders, and often intake answers and staff notes, some of them sensitive, such as injuries, pregnancies or medications.

Can customers ask to see staff notes?

Generally yes. People can usually ask a business for the personal information it holds about them, and notes in a booking system are part of it. Write them as facts.

Can booking records be stored outside Canada?

Generally yes, but the business stays responsible for them, should protect them by contract, and should tell customers where they may be stored. Ask a lawyer about specifics.

Which staff should see client notes?

Only the people providing the service to that client. Front desk logins usually need the schedule and contact details, and only the owner needs to export the whole list.

What should our privacy policy say about it?

That an outside booking service collects names, contact details and any intake answers, why, where the records may be stored, and how long the business keeps them.

What happens when we change booking systems?

Export everything you need and check it is complete, then cancel, then ask the old provider in writing to delete your records, and keep its confirmation.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Booking system nobody has reviewed?

We will go through what it collects, who can see it, and what your privacy policy should say about it.

Start a Conversation