Privacy Policy

ESB Scheduling is a practice management platform for independent therapists, operated at app.esbscheduling.com. This Privacy Policy explains what information we collect, how we use it, and how we protect it. By using ESB Scheduling, you agree to the practices described here.

ESB Scheduling uses SMS (text messaging) to send appointment reminders, booking confirmations, cancellation notices, and balance updates to therapy clients on behalf of their therapist.

Opt-in: A client provides their mobile phone number to their therapist during the intake process. The therapist enters the number into ESB Scheduling and confirms that the client has consented to receive SMS messages from the practice. No number is added without therapist-confirmed consent.

Types of messages:

• Appointment reminders (48 hours and 2 hours before a session)
• Booking confirmations and rescheduling notices
• Cancellation notices
• Payment balance reminders
• Responses to client-initiated SMS commands (BOOK, CANCEL, SCHEDULE, BALANCE, HELP, STOP)

Message frequency: Clients typically receive 1–3 messages per scheduled appointment. Additional messages may be sent if the client initiates contact via SMS commands.

Opt-out: Clients can opt out at any time by replying STOP to any message. No further messages will be sent after opting out. Clients can re-enable messages by replying START.

Help: Clients can reply HELP for a list of available commands or contact their therapist directly.

Message and data rates may apply. Standard carrier rates apply to all SMS messages sent and received.

ESB Scheduling includes an interactive voice response (IVR) phone system that allows clients and therapists to interact with the platform by phone call. When a client calls the practice phone number:

• The system identifies the caller by their registered phone number
• Callers may hear upcoming appointment details, outstanding balances, or office information
• Callers may have the option to leave a voicemail for their therapist

Voicemail recordings left through the phone system are stored securely and are accessible only to the therapist associated with the practice. Recordings are retained until manually deleted by the therapist.

We use collected information to:

• Send SMS appointment reminders and confirmations to clients
• Operate the phone booking and IVR system
• Process session bookings and cancellations
• Track and display payment balances
• Authenticate therapist accounts and protect against unauthorized access
• Deliver voicemail recordings to the correct therapist account

We do not sell, rent, or share client or therapist data with third parties for marketing or advertising purposes.

All data is stored in a secure, encrypted PostgreSQL database. Passwords are hashed using bcrypt and are never stored in plain text. All API requests are authenticated using signed JWT tokens. Each therapist account is fully isolated — no therapist can access another therapist's clients, sessions, or records.

All data is transmitted over HTTPS. Voicemail recordings are stored using Twilio's secure media storage and are accessed only through authenticated requests.

Client data is retained for as long as the therapist account remains active. Therapists can delete individual client records at any time from the dashboard. Upon account deletion, all associated data will be permanently removed from our systems within 30 days.

Voicemail recordings are retained until deleted by the therapist. SMS message logs are retained for up to 12 months for troubleshooting purposes.

ESB Scheduling uses the following third-party services, each governed by their own privacy policies:

• Twilio — SMS messaging, IVR phone system, voicemail storage, and outbound calling
• Stripe — credit card payment processing
• Supabase / PostgreSQL — secure database storage
• Vercel — cloud hosting and deployment

Clients: If you wish to have your data removed from a therapist's account, contact your therapist directly. Therapists can permanently delete client records at any time.

Therapists: You may request full account deletion and data removal by contacting us. All data will be removed within 30 days of the request.

We may update this Privacy Policy from time to time. Changes will be posted on this page with a revised "Last updated" date. Continued use of the platform after changes are posted constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or how your data is handled, please contact us at: office@esbscheduling.com