PainTrace Booking is online booking software for massage, bodywork, and wellness practices, made in Greenville, South Carolina. Anything in this policy is a promise from us to you. Questions go to paintracebooking@gmail.com and a person answers them.
Practice account information. When a practice signs up we collect the practice name, a sign in email, an optional phone number, and a password. Passwords are stored only as salted cryptographic hashes. We never see or keep the actual password.
Practice content. The services, prices, business hours, branding choices, and pages a practice sets up in its back office.
Booking information. When a client books an appointment, we store what the booking form asks for: name, email, phone, the chosen service, the date and time, and any note the client chooses to leave. This is the practice's information, held for the practice.
Session records the practice keeps. Practices can write session notes in their chart, and clients can answer one tap pain check-ins from 0 to 10. These live in a sealed vault: encrypted, access logged, isolated to that one practice, and visible only to it. We process them for exactly one purpose, running the service, and we never read, mine, or sell them.
Payment information. Client card payments run through the practice's own Stripe or Square account, and a practice's subscription card is handled by Stripe. In every case card numbers go directly to the payment processor and are never stored on PainTrace Booking servers.
Technical basics. Standard server logs such as IP addresses and request times, used for security, abuse prevention, and keeping the service up.
No records from other systems. PainTrace Booking holds what happens inside PainTrace Booking. Do not import medical records from other systems. We do not sign business associate agreements at this time, and HIPAA covered entities should not use the service for protected health information; the Terms explain this plainly.
Each practice owns its client list, its bookings, and everything it creates in PainTrace Booking. We process that information for exactly one purpose: running the service the practice signed up for. Every practice's data is isolated from every other practice's data, enforced in the software itself. Your clients are yours. Full stop.
A small number of providers touch data so the product can work, each only as much as their job requires: Cloudflare hosts the application and database. Resend delivers emails such as booking confirmations and password reset links. Stripe handles payments inside the practice's own Stripe account. Telnyx sends text reminders when a practice turns them on. We do not hand data to anyone else unless the law requires it.
Clients who book receive confirmations and reminders sent by PainTrace Booking on their practice's behalf, with the practice named in every message. Practice owners receive account email such as booking alerts and password reset links. We do not market to a practice's clients.
Text messages are opt in only. A client receives appointment texts only after checking the consent box beside the phone number field while booking, and by opting in agrees to receive automated appointment texts at the number provided. Consent is not a condition of booking or service. Every text honors STOP and HELP replies, message frequency varies with appointments booked, and message and data rates may apply. A client receives at most a confirmation and two reminders per appointment, and replying STOP ends texts after one final confirmation message. Your mobile information will not be sold or shared with third parties for promotional or marketing purposes, and text opt in consent is never shared with anyone for marketing. We use a telecom delivery provider to send texts, and the phone number is shared with that provider solely to deliver these appointment messages.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Mobile information is never sold, never rented, and never shared for lead generation or for third party analytics either. We may share your personal data, including your SMS opt-in or consent status, with third parties that help us provide our messaging services, including but not limited to platform providers, phone companies, and any other vendors who assist us in the delivery of text messages. We will not share your opt-in to an SMS campaign with any third party for purposes unrelated to providing you with the services of that campaign. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
For the text program we also keep the proof of consent itself: when the box was checked and the number it covered, along with message delivery records and the standing record of every opt out, so the record of who agreed always exists and STOP is honored permanently. Opt in and opt out both happen on the same number the texts come from: reply STOP or HELP to any message and that same line answers.
Questions about the text program reach paintracebooking@gmail.com and a person answers, or reply HELP to any message. The full SMS terms and conditions are published in our Terms of Service.
PainTrace Booking offers two mobile apps: PainTrace Booking for clients and PainTrace Pro for practices. Both are windows onto the same platform, and this policy covers them in full. The apps carry no advertising and no third party trackers. If you turn on notifications, the app collects a device push token used only to deliver appointment reminders and, in PainTrace Pro, booking and note alerts; it is never used for advertising and never shared for marketing. Pain check ins recorded in the client app are health related information; they live in your chart at your practice, help you and your practitioner see progress, and are never sold, never shared for marketing, and never used for advertising.
The apps are not a medical device and do not diagnose, treat, cure, or prevent any condition or disease. Nothing in the apps replaces the judgment of a healthcare professional, so please consult your provider for medical advice. The apps are not directed at children under 13. App users hold the same rights described in this policy: to see, correct, export, or delete information, start with your practice or email us and a person answers.
As long as the account is active, so the practice's history works. Practices can export their data at any time. When an account closes, we delete its data within 30 days, and residual copies in backups clear within 30 days after that.
Everything travels over HTTPS. Passwords are stored as salted keyed hashes, never in plain text. Sign in sessions expire after 8 hours, password reset links work once and die after 30 minutes, and changing a password signs out every other device. Session notes live in an encrypted vault, and every chart view is written to an access log the practice can read. If we ever learn of a breach affecting your information, we will notify affected practices without undue delay.
Whatever state you live in, we honor requests to see, correct, export, or delete information; email us and a person answers. Practices can read, correct, export, or delete their information at any time, in the app or by emailing us. If you are a client of a practice that uses PainTrace Booking, your booking information belongs to that practice, so start with them. We help every practice honor these requests.
PainTrace Booking is operated from the United States, and your information is processed in the United States on the global network of our hosting provider. If you use the service from outside the United States, you understand your information travels to and is handled in the United States. The rights described above, to see, correct, export, and delete information, belong to every user wherever they live. We welcome Canadian practices and honor the rights Canadian privacy law provides. If the law of your region grants additional rights, email us and we will honor what the law requires. The text messaging program runs on United States carriers only.
PainTrace Booking accounts are for business use by adults 18 and over.
If this policy changes, the new version appears here with a new date, and material changes get emailed to practice owners first.
PainTrace Booking · Greenville, South Carolina · paintracebooking@gmail.com