Skip to content

Draft: pending legal review

How Nafasi handles data

Plain-language principles. A full privacy policy will be published after attorney review.

Who we are

Nafasi provides online booking for independent clinics, studios and shared-suite buildings. When you book with a business on Nafasi, that business decides what happens with your information; Nafasi stores and protects it on the business's behalf.

What we keep

  • Clients: your name, and an email address and/or mobile number, plus your appointments, so you can book, get reminders and manage your bookings.
  • Visit notes (optional): if a business turns on visit notes, its staff may keep short notes about your visits, such as products used or preferences. Notes are visible only to that business.
  • Text-message consent: if you agree to text messages, we record when you agreed and the wording you saw.
  • Businesses: services, hours, providers, rooms, bookings, branding and pages.
  • Early access: your first name, email and the kind of practice you run.

What we don't keep

  • No card numbers. Payments, when added, will go through a payment processor.
  • No intake forms, diagnoses or photos at this time.
  • No advertising trackers or third-party analytics on our pages.

Who can see it

  • Your information is shared only with the business you book with. Each business sees only its own clients.
  • Other businesses in the same building only see that a shared room or machine is busy.
  • Building operators see room occupancy only, never names or bookings.
  • Nafasi staff access a business's records only to help that business, and that access is logged.
  • We never sell or rent client information.

Emails and messages

  • Booking emails are sent by Nafasi on behalf of the business (they show the business's name) through our email provider. They include only the day, time and place, never the service or anything about your visit.
  • Replies go to the business.
  • Sign-in codes are emailed and expire after 10 minutes.

How it's protected

  • Names, contact details and visit notes are encrypted in our database.
  • Business owners and staff sign in with two-factor authentication and are signed out after 30 minutes without activity.
  • All traffic is encrypted. Changes, sign-ins and every view of visit notes are logged.
  • Visit notes can't be edited or deleted by the app; corrections are added alongside the original.

How long we keep it, and your choices

  • Appointments are kept so the business has an accurate history; cancelled appointments are marked, not erased.
  • Businesses can export their client list. To see, correct or delete your information, contact the business you booked with, or us.
  • Retention periods will be set out in the full privacy policy.

Questions: [email protected]