Privacy Policy

Showup is operated by DanixSoft (“we”, “us”). This policy explains what we collect when a clinic uses Showup and when a patient books through a clinic’s booking link, why, who else handles it, and the choices people have.

Who is responsible for what

The clinic decides which patients it records and why, and is responsible for that data (the “controller”). DanixSoft stores and processes it only to run Showup for the clinic (a “processor”). For clinic staff accounts and this website, DanixSoft is responsible for the data it collects.

What we collect

• Staff accounts: email address and password, stored by our authentication provider. Passwords are hashed, never kept in plain text.
• Clinic details: the clinic’s name, booking-link name, city, phone, address, time zone, booking rules, message language, practitioners’ names and titles, working hours, time off and services.
• Patient details: name and mobile number; when the patient is next due back and why (for example “six-month check-up”); and a short note the clinic may add, which must not be clinical.
• Appointments: the practitioner, service, time, status (booked, confirmed, cancelled, seen, no-show), how it was booked, and a short non-clinical note.
• Messages: a record of which WhatsApp messages were opened or sent for an appointment, and, when automatic sending is on, their delivery status and any error.
• Booking consent: patients who book online tick a box agreeing to receive messages about that appointment.

What we deliberately do not collect

Showup is for appointments and communication only. There is no place for diagnoses, symptoms, prescriptions, test results or other clinical information, and clinics must not put such information in the free-text notes. We are aware that even the fact that someone has an appointment at a clinic can reveal something about their health, and we treat patient records with that in mind.

How it is used

• To run the booking page, the schedule, reminders and recalls for the clinic.
• To send or prepare appointment messages: confirmations, reminders, cancellations and recalls. We never use patient data for marketing, and we never contact patients for our own purposes.
• To keep the service secure and working, and to contact clinic staff about their account or important changes.

Who else processes it

• Supabase hosts the database and handles sign-in.
• Our hosting provider serves the website and app.
• Meta (WhatsApp), only when a clinic turns on automatic sending through the WhatsApp Business API: the patient’s number and the message are sent to Meta to deliver it, under Meta’s own terms. Without automatic sending, messages open in the clinic’s own WhatsApp and are sent by the clinic.

These providers may store data outside Pakistan. We do not sell or rent personal data, and we disclose it to others only if the law requires it.

Patients’ booking links

After booking, a patient gets a private link containing a long random code. Anyone with that link can see the appointment’s time, the clinic and practitioner, the service and the patient’s first name, and can confirm or cancel it, so patients should share it only as they would an appointment card. The public booking page itself shows only free times, never who has booked them.

Security

Every record belongs to one clinic, and the database only lets that clinic’s staff read or change it (row-level security). Appointments are changed through checked database functions, connections are encrypted in transit, and only the clinic owner can change practitioners, hours, services and settings.

How long it is kept

We keep a clinic’s data while its account is active. A clinic can correct patient details at any time. When a clinic asks us to close its account, we delete its data, except anything we must keep by law.

Your choices and rights

• Patients: to see, correct or delete your details, or to stop receiving messages, contact the clinic you booked with. You can also cancel an appointment from your booking link or by replying 2 to a reminder.
• Clinic staff: contact us to access, export or delete your clinic’s data.

Website analytics

To see how Showup is used, we run DanixSoft’s own first-party, cookieless analytics. It is hosted by DanixSoft at admin.danixsoft.com and the data is stored in DanixSoft’s own database; no third-party analytics or advertising service is involved. It records:

• the pages visited (the codes in patients’ booking links are masked);
• the referring website and any UTM campaign tags in the link;
• approximate location (country, region and city), derived from the IP address by our hosting provider;
• browser, operating system and device type;
• clicks on links and buttons (on signed-in screens and on patients’ booking links, the button or link text is not recorded);
• conversion events such as sign-ups and bookings, recorded without any personal details;
• page-load speed measurements (Core Web Vitals), which are timing numbers only;
• time on page and how far down the page you scroll.

It does not use cookies or local storage, and it does not store IP addresses. Unique visitors are counted with a salted hash that rotates daily; the salt is deleted after a day, so the hash cannot be reversed or linked across days. This data is not sold or shared with advertisers.

Cookies and local storage

We use cookies that keep staff signed in and remember which clinic they are working in. Theme preference is kept in the browser’s local storage. We do not use advertising or tracking cookies, and our website analytics use no cookies or local storage. The public booking page does not need an account or cookies to book.

The law

We aim to handle data in line with the laws that apply to us and to clinics in Pakistan, including the Prevention of Electronic Crimes Act 2016. This policy describes our practices; it is not a certification, and clinics remain responsible for their own obligations to their patients.

Changes

If this policy changes in a way that matters, we will update the date above and tell clinic owners in the app or by email.

Contact

Questions about privacy: contact DanixSoft.