Privacy Notice

Effective November 5, 2026.

Daobook is practice-management software for Traditional Chinese Medicine practitioners, operated by Emba Digital Pty Ltd (ACN 683 319 486; ABN 89 683 319 486) of 14 Christmas Street, Northcote VIC 3070, Australia, for United States customers at daobook.health. This notice explains what personal information we collect from the people who use or visit Daobook, how we use it, who receives it, and the choices and rights you have. If you have a question we do not answer here, write to privacy@daobook.health.

1. Who this notice is for

• Practitioners and clinic staff who hold a Daobook account.
• Visitors to daobook.health, and to the public booking, intake-form and record-copy pages a clinic chooses to expose through Daobook.
• People who contact us about Daobook, by email, a form, or a trial sign-up.

2. If you are a patient of a clinic that uses Daobook

Your clinic is the one that holds your health record. Daobook stores and processes it on the clinic's behalf as a business associate under the Health Insurance Portability and Accountability Act (HIPAA), bound by a business associate agreement with the clinic, and in Texas and California by those states' health-privacy laws directly. We use your information only to run the practice-management features your clinic uses. We do not use it for our own marketing, we do not profile you, we do not sell it, and we do not use it to train artificial intelligence.

What that means for you:

• Your clinic's Notice of Privacy Practices describes how your health information is used and shared, and your rights over it.
• To see, copy, correct or restrict your record, or to ask who it has been disclosed to, ask your clinic. Daobook gives clinics the tools to answer within the law's time limits; a clinic can send you a secure link to a copy of your record from Daobook, and that page asks for your date of birth before it opens.
• If your clinic sends you appointment reminders or other messages through Daobook, it is the clinic sending them. Reply STOP to any text to stop texts from that clinic, or tell the clinic how you would rather be contacted; Daobook honours that choice in everything it sends for the clinic.
• If a breach of your health information ever involved Daobook, your clinic would notify you, with our help, within the time the law sets.

The rest of this notice is about information that is ours, not your clinic's.

3. What we collect

From practitioners and clinic staff, when you create and use an account

• Identifiers: name, email address, phone number, the clinic you belong to, your account's user id.
• Professional information: profession, credentials, state licence number, and the qualifications you choose to show on your booking page.
• Account credentials: your password, stored only as a bcrypt hash; two-step sign-in secrets and passkeys, stored encrypted. We cannot read your password.
• Commercial information: your subscription plan, invoices, and the payment method you give Stripe, which processes it for us; we hold the last four digits and the card's expiry, never the number.
• Your communications with us: support requests and their contents, and your email preferences.
• Internet and device activity: IP address, browser and device type, the pages and actions you use in Daobook, and when you sign in. Daobook keeps a record of who opened which patient record, which your clinic's owner can see; it exists for the patients' protection and the law requires it.

From visitors, automatically

• Standard server logs: IP address, user agent, the pages requested and when. Kept seven days.
• Cookies and local storage, described in section 6.

From people who contact us

• What you send us: your name, email address, clinic name, and your message.

What we do not collect. Social Security numbers, government ids, financial account numbers (Stripe holds the card), precise geolocation, biometric identifiers, or information about race, religion, sexual orientation or union membership. We do not buy information about you from data brokers, and we do not collect it from social media.

4. How we use it

Purpose	What for
To provide Daobook	Creating and securing your account, the features you turn on, the clinic's billing, SMS and email credits
To bill you	Subscription charges, usage-based add-ons such as text messages, receipts, and tax records
To support you	Answering your requests, telling you about problems that affect your service, and the "Ask AI" help, which answers from Daobook's own help text
To keep Daobook safe	Sign-in protection, rate limits, fraud and abuse detection, audit records, and investigating incidents
To improve Daobook	Aggregate, de-identified usage: which features are used and how often. Never patient data, never individual profiling
To tell you about Daobook	Product updates and educational emails, only if you opted in, each with an unsubscribe link honoured within ten business days
To meet legal obligations	Tax, accounting, responding to lawful requests, and our duties as a business associate

We do not sell personal information and we do not share it for cross-context behavioural advertising, as California law defines those words. We make no decisions about you by automated means that have legal or similarly significant effects.

5. Who receives it

Some processing is done for us by service providers under written contracts that limit what they may do with the information. For the US service they are:

Provider	What it does for us	Where
Amazon Web Services	Hosting, database, file storage, backups, email delivery, text messages on behalf of clinics, and, for the AI Scribe, speech-to-text (Amazon Transcribe)	United States (Oregon)
Anthropic	Artificial-intelligence features a practitioner starts, such as drafting a note from a transcript or a letter; for patient information this runs under a business associate agreement	United States
Stripe	Subscription billing and, for clinics that connect their own Stripe account, the clinic's card payments; Stripe receives payment details, never health information	United States
Sentry	Error monitoring: the error, the page, and your account id, with form contents and cookies removed before they leave our servers	United States
Slack	Internal alerts to the Daobook team about sign-ups, urgent support requests and system failures, carrying record ids and links only	United States
Google or Microsoft	Only when a practitioner connects their own calendar; appointment times go to that calendar, and patient identifiers only when the clinic's own account is covered by that vendor's business associate agreement	United States
Zoho Mail	Our own mailboxes: what you write to us at privacy@daobook.health or to support is held there	Australia

We may also disclose personal information: with your consent, including any integration you connect yourself; through the Daobook API to software your clinic authorises; when the law requires it, such as a subpoena or a lawful request from a regulator; to protect the rights, safety or property of Daobook, our customers or others; and to a successor if Emba Digital is sold or restructured, bound by terms no less protective than these.

In the preceding twelve months we have disclosed, for the business purposes above, the categories in section 3 to the providers in this section. We have sold or shared none.

6. Cookies and tracking

Daobook sets only what it needs to work: a session cookie that keeps you signed in (HttpOnly, Secure, SameSite=Lax, expiring after two weeks of inactivity or sooner where your clinic sets an idle sign-out), a token that protects forms from forgery, and small preferences stored in your browser that never leave it. On pages where you enter card details, Stripe's script sets its own fraud-prevention cookies.

We do not use Google Analytics, Google Tag Manager, Meta Pixel, session replay, advertising networks or any similar tracking tool, on our website, in the application, or on the booking and intake pages clinics expose through Daobook. No third party collects information about you over time and across other sites through Daobook. Because we do not track, there is nothing for a browser's Do Not Track or Global Privacy Control signal to switch off; we treat such a signal as a request not to be tracked, which is already the case.

7. Text messages

Daobook sends two kinds of text message. To practitioners and staff: sign-in codes when you choose text as your second step, and service notices you ask for. To patients, on behalf of their clinic: appointment reminders, confirmations, intake-form links, waiting-list offers and replies to the patient's own texts, using the number the patient gave the clinic; each clinic text names the clinic and says that replying STOP stops them, and a clinic's marketing texts go only to patients who gave the clinic written consent.

Consent to receive texts is always optional and never pre-ticked. Message frequency varies with your clinic's settings; message and data rates may apply; reply HELP for help and STOP to cancel. All the above categories exclude text messaging originator opt-in data and consent; this information won't be shared with any third parties.

8. How we protect it

Daobook's US service runs in Amazon Web Services in the United States, and your information, including backups, does not leave the country. Data is encrypted in transit (TLS 1.2 or better) and at rest; the database, cache and file storage sit on private networks; two-step sign-in is required for every US account; accounts lock after repeated wrong codes; and access to patient records is logged. Our staff reach your clinic's records only when the clinic opens support access, for a limited time, and every such view is recorded. For a clinic in California, visits a practitioner marks as being about contraception, abortion or gender-affirming care are kept apart in the record: they open only to the people the clinic has authorised, only from inside California, and every opening is logged (Civil Code 56.101(c)); the service providers above process them under their contracts, as the Act permits, and the restriction is on the people and recipients who may see them. Backups are kept in an immutable vault and restores are rehearsed. No system is impenetrable: if a security incident affects your personal information, we will tell you and, where the law requires, the authorities, within the time the law sets.

9. Your rights and choices

Whatever state you live in, you can ask us to:

• tell you what personal information we hold about you, where it came from, why we use it and who we have disclosed it to;
• give you a copy in a portable form (Daobook exports your clinic's data as spreadsheets and documents at any time);
• correct information that is wrong;
• delete your personal information, subject to what we must keep for tax, accounting, security or our legal duties as a business associate (a clinic's patient records are the clinic's to delete, through its own retention settings);
• stop marketing emails, through the link in any such email or by writing to us;
• limit the use of sensitive information: the only sensitive information we hold is your sign-in credentials, used solely to sign you in.

We will not discriminate against you for exercising a right. To make a request, email privacy@daobook.health from the address on your account, or write to the address in section 12; we verify requests through your account and may ask for more if we cannot. We answer within 45 days, and will tell you if we need 45 more. An authorised agent may act for you with your written permission. California residents may also ask once a year whether we have disclosed personal information to third parties for their own direct marketing (Civ. Code 1798.83): we have not and do not.

Residents of other states with privacy laws (such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Washington) have the same rights with us, whether or not those laws yet apply to a company of our size. Where a clinic is the controller of its own patients' information under Washington's My Health My Data Act or Nevada's consumer health data law, we act as its processor under written terms.

10. How long we keep it

• Active accounts: for as long as the account is active.
• Trial accounts that never subscribe: permanently deleted 60 days after the trial ends; the date is shown during the trial and the owner is emailed seven days before.
• After cancellation: thirty days of read-only access to export everything, then about three months' retention (which the clinic may extend by paid retention), then deletion within thirty days of that period's end, confirmed to the clinic in writing. That is the clinic's time to export its records and meet its own state's record-retention rule, which for patient records runs from five years (Texas, Florida) to six years and longer for minors (New York).
• Billing and tax records: for the period tax law requires.
• Server logs and error data: seven and ninety days.
• De-identified usage data: may be kept for product analytics.

When information reaches the end of its life it is deleted from our live systems; backups expire on their own schedule and are never restored except to recover from a disaster, in which case deletions are reapplied.

11. Children

Daobook accounts are for adults. We do not knowingly collect personal information from anyone under 13 for our own purposes; if we learn we have, we delete it. Clinics treat children, and a child's record is held in the clinic's record with the same protections as any other patient's; a parent's or guardian's access to it is governed by the clinic and by state law.

12. Changes, and how to reach us

We will update this notice as Daobook and the law change, and the date at the top will say when. A material change will be announced in the application before it takes effect.

Emba Digital Pty Ltd, trading as Daobook 14 Christmas Street, Northcote VIC 3070, Australia privacy@daobook.health

A clinic's own handling of your health record is governed by its Notice of Privacy Practices and by the Business Associate Agreement it accepted with Daobook; the subcontractors that handle protected health information for Daobook are on the trust page.