Privacy policy

GenNotify is operated from New Zealand. We provide an automated patient communications service for healthcare clinics using Gensolve practice management software. Contact us at hello@gennotify.co.nz.

• Clinic information: name, timezone, branding preferences, and notification settings.
• User accounts: name and email of clinic administrators.
• PMS credentials: encrypted at rest, never stored in plaintext.
• Appointment data: retrieved from your PMS to generate emails. Patient name, email, appointment time, and clinician are retained for each communication sent, so your dashboard can show delivery history, let you search and resend past communications, and alert you if a patient's email is undeliverable.

GenNotify connects to your practice management system to detect appointment changes. Patient details (name, email, appointment time, clinician) are used to generate branded emails, which are delivered via a trusted transactional email provider with TLS encryption. This information is retained for as long as your account is active, so you can view communication history, search past sends, resend a communication if needed, and be alerted if a delivery fails. We do not separately store clinical or medical details beyond what's needed to identify the appointment and generate the email.

When a patient submits an intake form, GenNotify validates the submission, matches it to an existing patient in your PMS, and syncs the data back. The complete submission, including medical history and consent responses, is retained for audit purposes and to support manual review where a patient match is ambiguous.

Appointment tracking records and clinic data are retained while your account is active. You can request deletion of all your data at any time by emailing hello@gennotify.co.nz or by deleting your account in the app settings.

We use the following third-party providers to deliver the service. These providers are selected for their security practices and appropriate data handling. We do not sell or share your data with third parties for marketing purposes.

• Postmark (Wildbit LLC) - transactional email delivery.
• Stripe - payment processing for your subscription. Stripe does not receive patient information.
• Hetzner Online GmbH - infrastructure hosting (EU, Germany).
• Cloudflare - DNS for our website and application domains.
• Gensolve - your own practice management system. Not a GenNotify subprocessor: we connect to it using credentials you provide, under your existing agreement with Gensolve.

See our Data Processing Agreement for more detail on how each provider is used, and how we'll notify you of any changes.

We use functional session cookies only (login and CSRF protection). We do not use tracking cookies, advertising pixels, or third-party analytics cookies.

We comply with the New Zealand Privacy Act 2020 and the Health Information Privacy Code 2020 (HIPC).

You have the right to access, correct, or delete the personal information we hold about you. You can also lodge a complaint with the NZ Privacy Commissioner. Email hello@gennotify.co.nz to exercise any of these rights.

We use encryption in transit (TLS) and at rest for sensitive data. PMS credentials are encrypted and only decrypted at the point of use. Access is restricted to authorised systems.

We may update this policy from time to time. Material changes will be notified via email. For any questions about this policy or your data, contact hello@gennotify.co.nz.