Calendo app privacy policy

1. Who operates the service

The controller for the platform data described below is the sole trader / ατομική επιχείρηση KONSTANTINOU KONSTANTINOS TOU IOANNI in Greece. This policy names the published Calendo Health, Calendo Dental, and Calendo Beauty products on the Organosi website (organosi.com.gr).

Postal address: Rodon 38 (Ρόδων 38), 59100 Veria (Βέροια), Greece.

Privacy and support email: hello@organosi.com.gr. Phone: +30 6949010227.

No data protection officer (DPO) has been appointed. For privacy matters, use the email above.

Public website: https://organosi.com.gr. Calendo Health: https://app.organosi.com.gr and the Calendo Health iOS and Android apps (bundle identifier gr.com.organosi.calendo). Calendo Dental: https://dental.organosi.com.gr and the Calendo Dental iOS and Android apps (bundle identifier gr.com.organosi.calendo.dental). Calendo Beauty: https://beauty.organosi.com.gr. This policy is published at https://organosi.com.gr/privacy/calendo (Greek) and https://organosi.com.gr/en/privacy/calendo (English). App-store listings referenced here are for Calendo Health.

2. What Calendo is

The Organosi website publishes four sibling products. Calendo Health is B2B software for children's therapy centres in Greece: appointment scheduling, calendar, staff roles, child records in a clinic context, and notifications.

Calendo Dental is B2B clinic operations software for dental practices: people and session scheduling for dental teams. It is the dental clinic scheduling product at https://dental.organosi.com.gr.

Calendo Beauty is B2B scheduling software for salons, spas, and beauty businesses. The published product origin is https://beauty.organosi.com.gr.

Calendo Clinic is B2B scheduling software for diagnostic centres and multi-site polyclinics. The published product origin is https://clinic.organosi.com.gr. The Calendo Clinic app is available for iPhone and Android. This policy does not publish a store bundle identifier for Calendo Clinic.

None of the four products is emergency medical care, emergency diagnosis, or a social network. In an emergency, contact appropriate emergency services.

3. Data that may be collected or processed

The following categories are processed in Calendo Health and, where a dental practice enters corresponding clinic fields, Calendo Dental. They are Health/Dental application processing, not Organosi website form processing. App Store privacy declarations referenced here are for Calendo Health:

• Account / login data: email, hashed password, role, permissions, account status, must-reset-password flags.
• Identifiers: account identifiers and, when Calendo Health notifications are enabled, device push tokens.
• Contact info: names, email addresses, and phone numbers the clinic enters for staff, parents, or other authorized users.
• Staff / therapist profile data: profile names, roles, clinic-entered contact details, availability where applicable.
• Child / minor clinic records: names and related operational or health-adjacent fields entered by authorized clinic users (not for public or social use).
• Appointments / calendar / attendance: times, status, type, procedure, therapist name, child linkage, cancel/attendance actions where permitted.
• Photos and documents: in Calendo Dental (and wherever this feature is enabled), authorized clinic staff may optionally upload clinical photos (taken with the device camera or chosen from the photo library) and documents to a patient's record. The camera or photo library is opened only when the user chooses to add a photo, subject to the permissions granted on the device. These files are stored on our servers as part of the clinic's records, transmitted encrypted (HTTPS), processed only to provide the service to the clinic, not shared with third parties for advertising, and deleted together with the patient record or on the clinic's request.
• Calendo Health notifications: in-app inbox messages; device tokens for delivery when permission is granted.
• Calendo Health technical logs / security events: IP addresses where needed for security, access-control events, rate limits, session events.
• Billing / subscription: details needed for invoices, accounting, and account activation.
• Support communications: what you voluntarily send for support or privacy requests.
• Marketing-site data: what is described in the /privacy policy (forms and optional first-party analytics with consent).

4. Sensitive / health-adjacent data

Because Calendo Health is used by therapy centers, clinics may enter information relating to children/minors and therapy or appointment operations, including data that may be special-category data (GDPR Article 9) or health-adjacent.

Calendo Dental is used by dental practices for clinic operations. The categories each dental clinic enters depend on its own use of the service.

Calendo Beauty is identified as a published salon scheduling product at https://beauty.organosi.com.gr.

On Calendo Clinic (iPhone and Android) we process the following on the clinic's behalf. The clinic is the data controller. There is no advertising or analytics SDK and no advertising ID. Nothing is sold or shared.

We process that Health and Dental data as a processor on the customer’s instructions. The clinic is the controller toward families and staff and is responsible for Article 9 legal bases and parental authority where those apply. We do not use that data for advertising.

• Staff: name, email, user ID, and optional phone.
• Patient: name, phone, and date of birth.
• Appointment, exam, and preparation notes, plus attendance (health data).
• Optional clinical photos attached by staff.
• Patient balances and receipts/invoices shown to staff.
• In-app interactions.
• Diagnostics: the reason a sign-in failed, and the app version.
• The push notification token.

5. Purposes

For Calendo Health and Calendo Dental clinic operations, data is processed for:

• Providing the SaaS service to the clinic customer and managing user accounts
• Clinic operations and appointment scheduling
• Security, access control, and abuse prevention
• Calendo Health notifications (when enabled)
• Customer support and privacy requests
• Billing, accounting, and legal compliance

6. GDPR roles

Processor: for clinic-held records in Calendo Health and, where corresponding fields are entered, Calendo Dental (children, appointments, clinic staff profiles the clinic enters). The clinic is the controller toward families and staff. Deletion of those records goes through the clinic. A data processing agreement (DPA) is available on request at hello@organosi.com.gr.

Controller: for platform accounts we issue, billing/subscription, support tickets sent to us, Calendo Health platform security logs, and marketing-site data.

7. Legal bases (controller processing)

When we act as controller for Calendo Health, documented Dental operations, and the public website, the legal bases are:

• GDPR Art. 6(1)(b) contract — providing the SaaS to the clinic customer and operating user accounts.
• GDPR Art. 6(1)(f) legitimate interests — security, abuse prevention, and limited first-party product analytics on the marketing site only, with the existing consent banner where required.
• GDPR Art. 6(1)(c) legal obligation — tax/accounting and responding to lawful requests.
• GDPR Art. 6(1)(a) consent — optional Calendo Health device push notifications and optional marketing-site analytics.
• Special-category / children’s data: processed as processor on the Health or Dental clinic’s instructions. The clinic is responsible for Art. 9 and parental authority. We do not use that data for ads.

8. Children and minors

In Calendo Health, children do not self-sign-up. Clinic staff and parents receive accounts from the clinic. Children’s data is entered and managed by authorized clinic-customer users for center operations.

Calendo Health is not a social network and is not directed at children for self-signup. We do not ask children to create a consumer account through the public marketing website.

9. Sharing and processors

We use service providers only as needed to operate the documented platform. The current processors / subprocessors named here are:

• Render — Calendo Health app / API hosting (app.organosi.com.gr).
• Vercel — hosting for the public marketing site organosi.com.gr.
• Cloudflare Turnstile — Calendo Health login bot protection.
• Apple — Calendo Health App Store distribution, and Apple Push Notification service (APNs) for iOS notifications when permission is granted.
• Google — Google push services (FCM) for Android notifications when enabled. The Calendo app is available for iPhone on the App Store and for Android at organosi.com.gr/install.
• Expo / EAS — building and delivering the Calendo Health mobile apps.
• Optional first-party analytics on the marketing site, only after consent in the existing preferences banner (see /privacy and /cookies).

10. No sale of data, advertising, or cross-app tracking

We do not sell personal data. We do not use third-party advertising SDKs. We do not engage in cross-app tracking. We do not use Health or Dental clinic or children’s data for advertising profiles.

11. International transfers

Some Calendo Health application and public-website providers (Apple, Google, and, as applicable, Vercel, Render, or Cloudflare) may process data in the United States or outside the EEA. Where required, we rely on standard contractual clauses (SCCs) or equivalent safeguards under applicable law.

12. Retention

Calendo Health platform data we control is retained while the clinic subscription or account lasts. After that ends, that platform data is deleted or anonymized within 30 days, unless law requires longer retention (for example security logs or invoices).

Health and Dental clinic-held records follow the clinic’s instructions. See section 16 for the Calendo Health account-deletion path.

13. Your rights and how to exercise them

Where GDPR applies, you may request access, correction, deletion, restriction, objection, portability, and withdraw consent where processing is based on consent.

How to exercise rights: email hello@organosi.com.gr. We may need to verify the requester’s identity. Requests about Health or Dental clinic-held records (children, appointments, clinic-entered profiles) must go to the clinic; we route them there when needed.

For deletion of Calendo Health account or platform data we control, the completion target is 30 days; see section 16.

You have the right to lodge a complaint with the Hellenic Data Protection Authority (ΑΠΔΠΧ), https://www.dpa.gr. Users in other EU member states may also contact their local supervisory authority.

14. Security

For Calendo Health we apply measures such as role-based access control, HTTPS in transit, secure token storage on mobile where supported, audit logging, and least privilege. We do not claim ISO, SOC 2, or similar certifications.

Report security incidents to hello@organosi.com.gr. When we act as processor for Health or Dental, we notify the clinic customer.

15. Push notifications

On Calendo Health mobile apps, device tokens are used for notification delivery only when the user has granted permission on the device. Lock-screen content should be generic; appointment details or child names must not appear on the lock screen by default product policy. You can turn notifications off in the device settings.

16. Data deletion (30-day target)

For deletion of Calendo Health account or platform data we manage as the service provider (for example login accounts, platform security logs, and support messages sent to us), email hello@organosi.com.gr. We aim to complete the request within 30 days after we can confirm the requester, unless law, security, or an outstanding dispute requires longer retention.

Deletion requests for child records, appointments, or other Health or Dental clinic-held records must go through the clinic customer. We do not delete clinic-held records on a third-party request without the clinic customer's process.

On Calendo Clinic, deletion is in the app under Settings > Delete account, with password confirmation. It anonymises the staff account, ends sessions, and removes push tokens. Or email hello@organosi.com.gr. We aim to complete the request within 30 days after we can confirm the requester, unless law, security, or an outstanding dispute requires longer retention. Patient records stay with the clinic, which is the data controller.

17. Cookies and the public website

The public marketing website has a separate privacy and cookies policy at /privacy and /cookies, including the consent banner for optional first-party analytics. This page covers Calendo Health application processing and documented Calendo Dental clinic operations. Calendo Beauty is named as a published product at https://beauty.organosi.com.gr.

18. Policy changes

If we change this policy, we update the “Last updated” date at the bottom of this page. The current version is always the one published here.

19. Contact

Privacy and support: hello@organosi.com.gr

Phone: +30 6949010227

Address: Rodon 38 (Ρόδων 38), 59100 Veria (Βέροια), Greece