Privacy Policy
1. Who we are
ClokFox LLC ("ClokFox", "we", "us") provides ClokFox, a client scheduling, intake and cancellation management platform with voice and text message wait list offers and document management, at app.clokfox.com, and this website at clokfox.com. ClokFox is based in the United States.
2. Businesses and their clients
Our customers are businesses (for example dental practices, spas and accounting firms) that use ClokFox to run their appointments. Each business decides what information it enters into ClokFox about its own clients and staff. For that information, ClokFox acts on the business's behalf as its service provider, and the business's own privacy notice also applies. If you are a client of a business that uses ClokFox, you can ask that business, or us, about your information.
3. Information we collect
- Account information for business staff: name, work email, role, sign in records and security settings such as multi factor authentication.
- Client information entered by a business: name, contact details, appointments, wait list preferences, intake answers, documents and signatures.
- Communication records: text messages, calls and emails ClokFox sends or receives for a business, and each client's consent to texts, calls and email, with the wording shown and the time given.
- Calendar information from a staff member's connected Google or Microsoft calendar, as described in sections 6 and 7.
- Technical information: IP address, browser and device type, and security and error logs, used to run and protect the service.
4. How we use information
We use information only to provide ClokFox to the business that entered it: to book and manage appointments, send reminders and wait list offers, run intake and document workflows, connect staff calendars, provide support, keep the service secure, and meet legal obligations. We do not sell personal information, and we do not use it for advertising.
5. Text messages and calls
A business can send appointment reminders, wait list offers and appointment updates by text message or automated call, only to clients who agreed to receive them. Message frequency varies with a client's appointments. Message and data rates may apply. A client can reply STOP to opt out of texts from that business, START to opt back in, and HELP for help. Mobile phone numbers and text message consent are not shared with third parties or affiliates for marketing or promotional purposes.
For health businesses, texts and calls do not name the service unless the business has chosen to, and never carry clinical detail. Services a business marks as health sensitive are never named.
6. Google user data
A staff member can connect their own Google Calendar to ClokFox. ClokFox asks only for the permissions below, uses them only for the purpose shown, and only for the staff member who connected.
| Permission | What ClokFox accesses | Why |
|---|---|---|
openid and email | The email address of the connected Google account. | To show the staff member which Google account is connected. |
calendar.freebusy | The start and end times of busy periods on the staff member's primary calendar. ClokFox does not receive event titles, descriptions, locations or attendees through this permission. | So ClokFox never books a client into a time the staff member is already busy. |
calendar.events | ClokFox creates, updates and deletes calendar events for the appointments booked in ClokFox, on the staff member's primary calendar. An event contains the appointment title, start and end time, and, where the business uses them, the location, a meeting link and the client's email address as an attendee. For health businesses the title does not name the service unless the business has chosen to. ClokFox does not read, change or delete any event it did not create. | So the staff member's calendar stays correct when a client books, moves or cancels. |
How Google user data is stored and protected
The access and refresh tokens Google issues are encrypted before they are stored. Busy periods are stored only as start and end times, and are refreshed regularly. ClokFox keeps the identifier of each event it created so it can update or remove that event later.
Sharing of Google user data
Google user data is used only to provide the calendar features above to the staff member and their business. It is not sold, not used for advertising, not used to train artificial intelligence or machine learning models, and not transferred to anyone else except as needed to provide these features, to comply with law, or as part of a merger or sale of ClokFox with notice to you. No person at ClokFox reads Google user data unless the staff member asks us to for support, it is needed for security, or the law requires it.
Disconnecting and deletion
A staff member can disconnect their Google Calendar at any time in ClokFox, under Scheduling settings, Staff calendars. Disconnecting deletes the stored tokens and imported busy times. Events ClokFox already created stay on the calendar until the staff member deletes them. Access can also be removed at myaccount.google.com/permissions.
7. Microsoft 365 data
A staff member can connect their own Microsoft 365 (Outlook) calendar. ClokFox asks only for these delegated permissions, which act for the staff member who connected and no one else:
| Permission | What ClokFox accesses | Why |
|---|---|---|
User.Read | The staff member's name and email address. | To show which Microsoft account is connected. |
Calendars.ReadWrite | The free and busy status of time periods on the staff member's calendar (busy, tentative and out of office times only). ClokFox creates, updates and deletes events for appointments booked in ClokFox, with the same contents as for Google above. ClokFox does not read the contents of events it did not create. | To avoid double booking and keep the calendar correct. |
OnlineMeetings.ReadWrite | ClokFox creates a Microsoft Teams meeting link for an appointment when the business uses online meetings. | So a client receives a meeting link with their appointment. |
offline_access | A refresh token, so the connection keeps working without the staff member signing in again. | To keep busy times and events current. |
Tokens are encrypted before they are stored. Disconnecting in ClokFox deletes them and the imported busy times. Access can also be removed at myapps.microsoft.com. Microsoft data is not sold, not used for advertising and not used to train artificial intelligence or machine learning models.
8. Google Limited Use
ClokFox's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
9. How information is shared
We share information only with service providers that help us run ClokFox, under contracts that limit their use of it to providing their service to us:
- Amazon Web Services: hosting, storage, document text recognition and malware scanning.
- Microsoft 365: sending email from clokfox.com.
- Twilio: sending and receiving text messages and calls for a business.
- Google and Microsoft: calendar features, only for staff who connect a calendar.
- A payment processor, for business subscriptions, and an error monitoring provider, for diagnosing faults.
We may also disclose information when required by law or valid legal process, to protect the rights and safety of users or the public, or as part of a merger or sale of ClokFox, with notice. We do not sell personal information.
10. Security
ClokFox keeps each business's records separate at the database level, encrypts data in transit and at rest, encrypts stored calendar tokens, requires multi factor authentication for business staff accounts, scans uploaded documents for malware, and keeps audit logs of sensitive actions. No system is perfectly secure, and ClokFox does not claim any certification or independent attestation.
11. Retention and deletion
We keep information for as long as the business that entered it keeps its ClokFox account, and afterwards only as long as needed for security, legal and record keeping requirements. When a business closes its account, its records are deleted under our retention schedule. Calendar data is deleted as described in sections 6 and 7.
12. Your choices and rights
Depending on where you live, you may have the right to ask for access to, correction of, a copy of, or deletion of your personal information. Clients of a business can make these requests to the business or to us, and we will work with the business to answer. Staff can disconnect a calendar at any time, and clients can opt out of texts by replying STOP. Send requests to support@clokfox.com.
13. Health information
Some businesses that use ClokFox are health care providers. A business that is subject to HIPAA should contact us about a business associate agreement before entering protected health information.
14. This website
The clokfox.com website does not use cookies, analytics or advertising trackers. Our hosting provider, Cloudflare, processes visitors' IP addresses to deliver and protect the site. The ClokFox app at app.clokfox.com uses only the cookies needed to sign you in and keep your session secure.
15. Children
ClokFox is a business service and is not directed to children. Staff accounts are for adults. Information about a minor who is a client is entered and controlled by the business that serves them.
16. Changes and contact
We will post any change to this policy on this page and update the date above. For material changes, we will also notify businesses by email or in ClokFox.
Questions or requests: support@clokfox.com. Postal address: ClokFox LLC, address to be added before this policy is final.