Privacy Policy

Last updated: September 25, 2026

Introduction

PelaSync ("we," "us," or "our") operates PelaSync, an SMS-based journaling service available at pelasync.co. This Privacy Policy describes how we collect, use, protect, and handle your information when you use our service.

Information We Collect

We collect the following information through our service:

• Phone numbers (in E.164 format) used to send and receive SMS messages
• Text message content submitted as journal entries
• Consent status and records (opt-in and opt-out history)
• Provider association data linking clients to their providers
• Timestamps of messages and interactions

How We Use Your Information

Your information is used to:

• Receive and store your journal entries via SMS
• Generate reports for your associated provider(s)
• Manage your consent preferences
• Improve and maintain the service

Information Sharing

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

How We Protect Your Data

We take the security of your data seriously:

• All message content is encrypted at rest using AES-256-GCM encryption
• All data in transit is protected via HTTPS
• Access to your journal entries is restricted to your associated provider(s)
• Authentication is enforced on all provider-facing endpoints
• All significant actions are recorded in an audit log

Data Retention

Journal entries are retained for as long as the client remains enrolled with their provider. Entries are deleted when a client is removed from the platform by their provider, or upon written request. Messages from unrecognized numbers (which are not tied to an enrolled client) are stored separately and retained for operational and troubleshooting purposes only.

SMS Messaging and Consent

Initial consent to receive and send SMS messages through PelaSync is granted exclusively through the online Enrollment Page. You may enroll in one of two ways:

• Through a provider-supplied enrollment link, which pre-associates your account with that provider.
• Through open enrollment, by submitting your name and phone number without an enrollment code.

In both cases, the form includes an SMS consent disclosure and a checkbox that must be actively selected by the client. The checkbox is unchecked by default. Providers do not complete opt-in on behalf of clients. Message frequency varies based on your usage. Message and data rates may apply. Consent is not a condition of receiving care.

How to Opt Out

You may opt out of the PelaSync SMS service at any time by texting STOP to the number you received messages from. Your consent will be immediately revoked and you will receive no further messages. To re-enroll, you may revisit the Enrollment Page at any time, or contact your provider's office for an enrollment link.

Google Calendar Connection (Practitioners Only)

Practitioners may optionally connect their own Google Calendar so that PelaSync can offer clients appointment times that are genuinely open and place booked appointments onto the calendar the practitioner already uses. This connection is optional, is available only to practitioners, and is never requested of clients. PelaSync never asks anyone for their Google password — access is granted through Google's own consent screen and can be withdrawn at any time.

What we read: free/busy information only — the time ranges in which the practitioner is already busy. We do not read the titles, descriptions, attendees, locations, or contents of existing calendar events.

What we write: a single de-identified event for each booked appointment, containing the client's first initial and last name (for example, "R. Gibson") along with the date, time, and duration. We do not write journal entries, clinical notes, phone numbers, email addresses, or any other client details into the event, and we do not add the client as an attendee.

What we change: when an appointment is cancelled or moved, we update or delete that same event. We do not modify or delete any other event on the calendar.

What we store: the authorization token that allows this access, encrypted at rest using AES-256-GCM, along with the connected account's email address and the identifier of the chosen calendar. We do not store copies of the practitioner's calendar contents.

Information received from Google is used only to provide the scheduling features described above. It is never sold, never used for advertising, and never used to train generalized artificial intelligence or machine learning models. It is not transferred to others except as necessary to provide these features, to comply with applicable law, or with the practitioner's explicit consent. Human access is limited to what is needed for security, to investigate abuse or a suspected violation, to comply with law, or where the practitioner has given explicit consent. PelaSync's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

A practitioner can disconnect at any time from the Settings page in PelaSync, which revokes our access with Google and deletes the stored token. Access can also be withdrawn directly at myaccount.google.com/permissions. After disconnecting, PelaSync stops reading availability and stops creating or changing events; appointments already written to the calendar remain there for the practitioner to manage.

HIPAA Considerations

PelaSync is designed to support HIPAA-compliant workflows. Healthcare providers using our service are responsible for maintaining their own HIPAA compliance, including executing a Business Associate Agreement (BAA) where applicable. Please note that standard SMS is not inherently a secure communication channel, and clients consent to this when opting in to the service.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will take effect upon posting to this page. We encourage you to review this policy periodically.

Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

PelaSync
Email: support@pelasync.co