Last updated October 2026
When you book an appointment or complete your intake form, we collect your full name, email address, phone number, date of birth, and your responses to health intake questions. As your care continues we also hold what you add through AyurNote — check-in responses, messages and photos you send your practitioner, and the name you type to sign a waiver with the time and IP address you signed it from — along with the notes, protocols, appointment history, and files your practitioner adds to your record. We also keep a record of what you pay: amounts, refunds, and Stripe's reference for each payment, never your card number. A payment that fails is recorded too, with the reason the card was declined. When you submit the public booking form we also record the IP address the request came from.
Most of it is what your Ayurvedic practitioner needs to provide care — scheduling appointments, maintaining your health record, and tracking your progress over time. The rest is what it takes to run the service around that care: a payment record so what you were charged can be reconciled, the name, time and IP address on a waiver signature so the signature holds up, and the IP address behind a booking request so that no one network can flood a practitioner with fake bookings. We do not use your information for anything else.
Your data is stored on Supabase and hosted on Vercel, both of which encrypt data at rest and in transit. Inside AyurNote, access is restricted to you and your provider.
Your information is never sold, and we do not use it for advertising or analytics. Inside AyurNote, the only person who can see your health record is your own practitioner. Running AyurNote does mean your information passes through the companies we use to operate it: Supabase stores it, Vercel hosts the app, Stripe processes payments and receives your email address for receipts, and Resend delivers the emails AyurNote sends to you and your practitioner, which carry names, email addresses, and the appointment or payment details each email is about. Messages and protocols are never emailed; the email links to AyurNote instead. Your card number and security code go straight to Stripe and never reach us; a saved card appears in AyurNote only as its brand and last four digits. Those four handle your information on AyurNote's behalf and may not use it for their own purposes. Two more come in when your practitioner sets them up: a connected calendar receives the time, length, and type of an appointment — not your name and not your health record — and a virtual session runs on Zoom, which receives the same appointment time and length, plus your name and whatever you share in the meeting itself. Those two operate under their own terms, which we don't control.
AyurNote does not currently offer a way to delete a client record, and your practitioner cannot remove one from the system. If you want your information removed, contact your practitioner — they are the custodian of your record and can tell you what they are able to do.
AyurNote is not offered to practitioners who are covered by HIPAA — those who bill health insurance electronically — and we have not signed HIPAA business associate agreements. Your health information is still treated as private and sensitive.
Reach out to your practitioner if you have any questions about how your information is used.