Clinic Logo

Privacy Policy

Last updated: 26 October 2026

1. Who We Are

MyClinicBooking is an online platform for booking appointments with clinics, pharmacies and doctors in Malta. It is operated by Maja Vella, 29, Triq Alessandru, Birzebbuga BBG 2303, Malta (VAT number MT25516128) ("we", "our", "us").

This Privacy Policy explains what personal data we process when you use our website https://myclinicbooking.com, the booking widget that clinics embed on their own websites, and our related services (together, the "platform"), why we process it, and what rights you have. For any privacy question or request, write to info@myclinicbooking.com.

2. Our Role and the Clinic’s Role

Under the EU General Data Protection Regulation (GDPR) and the Maltese Data Protection Act (Cap. 586), the party that decides why and how personal data is used is the "controller". On this platform there are two:

  • We are the controller for your user account (your profile, sign-in, saved payment cards, booking history across clinics), for no-show fee payments and account blocking, for clinic subscriptions and billing, and for the security and operation of the platform.
  • The clinic you book with is the controller for the appointment information it receives and manages: the booking itself, your attendance, notes, and any details the clinic enters for walk-in or phone bookings. We process that information on the clinic’s behalf under a Data Processing Agreement.

Clinics keep their medical records outside the platform. We do not hold clinical records, diagnoses or treatment notes.

3. What Personal Data We Collect

Patients

  • Account details: full name, email address, mobile number, preferred language and, if you add one, a profile picture.
  • If you sign in with Google: your name, email address and Google account identifier. We do not receive your Google password.
  • If you connect Google Calendar: an access token that lets us add your bookings to your calendar. We only request this when you choose to add an appointment to Google Calendar.
  • Bookings: the clinic, doctor, speciality, room, date and time, booking status, any note you write when booking, your reminder choices, and the history of changes (for example cancelled, rescheduled, attended or not attended, with any reason given).
  • Payments: if a clinic charges no-show fees, you save a payment card through our payment provider Stripe. We store only the card brand, last four digits and expiry date; the full card number is held by Stripe. We also keep a record of any fee charged and its outcome.
  • Communications: messages you send us, for example through the contact form or by email.

Clinics, clinic administrators and doctors

  • Clinic details: name, address and location, contact email, photos and description, opening schedules and rooms.
  • Administrator and doctor details: full name, email address, phone number, profile picture and, for doctors, specialities and working schedules.
  • Billing details: company name, contact person, billing address and email, VAT and registration numbers, subscription and SMS credit records, and invoices. Card payments are processed by Stripe.

Collected automatically

  • Technical data needed to run and protect the platform, such as your IP address, browser type and the pages requested. This appears in our server logs.
  • Cookies that are strictly necessary for signing in, security and remembering your language. We do not use analytics or advertising cookies. See our Cookie Policy.
  • Your location, only if you allow your browser to share it, to show clinics near you on the map. It is used for the search and is not saved to your account.

From others

  • A clinic may enter your name, email address and phone number when it books an appointment for you (for example a walk-in or a phone booking).
  • Google (when you use Google sign-in or Calendar) and Stripe (payment status) send us the information described above.

Google user data

  • Google sign-in gives us only your name, email address and Google account identifier, which we use to create and sign in to your account.
  • Google Calendar access is separate and optional. You grant it only if you choose to connect your calendar. With it, we create one event in your primary Google Calendar for each appointment you book with the “add to Google Calendar” option, containing the date and time, the doctor’s name and the clinic. We do not read, change or delete any other events in your calendar.
  • We do not use Google user data for advertising, we do not sell it, and we do not share it with anyone except as needed to provide these features, to comply with the law, or with your consent.
  • MyClinicBooking’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
  • You can remove our access at any time in your Google Account (myaccount.google.com/permissions). Deleting your account also removes your Google Calendar connection.

4. Information About Your Health

We do not ask for medical information. However, the fact that you book with a particular doctor or speciality, and anything you write in a booking note, can reveal information about your health. This is a special category of personal data under Article 9 GDPR.

We process it only to arrange and manage your appointments, on the basis of the explicit consent you give when you create your account (see our Patient Consent). Please keep booking notes short and practical, and do not include medical details that the clinic does not need before your visit.

The clinic handles this information as a healthcare provider, under its own legal obligations of professional secrecy.

5. Why We Use Your Data and Our Legal Basis

  • To create and run your account, take bookings, and let you view, change and cancel them: performance of our contract with you (Article 6(1)(b) GDPR) and, for health-related information, your explicit consent (Article 9(2)(a)).
  • To share your booking with the clinic you book with, so it can see you: performance of our contract with you, and your explicit consent for health-related information.
  • To send messages about your bookings (see section 6): performance of our contract with you; optional reminders and earlier-slot alerts are sent only if you ask for them.
  • To add bookings to Google Calendar, if you choose to: your consent, which you can withdraw at any time.
  • To charge no-show and late-cancellation fees set by the clinic, retry failed charges and block bookings until a fee is paid: performance of our contract with you.
  • To provide clinics with their subscription, SMS credit and invoices: performance of our contract with the clinic, and our legal obligations under Maltese tax and accounting law (Article 6(1)(c)).
  • To keep the platform secure, prevent misuse and fraud, and fix errors: our legitimate interest in operating a safe service (Article 6(1)(f)).
  • To answer your questions and requests: performance of our contract with you or our legitimate interest in responding to you.
  • To comply with the law, and to establish or defend legal claims: our legal obligations and legitimate interests.

We do not sell your personal data and we do not send marketing messages.

6. Messages We Send

  • When you book, and when your booking is cancelled or changed, or the doctor is running late, we send you a message by SMS (from the clinic’s SMS credit) or by email. These messages are part of the service.
  • Appointment reminders are sent only if you tick “send reminder” when booking. If the clinic asks for it, the reminder includes a link to confirm that you will attend.
  • Earlier-appointment alerts are sent only if you ask to be notified when an earlier slot becomes available.
  • If a no-show fee cannot be charged, we email you about the failed payment and how to pay it.
  • Clinic administrators and doctors receive emails about their account, approval, schedules, SMS credit and invoices.

7. No-Show Fees and Account Blocking

If a clinic charges no-show or late-cancellation fees and a charge to your card fails three times for the same appointment, your account is automatically blocked from new bookings until the fee is paid. We email you before this happens and send you a link to pay.

This decision is made automatically under the clinic’s fee rules that you accepted when booking. You can contest it, explain your point of view and ask for a person to review it by writing to info@myclinicbooking.com. We will review it with the clinic and lift the block and refund the fee if it was applied wrongly.

8. Who We Share Your Data With

  • The clinic you book with, and its doctors and administrators, for your bookings at that clinic only. Clinics cannot see your bookings at other clinics.
  • Our service providers, who process data on our instructions and under contracts that protect it:
  • Microsoft (Azure): hosting of the platform, database and backups, in the Netherlands (EU).
  • Bird (MessageBird B.V., Netherlands): delivery of emails and SMS, through its EU data centre.
  • Stripe (Stripe Payments Europe, Ltd., Ireland): card payments for no-show fees, subscriptions and SMS credit.
  • Google (Google Ireland Ltd.): sign-in with Google, Google Calendar (only if you connect it), and maps and address search.
  • Our email hosting provider, for messages you send to our support address.
  • Public authorities, courts or professional advisers, where the law requires it or to establish or defend legal claims.
  • A buyer or successor, if our business is sold or reorganised, under the same protections.

9. Transfers Outside the EU

We store the platform’s data in the EU. Stripe and Google may process some data in the United States. Where this happens, the transfer is protected by the EU–US Data Privacy Framework or by the European Commission’s Standard Contractual Clauses. You can ask us for more information about these safeguards.

10. How Long We Keep Your Data

  • Your account: for as long as you keep it. When you delete it, we remove or anonymise your name, email address, phone number, picture, saved cards, Google connection and booking notes straight away. The anonymised booking records stay with the clinic for its statistics.
  • Accounts whose email address was never confirmed: deleted after 30 days.
  • Booking notes and the reasons given for cancellations or changes: deleted 12 months after the appointment. For walk-in and phone bookings, this includes the patient details the clinic entered.
  • Booking records without notes: for as long as the patient account and the clinic account exist.
  • When a clinic closes its account: its booking notes are deleted within 30 days.
  • Invoices and payment records: for as long as Maltese tax and accounting law requires, currently up to 10 years.
  • Sign-in sessions: expired sessions are deleted daily.
  • Server logs: kept for a short period for security and troubleshooting, and deleted automatically as they rotate.
  • Backups: kept for 35 days, then deleted automatically.
  • Messages you send us: for as long as needed to deal with your request and any follow-up.

11. How We Protect Your Data

  • All connections to the platform are encrypted (HTTPS).
  • Data and backups are stored in the EU, on encrypted storage.
  • Passwords are stored only as secure hashes, and repeated failed sign-in attempts lock the account temporarily.
  • Each clinic can only access its own bookings, and staff access is limited by role.
  • Servers are protected by a firewall, receive security updates automatically, and are accessible only to authorised administrators.

No online service can be completely secure. If a personal data breach is likely to put your rights at high risk, we will tell you without undue delay.

12. Your Rights

Under the GDPR you have the right to:

  • access your personal data and receive a copy of it;
  • have inaccurate data corrected;
  • have your data erased;
  • restrict or object to certain processing, including processing based on our legitimate interests;
  • receive your data in a portable format;
  • withdraw your consent at any time, without affecting processing that took place before; and
  • not be subject to a decision based solely on automated processing without the possibility of human review (see section 7).

Patients can download their data and delete their account themselves under My Account → Data & Privacy. For any other request, write to info@myclinicbooking.com. We reply within one month. For information that a clinic controls, we will pass your request to the clinic and help it respond.

You also have the right to complain to the Maltese supervisory authority, the Office of the Information and Data Protection Commissioner (idpc.org.mt), or to the data protection authority in the EU country where you live.

13. Children

Accounts are for people aged 16 and over. Appointments for younger children should be booked by a parent or guardian using their own account.

14. Booking Widget on Clinic Websites

When you book through our widget on a clinic’s own website, this Privacy Policy applies to the information you enter in the widget. The rest of the clinic’s website is covered by the clinic’s own privacy policy.

15. Changes to This Policy

We may update this Privacy Policy. The date at the top shows when it last changed. If we make important changes, we will tell registered users, and patients will be asked to review and accept the updated texts at their next sign-in.

16. Contact

  • Maja Vella, trading as MyClinicBooking
  • 29, Triq Alessandru, Birzebbuga BBG 2303, Malta
  • Email: info@myclinicbooking.com