Privacy Policy
Last updated: September 23, 2026
1. Introduction
TopBook is a booking, client-management and payments platform for service businesses — salons, spas, med spas, clinics and other practices. TopBook is operated by MithrilCore LLC, a Florida limited liability company ("MithrilCore", "we", "us", "our"). This Privacy Policy explains what information we collect, how we use and protect it, and what rights you have over it. By using TopBook you agree to this policy.
2. Who is responsible for your data
For business owners and their staff (our customers), we are the controller of the account information we collect about you. For the clients and patients who book with a business through TopBook, the business is the controller of their information, and we process it on the business's behalf and under its instructions. When the business is a healthcare provider covered by HIPAA, we act as its Business Associate, and the Business Associate Agreement (BAA) between us governs its protected health information (section 10).
3. Information we collect
From business owners and staff: name, email, phone, password (stored only as a one-way hash), organization details, locations, services, work schedules, and payout account details (held by Stripe). If you sign in with Google or connect Google Calendar, we receive the account and calendar access you authorize. From clients and patients, as entered by you when booking or by the business: name, phone number, email, date of birth, language, appointment history, notes, family members or dependents booked under your contact, forms and electronic signatures, messages exchanged with the business over WhatsApp, SMS or email, and payment, deposit, package and gift card records. Card details are collected and held by Stripe, never by us. From healthcare and aesthetic practices that turn on clinical features: client charts (allergies, medications, conditions), visit and treatment notes, treatment plans, treatment photos, and insurance and eligibility details. From conversations with a business's assistant: when a business turns on its AI assistant, the text of your chat — and, on phone calls, a live speech-to-text transcript — is processed so the assistant can answer you and book for you. Call recording is off by default. Technical data: IP address, device and browser type, and security and usage logs.
4. How we use your information
To provide and operate the service — accounts, scheduling, confirmations and reminders, payments, forms, client records and the business's AI assistant; to keep the service secure and prevent fraud and abuse; to provide support; to enforce our Terms; and to comply with legal obligations. We do not sell personal information, we do not use it for advertising, and we do not use clients' or patients' information to train AI models.
5. WhatsApp & SMS messaging
When you provide your phone number to book an appointment, you agree to receive transactional text (SMS) and WhatsApp messages from the business — verification codes, appointment confirmations, reminders, and rescheduling or cancellation notices. Message frequency varies (typically 2–4 messages per appointment) and message and data rates may apply. Messages are sent through Twilio acting as our messaging provider. Phone numbers collected for messaging are used only for these appointment-related messages — they are never sold or shared with third parties for their own marketing. You may opt out at any time by replying STOP to any message; reply HELP for help.
6. Service providers
We share with each provider only the data it needs to perform its service for us: • Google Cloud (United States) — application hosting, database, file storage, logs and server error reporting; Google sign-in and Google Calendar when you connect them. Covered by our HIPAA Business Associate Agreement with Google. • Stripe — subscription billing, and the payments a business collects from its clients. • Twilio, and through it Meta's WhatsApp Business Platform — SMS, WhatsApp and phone calls, including the speech recognition and voice the assistant uses on calls. • Anthropic — the AI model behind the business's assistant and note dictation. • Resend — transactional email. • Meta — publishing to a business's Instagram account, when the business connects it. • Stedi — insurance eligibility checks, when a clinic turns them on. • Inngest and Upstash — background job scheduling and rate limiting; they receive internal identifiers only, never client details. • Sentry — error reports from your browser, with personal data scrubbed. • Have I Been Pwned — a five-character fragment of a password hash, used to reject passwords exposed in known breaches; your password never leaves our servers. Each provider is bound by its own data protection terms. Protected health information is shared only with providers bound by a Business Associate Agreement; the messages we send to a healthcare practice's patients through Twilio, Meta and Resend are generic and carry no clinical details. We do not share data with advertisers or data brokers.
7. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict its processing, and to withdraw consent. Business owners and staff can exercise these rights by writing to support@topbook.app; we respond within 30 days. If you are a client or patient of a business, send your request to that business — it controls your records, including your HIPAA rights to access and amend your health information — and we will help it respond. You may also lodge a complaint with your local data protection authority.
8. Data retention
We keep account data while the account is active. When a business closes its account, its data is permanently deleted about 30 days after the closure becomes final, unless the law requires it to be kept longer. Records with a legal retention period are kept for that period and then deleted: clinical records for the period the business's retention policy sets under applicable law (in Florida, 7 years from the last clinical contact, and longer for minors), and financial records for 7 years. Records under a legal hold are kept until the hold is released. Client and patient records are controlled by the business that collected them; contact that business to request their deletion.
9. Security
We protect information with administrative, physical and technical safeguards, including: encryption in transit (TLS) and at rest, with sensitive fields — clinical records, messages and connected-account credentials — additionally encrypted by the application; passwords stored only as bcrypt hashes and checked against known breaches; sessions that expire after 8 hours; role-based access, with clinical records closed to every role until the business grants access, and every clinical read recorded in an audit log that cannot be altered; strict separation between businesses; and private, access-restricted storage for photos and files. No system is 100% secure. If a breach affects your information, we will notify you — or the business that controls it — without unreasonable delay and within the time the law requires, including the HIPAA Breach Notification Rule for healthcare providers.
10. Health information and HIPAA
TopBook meets the requirements HIPAA places on Business Associates. TopBook is built for healthcare providers covered by HIPAA. When a covered provider uses TopBook, we act as its Business Associate: we enter into a Business Associate Agreement with it, and we use and disclose protected health information (PHI) only to provide the service and as that agreement and HIPAA permit. TopBook's hosting, database and file storage run on Google Cloud under a Business Associate Agreement with Google. Clinical features stay off for a business until it has accepted our BAA and completed our clinical readiness checks. Appointment messages, reminders and emails to patients are kept generic, without diagnoses, treatments or other clinical details. The healthcare provider remains responsible for its own HIPAA obligations to its patients, including its Notice of Privacy Practices.
11. Children
TopBook is not directed at children under 13, and we do not knowingly collect information directly from them. A business may keep records about a minor — a dependent booked by a parent or guardian — which it holds on the guardian's authority and under its own legal obligations. If you believe a child has given us personal information directly, contact us and we will delete it.
12. International transfers
Our servers are hosted in the United States. If you access the service from outside the US, your information will be transferred to and processed in the US. Where required, we rely on standard contractual clauses for international transfers.
13. Changes to this policy
We may update this Privacy Policy. Material changes will be notified by email or in-app banner at least 30 days before they take effect. The "Last updated" date at the top reflects the current version.
14. Contact
For questions about this policy or to exercise your rights, contact MithrilCore LLC at support@topbook.app.