OnSched & GDPR

Introduced in 2016, and implemented in 2018, GDPR (General Data Protection Regulation) was introduced to give individuals throughout Europe more control over their personal data. It's important to understand the roles of OnSched and our Users in GDPR compliance.

OnSched is a Processor, User is a Controller.

All of our activity is structured in a way, where OnSched acts as a data processor and the User acts as a data controller. For example, customer information like First Name, Last Name, and Email Address is passed over to OnSched through the API to create an appointment, then the same data is sent to the User's CRM through OnSched's webhook. During the whole process the User remains in control of this data - meaning, creating, enriching, modifying, or removing the data are all User's privileges, but the OnSched and the CRM act as data processors.

As a Data Processor, OnSched is responsible for safeguarding the data of our partners' and customers' users as it flows through our system.

As a Data Controller, you're responsible for safeguarding the data of your customers as they interact directly with services integrated with OnSched.

OnSched uses a variety of well-known sub-processors like Microsoft Azure (our hosting provider) or Stripe (our payments provider). We are working on minimizing the amount of data each sub-processor has access to (for example, due to the nature of our software product, Microsoft Azure handles all user data but Stripe only handles a minimum set of billing data). We've executed all the necessary Data Processing Addendums and will work with sub-processors to maintain compliance. Some of our Users practice hiding user IDs with pairwise pseudonymous identifiers (PPIDs) or phantom tokens on their internal networks.

To request personal data removal, please submit a request through our support form.

To request Data Processing Agreement, please make a request through your account manager. If you haven't engaged with us yet, you can start by booking the first call here.