Public information

Privacy Notice

Version: September 18, 2026

This Privacy Policy explains how Orb at orbemr.app accesses, uses, stores, shares, and deletes information for its optional Google Calendar connection. Orb is practice management software for scheduling, clinical notes, and Client communication. Connecting Google Calendar is optional and is not required to use other Orb features.

Google user data we access

Orb collects the Google account email used to connect, Calendar display names and access roles used by the picker, and the immutable Calendar identifier and display snapshot for the one Calendar the Provider selects.

With your consent, Google account identity and email permissions let Orb identify and display the connected account. Read-only Calendar list permission lets you see which calendars are available and choose one that you can edit. Calendar event permission lets Orb read availability and create, update, or remove its own Appointment mirrors in that selected Calendar. Orb does not activate event access until you confirm your selection; it does not automatically choose your primary calendar.

How Calendar data is used

For the selected Calendar only, Orb reads the minimum live event fields needed to show a Provider-only advisory overlay: title, start and end, cancellation state, and show-as-free state. Event titles are not stored. Clients and public visitors receive only numeric, identity-free Busy Intervals; they do not receive Google event content or account or Calendar identity.

Orb writes active Appointments as private Google events titled exactly “Orb appointment.” A mirror contains its time and duration, a generic management sentence, and an opaque correlation value. It contains no Client, Service, Provider, Practice, clinical, contact, attendee, location, or conferencing data. Google-side changes do not change the Appointment in Orb.

Data sharing and third-party processing

Google processes authorization requests and Calendar API requests to provide the connection you request. Orb runs its application backend and database on Convex, which processes and stores connection data on Orb’s behalf. These transfers support the Calendar features described in this policy; Orb does not transfer Google user data to third parties for their advertising, marketing, or other independent purposes.

Your live Google event details are shown only to you as the connected Provider. Other scheduling surfaces use identity-free Busy Intervals rather than your Google event titles or account identity. Google Calendar data is not sent to Orb’s AI note-generation services. Orb does not use Google Workspace API data to develop, improve, or train generalized or non-personalized AI or machine-learning models.

Authorization and security

Orb stores Google authorization tokens only in encrypted server-side envelopes and refreshes access when needed. Connections use HTTPS, and authenticated access checks scope Calendar operations to the connected Provider and Organization. Authorization tokens never reach the browser. During setup, eligible Calendar identifiers pass only to the exact authenticated Provider’s picker and selection submission; they are absent from connection status, Client, and public responses. Orb uses Google user data only to provide the visible Calendar Connection described here.

Orb does not sell Google user data or use it for advertising, credit decisions, unrelated human review, or unrelated model training. Orb’s use and transfer of Google user data complies with the Google API Services User Data Policy, including its Limited Use requirements.

Retention, Disconnect, and revocation

Live Provider event details are not retained. Busy Intervals are kept only for the bounded availability window and removed by normal retention after they are no longer fresh. The encrypted connection grant and selected-Calendar snapshot remain while the Calendar Connection is configured.

Disconnect stops Orb from using the connection, makes saved Busy Intervals unusable immediately, attempts to revoke Google authorization, and deletes the local connection even if revocation is unavailable. Previously mirrored events are not deleted by Disconnect; those remaining Google events can be removed manually in Google Calendar.

Your choices and privacy requests

You can stop access using Disconnect in Orb’s Connected Calendars settings. You can also remove Orb’s access from your Google Account’s third-party connections settings. To change the connected account or Calendar, disconnect and connect again with your new selection.

To request deletion of retained Google connection data or ask a privacy question, contact support@orbemr.app. Identify the Orb account and connection concerned; do not email passwords, authorization tokens, or clinical information. Deleting an Orb connection does not delete your Google account or unrelated Google events. Your Organization manages records entered directly into Orb; disconnecting Google Calendar does not delete those records.

See the retention and deletion notice for this lifecycle and support for help.