Privacy Policy

FrontDesk, LLC • Effective Date: October 6, 2026

FrontDesk, LLC (“FrontDesk,” “we,” “us,” or “our”) is committed to protecting the privacy of its users. This Privacy Policy describes how we collect, use, store, share, and safeguard information in connection with the FrontDesk web application, mobile applications (iOS and Android), and all related services (collectively, the “Services”). By accessing or using the Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, you must discontinue use of the Services immediately.

1. Who This Policy Covers

   FrontDesk serves businesses. This policy describes three different groups of people, and different rules apply to each:

   • Website visitors. Anyone browsing frontdeskkiosk.com. Sections 7 through 9 are the ones that matter most to you.
   • Our customers and their staff. The businesses that subscribe to FrontDesk, and the administrators, providers, and front-desk staff who hold accounts. Section 2 describes what we collect about you.
   • People who check in at a customer’s location. If you tapped a kiosk or scanned a QR code in a waiting room, see Section 3. Your information belongs to the business you were visiting, not to us, and their privacy notice governs it.
2. Information We Collect About Customers and Staff

   We collect only what is necessary to provide, maintain, and improve the Services:

   • Account Information. When an administrator creates an account, we collect a first name, last name, and email address.
   • Provider and Staff Profiles. Administrators may add provider or staff profiles containing a name (with optional prefix and suffix), an email address, a role assignment, the locations that person serves, and an optional profile photograph.
   • Business Information. The company or practice display name, the names of practice locations, branding customization data (colors and logo images), notification message templates, and the organizational structure needed to operate the Services.
   • Billing Information. Payment card information is collected and processed exclusively by our payment processor, Stripe, Inc. (“Stripe”). FrontDesk does not store card numbers, bank account numbers, or other payment credentials. We store only a Stripe customer identifier that links your account to your payment profile.
   • Device Tokens. When a provider or staff member installs the mobile application, we store a push notification token for that device so we can deliver arrival alerts.
   • Kiosk Device Identifiers. Each kiosk device generates a random identifier the first time it is set up, which we store so an administrator can name and manage that kiosk. It is generated by our app and is not a hardware serial number, advertising identifier, or any identifier assigned by Apple or Google.
   • Referral Program Data. If you participate in our referral program, we generate and store a unique referral code linked to your company account, along with usage counts and redemption records.
   • Support and Feedback. If you contact support or submit a feature request, we retain your message and contact details so we can respond.
   • Log and Operational Data. Server logs, processed webhook event records, and transactional email delivery records, kept for troubleshooting and operational integrity. These are deleted after thirty (30) days.
3. Check-In Information We Process for Our Customers

   When someone checks in at one of our customers’ locations, we process a small amount of information on that customer’s behalf and under their instructions. We act as a service provider and, where the customer is a healthcare provider subject to HIPAA, as a business associate. We do not use this information for our own purposes.

   The complete set of what a check-in record can contain is:

   • A first name — only if the business has enabled the optional first-name feature, which is switched off by default and which an administrator can disable at any time.
   • The date and time of arrival.
   • The name of the staff member the person is there to see.
   • The location or kiosk where the check-in happened.
   • An indicator that a billing or insurance consent screen was acknowledged, if the business has enabled that optional feature.
   • The answers to, and any signature on, an intake or consent form — only if the business has enabled the optional digital intake & consent feature, which is switched off by default and requires a signed Business Associate Agreement where the business is a covered entity. The business builds the form from a document it already uses, so the business — not FrontDesk — decides what is asked. That can include details a standard check-in never touches, such as a date of birth, contact details, insurance information, or health history. We store the responses and make them available to that business’s authorized staff on its instructions.

   Unless the business has enabled digital intake & consent forms, we do not collect a surname, date of birth, contact details, insurance information, or any clinical information at check-in. In every case we do not schedule appointments and never receive appointment times. The date and time we record is the moment of arrival.

   Check-in records are visible only to authorized staff of the business you visited, in the FrontDesk app and portal. Recent records are also cached on those staff members’ own devices so the arrival feed works offline. Arrival alerts sent to staff phones deliberately carry no name or other identifying information — see Section 6.

   If you checked in somewhere and want your information accessed, corrected, or deleted, contact the business you visited. They control the record and we act on their instructions. If you contact us directly, we will forward your request to them and let you know we have done so.

4. Information We Do Not Collect

   Across all of the Services, we do not collect, store, or process:

   • Appointment schedules or booking details
   • Medical records, diagnoses, treatment plans, or progress notes from a customer’s clinical system — we do not connect to any EHR and never receive them
   • Precise geolocation or GPS data
   • Social Security numbers, government-issued identification, or biometric data
   • Credit card or bank account numbers (these go directly to Stripe)

   A standard check-in also collects no surname, date of birth, postal address, phone number, email address, insurance information, or health history. The one exception is the optional digital intake & consent feature described in Section 3: where a business switches it on, the form is built from that business’s own document and may ask for any of those details, and we then store the responses on that business’s behalf and under its instructions. FrontDesk never collects them for its own purposes, and we do not use them for advertising or sell them.

5. HIPAA and Our Role as a Business Associate

   Some of our customers are covered entities under the Health Insurance Portability and Accountability Act (“HIPAA”). When a covered entity uses FrontDesk, the check-in information described in Section 3 can constitute Protected Health Information (“PHI”), and FrontDesk acts as that customer’s business associate.

   Our Business Associate Agreement applies automatically to any customer that is a covered entity or that is itself a business associate, and is incorporated into our Terms and Conditions. Customers who need a separately signed copy for their records can request one at [email protected].

   We have executed a Business Associate Agreement with Google LLC covering the Google Cloud services that store and process check-in records. We do not place PHI into any service that is not covered by an appropriate agreement, and Section 6 explains how that constrains the way arrival alerts are built.

   FrontDesk remains administrative software. It is not medical software and provides no clinical, diagnostic, or treatment functionality.

6. Arrival Alerts and What They Contain

   Arrival alerts reach staff phones through push networks operated by Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service). Those networks are outside the scope of our agreement with Google, and Apple does not offer such an agreement at all. A business can also choose to have arrival alerts emailed to its staff, in addition to the push, in which case the alert also passes through our email provider (Section 8).

   Because of that, an arrival alert carries no information identifying the person who checked in. It carries only the staff member’s name, the location or kiosk label, and the fact that someone has arrived. This is true of both the push and the email.

   Where a first name has been collected, it is written to our database and shown inside the authenticated app and portal. A small number of businesses that have told us HIPAA does not apply to them have asked us to include that first name in the alert itself, so it is readable without opening the app; we enable that only for those businesses, and never for a business that has told us it is a HIPAA-covered organization.

   Businesses control the wording of their own notification templates and the names they give locations and kiosks. Our Terms and Conditions require them not to put identifying information into those fields.

7. How We Use Information
   • To provide, operate, and maintain the Services, including the check-in kiosk, arrival notifications, and administrative portal
   • To identify and authenticate authorized users and administrators
   • To display provider profiles within the check-in experience
   • To process subscription billing, apply referral credits, and manage payment communications through Stripe
   • To send transactional email such as onboarding, receipts, and account notices
   • To respond to support inquiries and feature requests
   • To detect, prevent, and address fraud, security incidents, and technical problems
   • To measure the performance of our advertising on our marketing website, as described in Section 9
   • To comply with legal obligations

   We do not use check-in information for advertising, analytics, product research, or model training. We may use information that has been de-identified so that it no longer identifies any person, and cannot reasonably be used to do so, to understand and improve how the Services perform.

8. Service Providers and Subprocessors

   We use a small number of providers. Each accesses information only as needed to perform its function and is contractually required to keep it confidential.

   • Google LLC (Google Cloud and Firebase). Database storage, file storage, serverless backend logic, logging, authentication, and web hosting. A Business Associate Agreement is in place covering the services that hold check-in records. See Firebase’s privacy documentation.
   • Google and Apple push networks. Deliver arrival alerts to staff devices. They receive only the alert content described in Section 6, which contains no identifying information.
   • Stripe, Inc. Subscription payments, billing operations, and refunds. Card data is collected, processed, and stored by Stripe under PCI-DSS Level 1 standards. See Stripe’s Privacy Policy.
   • Anthropic PBC. Reads intake forms that an administrator uploads in the portal, in order to turn them into check-in questions. It receives only the uploaded file. It does not receive check-in records, and the content is not used to train models. See Anthropic’s Privacy Policy.
   • Mailgun (Sinch Email). Transactional email delivery. Processes staff email addresses and message content. Where a business has turned on emailed arrival alerts, that also includes the staff member’s name, the location or kiosk label, and the fact that someone has arrived — the same content the push networks receive, and no information identifying the person who checked in.
   • Meta Platforms, Inc. and Google (advertising). Advertising measurement on our marketing website only. See Section 9.
   • Google Fonts. Our pages load web fonts from Google, which causes your browser to send your IP address and request headers to Google servers.
9. Cookies, Tracking, and Advertising

   Our marketing website uses two advertising technologies: the Meta Pixel (Meta Platforms, Inc.) and Google Ads tag (Google LLC). Both use cookies and similar technologies and may collect your IP address, browser and device information, the pages you view, and actions you take such as creating an account or starting a subscription. We use them to measure advertising performance and to understand how visitors arrive from our ads. Sharing this information with Meta and Google for these purposes is considered “sharing” for cross-context behavioral advertising under California law. We do not receive money for it.

   These technologies are not loaded on the check-in pages. When someone taps a kiosk or scans a QR code to check in, no advertising or analytics tag runs on that page. Check-in information is never shared with Meta, Google Ads, or any other advertising partner.

   We honor the Global Privacy Control (GPC) signal. If your browser or extension sends it, we do not load advertising technologies at all. You can also opt out through your browser’s cookie settings, your Meta ad preferences, Google ad settings, or industry tools such as the Digital Advertising Alliance opt-out.

   We also use browser-native storage (localStorage and sessionStorage) for strictly functional purposes: caching company data to speed up page loads, remembering interface preferences and dismissed prompts, and maintaining session state during signup and checkout.

10. Your Privacy Choices

    To opt out of the sharing described in Section 9, do any of the following: enable Global Privacy Control in your browser; use the Meta, Google, or Digital Advertising Alliance opt-out tools linked above; or email us at [email protected] with the subject line “Do Not Sell or Share My Personal Information.” We honor verified requests within fifteen (15) business days and do not require an account to submit one.

    We do not sell personal information for money, we do not use or disclose sensitive personal information for purposes requiring a right to limit, and we do not offer financial incentives in exchange for personal information.

11. Data Sharing and Disclosure

    Beyond the providers in Section 8 and the advertising sharing in Section 9, we disclose information only:

    • Legal compliance. When required by law, regulation, legal process, or an enforceable governmental request.
    • Protection of rights. To enforce our Terms and Conditions or protect the rights, property, or safety of FrontDesk, our users, or the public.
    • Business transfers. In a merger, acquisition, reorganization, sale of assets, or bankruptcy, in which case information may transfer to the successor, subject to this policy.
    • With your consent. Where you have expressly agreed.
12. Data Security

    We implement commercially reasonable administrative, technical, and physical safeguards designed to protect information from unauthorized access, disclosure, alteration, and destruction, including:

    • Encryption in transit using TLS (HTTPS), and encryption at rest by our cloud provider
    • Database security rules enforcing role-based access, so a user can reach only their own organization’s data
    • Scoped access to check-in records — a provider sees their own arrivals, front-desk staff see the locations they serve
    • Cross-Origin Resource Sharing policies restricting API access to authorized domains
    • Single-use, time-limited sessions for QR check-in

    No method of electronic transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security.

13. Data Retention and Deletion
    • Active accounts. Account, staff, business, and check-in data is retained for the duration of your subscription so the check-in history remains available to you in the portal. Administrators can request deletion of check-in history at any time.
    • After cancellation. If a subscription is canceled and not reinstated before the current billing period ends, we delete all associated company data, staff profiles, check-in records, stored files, and authentication accounts within thirty (30) days of termination.
    • Uploaded intake forms. When an administrator uploads an intake form, we keep the uploaded file, and every later version of it, for the duration of your subscription. Deleting a form in the portal removes it from your list and stops it being used at check-in; it does not delete the underlying uploaded file, which is retained so that earlier versions of a form remain available. All uploaded files are deleted with the rest of your company data after termination, as described above.
    • Backups. Deleted data may persist in encrypted backups until those backups age out on their normal rotation, which is no longer than sixty (60) days after deletion. We make no further use of it during that window.
    • Operational logs. Server logs, webhook event records, and email delivery records are deleted after thirty (30) days.
    • Stripe records. Billing and payment history held by Stripe is subject to Stripe’s own retention policies and to tax and accounting record-keeping requirements.
14. Your Rights

    Depending on where you live, you may have the following rights regarding personal information we hold as a business in our own right. We extend these rights to all United States residents regardless of whether a particular state law applies to us:

    • Access. Request a copy of the personal information we hold about you, and information about how we use and share it.
    • Correction. Ask us to correct inaccurate or incomplete information.
    • Deletion. Ask us to delete your personal information, subject to legal exceptions.
    • Portability. Receive your information in a structured, commonly used format where technically feasible.
    • Opt out. Opt out of the sharing for advertising described in Section 9.
    • Non-retaliation. We will not deny service, charge different prices, or provide a different quality of service because you exercised a right.
    • Appeal. If we decline a request, you may appeal by replying to our response. We will answer an appeal within forty-five (45) days and, if we again decline, tell you how to contact your state Attorney General.

    Email [email protected] to exercise a right. We verify requests using the email address on the account or, where there is no account, by asking for enough information to confirm your identity. We respond to verified requests within forty-five (45) days and will tell you if we need a further forty-five (45) days.

    These rights do not apply to check-in information. That information is held on behalf of the business you visited, is generally exempt from state privacy laws as data regulated under HIPAA, and is governed by that business’s privacy notice. Direct those requests to them, as explained in Section 3.

15. State-Specific Disclosures

    California. Under the California Consumer Privacy Act as amended by the California Privacy Rights Act, California residents have the rights in Section 14 and the right to opt out of the sharing described in Section 9. We do not sell personal information for monetary consideration. We do share personal information for cross-context behavioral advertising through the Meta Pixel and Google Ads tag on our marketing website. Section 10 describes how to opt out, including through Global Privacy Control, which we honor. We collect the categories of information described in Sections 2 and 3, from the sources and for the purposes stated there, and retain it as described in Section 13.

    Kentucky. The Kentucky Consumer Data Protection Act took effect January 1, 2026. FrontDesk is a Kentucky company and does not currently meet the statute’s applicability thresholds, and information regulated under HIPAA is exempt from it in any event. We nonetheless honor the access, correction, deletion, portability, opt-out, and appeal rights described in Section 14 for Kentucky residents.

    Other states. Several other states have comprehensive privacy laws with similar rights. Whether or not a given law applies to us, we honor the rights in Section 14 for all United States residents.

16. Children’s Privacy

    The Services are business software and are not directed to children. We do not knowingly collect personal information from children under thirteen (13) through our website or through account registration, consistent with the Children’s Online Privacy Protection Act.

    A minor may check in at one of our customers’ locations. Any first name collected in that situation is processed on the customer’s behalf under Section 3, and the customer is responsible for any parental notice or consent their own obligations require. If you believe a child’s information has been provided to us outside that context, contact [email protected] and we will delete it promptly.

17. International Users

    The Services are hosted and operated in the United States and are intended for use by businesses located in the United States. If you access the Services from elsewhere, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction.

18. Changes to This Privacy Policy

    We may update this Privacy Policy. When we make material changes we will update the Effective Date above and, where practicable, give notice through the Services. Your continued use after a change takes effect constitutes acceptance of the revised policy.

19. Contact Us

    Questions, concerns, or requests about this Privacy Policy or our data practices:

    FrontDesk, LLC
    Email: [email protected]