Olamkal — Health appointment booking
Join as a practitioner

Privacy Policy

Last updated: 29/10/2026

OLAMKAL attaches great importance to the protection of its users' personal data. This Privacy Policy describes the practices for collecting, using, and protecting personal data.

1.1. Data collected

We collect the following data:

  • Identification information (name, first name, telephone, email, Teoudat Zeout, Diplomas)
  • Location information (city, postal code)
  • Data relating to reservations (services chosen, dates, times)
  • Payment information (if applicable)

Geographic location (“Near me” feature)

On the search page, the “Near me” feature lets you, only at your request, sort practitioners from nearest to farthest. Your location is requested only after you click and with your browser's or phone's permission. It is rounded to about a hundred metres, used only to compute this sorting, and then discarded: it is never stored, linked to your account, shared with third parties, or used for any other purpose. You may decline this permission at any time; searching by city remains available.

Patient record documents

For an appointment, you can send health documents (X-rays, reports, prescriptions, photos) to your practitioner from the website or the app, and your practitioner can add documents to your record (imaging, reports, clinical photos — with your consent for any clinical photo). These documents are health data: they are hosted on a dedicated database and storage space located in the European Union, encrypted at rest and in transit, and accessible only through short-lived secure links after identity verification; every access is logged. A document you send is accessible only to the practitioner of the appointment concerned — never to the other practitioners you see. Documents your practitioner adds to your record do not appear in your Olamkal space: they belong to their record-keeping. In accordance with the law, you may request a copy directly from your practitioner. Photos are compressed and their metadata (including GPS location) removed on your device before sending; no document is ever attached to e-mails. You can withdraw a document you sent as long as your practitioner has not opened it; once viewed, it is part of the record kept by the practitioner and you can only hide it from your own space. Practitioners do not delete documents: they archive them. If you delete your account, documents you sent that were never opened are permanently erased; those already viewed by your practitioner, and those they added, are kept in their record under their legal record-keeping obligation.

1.2. Purpose of collection

The data collected is used to:

  • Allow the booking of services
  • Manage user accounts
  • Communicate with users
  • Improve the services offered
  • Ensure the security of the Site

Appointment confirmations and reminders. When you book an appointment, Olamkal sends you the confirmation and then reminders (the day before and two hours before) by e-mail, by in-app notification and by WhatsApp to the phone number on your account. These messages relate strictly to your appointments and contain no advertising. You can refuse WhatsApp messages at any time from “My account” (website or app); you will then keep receiving e-mails. WhatsApp messages are delivered through Twilio and Meta (WhatsApp Business); only your phone number, first name, the practitioner's name and the date, time and place of the appointment are shared with them.

1.3. Legal basis

The processing is based on the explicit consent of the user, or on the execution of a contract (e.g.: making an appointment or subscription).

1.4. Hosting and security

Data is hosted by Google (Firebase / Firestore) and Vercel, whose servers are located in Europe, the United States, and Israel. Transactional emails are sent through Postmark. OLAMKAL implements all reasonable technical and organizational measures to ensure data security.

1.5. Retention period

Data is retained for as long as necessary to provide the services, and for the legal duration necessary for tax, accounting and legal purposes.

1.6. User rights

In accordance with Israeli law and the GDPR, every user has the following rights:

  • Right of access
  • Right of rectification
  • Right to erasure
  • Right to object
  • Right to data portability

To exercise these rights, you can contact us at: contact@olamkal.com

Right to erasure — you can delete your patient account yourself, from the mobile app (Account → Danger zone) or from your “My account” page on the website. Deletion permanently erases your medical vault (documents and files hosted in Europe), your consents, your profile's personal data and your notification tokens. However, your past appointments and any consultation notes remain in your practitioner's records, under your name, pursuant to their legal record-keeping obligation (Israeli law). Full details: olamkal.com/en/supprimer-compte.

1.7. Google Calendar synchronization (optional, practitioner-initiated)

Practitioners may connect their Google account. Two separate flows, each of which can be enabled independently, require their explicit consent and can be disabled at any time.

(a) To Google: OLAMKAL creates a dedicated calendar ("Olamkal — Appointments") in their account and writes their Olamkal appointments to it (patient name, service, date, time and practice location). No consultation reason or note is ever sent.

(b) From Google: to prevent double bookings, OLAMKAL reads the times and titles of events in the calendars the practitioner has chosen, as well as in the “Olamkal” calendar they maintain themselves ("calendar.events.readonly" and "calendar.calendarlist.readonly" scopes). Times (start, end) are kept in the main database without any content; the title — which may contain a patient's name — is stored separately in OLAMKAL's secure medical space (European hosting) and is visible to the owning practitioner only. OLAMKAL never reads or stores the description, location, attendees or attachments of these events, and never shows them to patients: the slot simply appears "unavailable". These events create no patient record and trigger no reminder or message.

Access tokens are encrypted at rest and stored outside the medical database. On disconnection, access is revoked with Google and the connection and imported events are archived (they immediately stop blocking the agenda); the dedicated calendar stays in the practitioner's Google account, who may delete it.

Google user data

Data read: only the times (start, end) and the title of events in the calendars the practitioner has chosen, plus the list of their calendars in order to make that choice. Never the description, location, attendees or attachments.

Use: to block the matching time slots on Olamkal (the patient only sees “unavailable”) and to show the title to the practitioner, on their own agenda only. No patient record, no reminder, no message; no advertising use, no sale, no training of any artificial-intelligence model.

Storage: times in Olamkal's main database, without any content; the title separately in the secure medical space (European hosting), readable by the owning practitioner only; access tokens encrypted at rest. None of this is transferred to any third party.

Deletion: on disconnection (“Disconnect” button in the settings), access is revoked with Google and imported events immediately stop blocking the agenda; they are archived and then purged. The practitioner can also remove access from the security settings of their Google account.

Protection of Google data

Safeguards applied to data obtained from Google Calendar:

  • Encryption in transit and at rest: all exchanges between your browser, Olamkal's servers and the Google APIs use HTTPS (TLS); the databases (Google Cloud Firestore) encrypt all data at rest.
  • Access tokens: the Google refresh token is encrypted with AES-256-GCM before being stored, using a dedicated key kept outside the databases. It is stored in the main database, outside the medical database, is never sent to the browser and is never written to logs.
  • Event titles: kept in a medical database that is separate from the main database (European hosting), whose access rules allow reading by the owning practitioner only (owner-only rules) and forbid any write from a client.
  • Least privilege: Olamkal requests only the scopes strictly required (app-created dedicated calendar, read-only events, calendar list), reads only the calendars the practitioner has ticked and keeps only their times and title — never the description, location, attendees or attachments. Olamkal appointments are written to the dedicated calendar only, never to the primary calendar.
  • Retention and deletion: while the synchronization is active, only events within a rolling window (7 days in the past to 90 days ahead) are kept. On disconnection, the token is revoked with Google and erased immediately; imported times and titles immediately stop being used, are archived and then permanently deleted within 30 days. The practitioner can also remove access at any time from the security settings of their Google account.
  • Internal access control and traceability: no direct access to tokens, times or titles is possible from a client; every operation goes through Olamkal's servers. Through its administration tools, Olamkal staff can only see the technical state of connections (status, sync dates, counters), never plaintext tokens or event content; their rights are defined by levels (founder, administrator, support, read-only). Every connection, disconnection and change of import settings is recorded in an audit log (who, what, when, which account).

Olamkal's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.