Privacy Policy
Last updated: 6 October 2026
1. Introduction
Thank you for your interest in Tempulo. Tempulo is software for appointment scheduling and appointment management in physiotherapy and medical practices: practices run calendars, client records and prescriptions; patients book appointments on the practice’s booking page.
This notice explains which personal data we process, for which purposes and on which legal basis.
It applies to the Tempulo website, dashboard, booking page, API and — where offered — embedded booking widgets.
2. Controller
Where we determine the purposes and means of processing, the controller is:
auronet GmbH represented by the managing director Michael Mücke Labbéstr. 18 41169 Mönchengladbach Germany
Phone: +49 2161 90 45 307 Email: [email protected]
Further details are in the legal notice.
We have not appointed a data protection officer. Privacy requests can be sent to the address above.
3. Our roles
Account, sign-in, billing, demo requests. For these we are the controller under the GDPR. That covers practice and staff accounts as well as an optional patient account on the booking page.
Practice data. Appointments, client records, prescriptions, messages, reminders and the details someone submits when booking belong to the practice. The practice is the controller towards its patients. We process these data only on its behalf (Art. 28 GDPR). The data processing agreement is included with every plan at no extra charge.
The chosen service is health data (Art. 9 GDPR). Special conditions of the practice apply to those data; we process them on instruction and not for purposes of our own.
4. Hosting and infrastructure
Cloudflare
Public pages (marketing, booking interface, embedded widgets) are delivered through Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA (Pages, CDN, DNS, bot protection). Cloudflare processes technical data (in particular IP address, browser and request information) to deliver the site and to defend against attacks.
Images and image sequences on the website (such as the film on the home page) are delivered from the storage service Cloudflare R2 at media.tempulo.com. No cookies are set; the same technical data arise as when the page itself is loaded (section 6.1).
Booking and practice data in the request body do not travel through a global CDN. API calls terminate in the practice’s Azure region.
Microsoft Azure
The backend, databases and file storage run on Microsoft Azure (Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA). Server locations are in the European Union (West Europe region).
Microsoft and Cloudflare are certified under the EU-US Data Privacy Framework (DPF). We also rely on the European Commission’s Standard Contractual Clauses (SCCs) and have data processing agreements in place. Azure meets recognised security standards (ISO 27001, SOC 1/2/3).
Legal basis for hosting and security: Art. 6 (1) (f) GDPR (legitimate interest in a secure, available service) and, where the infrastructure performs the contract, Art. 6 (1) (b) GDPR.
5. Recipients and international transfers
We only share data where that is necessary for the purpose:
| Recipient | Purpose | Location / transfer |
|---|---|---|
| Cloudflare Inc. | Delivery of static pages and media (Pages, R2), CDN, DNS, bot protection (Turnstile) | USA (DPF and SCCs) |
| Microsoft Corporation (Azure) | Hosting, databases, storage, error logs | Processing in the EU; group in the USA (DPF and SCCs) |
| Brevo (Sendinblue) | Transactional email and SMS (login codes, confirmations, reminders) | EU |
| Stripe Payments Europe, Ltd. (Dublin, Ireland) | Practice payments and subscriptions | EU; parent company Stripe, Inc. (USA, DPF / SCCs); card data stays with Stripe |
| Google, Apple, Microsoft, X | only if you sign in with that service | each USA (DPF / SCCs where applicable) |
| Google or Microsoft | only if the practice connects its calendar | USA or EU (DPF / SCCs where applicable) |
A transfer to the USA may mean that US authorities can request access under US law. We limit sharing to what is necessary and choose providers with DPF certification and/or SCCs.
Calendar connections and booking widgets embedded on a practice website remain the practice’s responsibility.
6. What we process
6.1 Visiting the website (logs)
Browsers and networks automatically send technical data. Cloudflare and Azure keep server logs, in particular:
- browser type and version, operating system
- referrer URL, requested path
- time of the request
- IP address
Purpose: delivery, stability, abuse and attack detection. Legal basis: Art. 6 (1) (f) GDPR. We do not combine this with the account for advertising.
The marketing site loads nothing from third-party servers. Fonts sit on the same server; there is no analytics, no social-network embed and no cookie that would require consent.
6.2 Account (practice, staff, patient)
An account requires at least an email address. We may also store display name, role, practice link, language and — for the practice — plan, trial period and subscription status.
Legal basis: Art. 6 (1) (b) GDPR (user agreement).
6.3 Sign-in
You can sign in with an email one-time code (OTP). We store the code briefly (a few minutes) and then delete it. You may also sign in with Google, Apple, Microsoft or X. Those providers send us the account data needed to log you in (typically email, name, provider ID).
After login, a JWT session token is stored on the device (localStorage). For some SSO providers we set short-lived, strictly necessary cookies (sso_pkce_*, sso_state_*, 10 minutes, HttpOnly, Secure, SameSite=Lax).
Legal basis: Art. 6 (1) (b) GDPR; for optional SSO connections Art. 6 (1) (a) GDPR (consent by using the button).
6.4 Bot protection (Cloudflare Turnstile)
Sign-in, registration, requests for login codes, online booking and the demo form are protected by Turnstile.
Turnstile checks whether a human submitted the request. It does not set tracking cookies for advertising. Legal basis: Art. 6 (1) (f) GDPR. No consent banner is required for this (§ 25 (2) TDDDG).
6.5 Email and SMS
We send transactional mail (login codes, booking confirmations, reminders, demo invitations) through Brevo. The practice can also send reminders by SMS through the same provider; SMS stays off during the trial.
Legal basis: Art. 6 (1) (b) or (f) GDPR; towards patients the practice is the controller and we are the processor. We do not send a marketing newsletter.
6.6 Payments
Paid plans (Solo, Team) are billed by Stripe. We store customer and subscription IDs, plan, seat count and trial period. Card data is held by Stripe, not by us. Legal basis: Art. 6 (1) (b) GDPR and, for statutory records, Art. 6 (1) (c) GDPR.
We do not bill patient appointments.
6.7 Booking an appointment
The practice’s booking page collects name, contact details and the chosen service. The service is health data. If someone books for another person, two separate identities are created — never a shared record.
An account is not required (guest booking). Anyone who creates a patient account can find appointments across practices; the account belongs to the person, the record belongs to the practice.
The practice is the controller for booking data. Legal basis for our technical processing: Art. 28 GDPR on the practice’s behalf.
6.8 Client records, prescriptions, messages
The practice can keep master data, history, notes, prescriptions, series, consents and messages in Tempulo. Those holdings belong to the practice. We store them, make them available in the dashboard and delete them on the practice’s instruction or after the agreed periods.
Legal basis: Art. 28 GDPR; towards data subjects the practice typically relies on Art. 9 (2) (h) GDPR and professional duties.
6.9 Reminders and confirmations
Email or SMS reminders contain a link to confirm or cancel. Anyone who does not confirm frees the slot. The practice decides which channels to use. Legal basis for our technical processing: Art. 28 GDPR.
6.10 Calendar connection
If the practice connects Google or Microsoft Calendar, we store access and refresh tokens for as long as the connection lasts. Tempulo appointments appear in the connected calendar; third-party entries are written back as busy time. We remove the tokens when the practice disconnects the calendar or deletes the account.
Legal basis: Art. 6 (1) (b) and (a) GDPR towards the practice; third-party calendar content is processed under the practice’s own responsibility.
6.11 Demo and pilot requests
The form on the website lets you book an online demo. We process name, email, optional phone and practice, specialty, preferred slot and your message so we can set up the appointment and send a Microsoft Teams invitation.
The demo runs on Microsoft Teams. Microsoft processes the technical data needed for the video call as a controller in its own right. We record the demo only if you expressly ask us to.
Legal basis: Art. 6 (1) (a) GDPR (consent in the form) and Art. 6 (1) (b) GDPR (performing the requested demo). Consent can be withdrawn at any time.
6.12 Error logs
In production, Azure Application Insights records technical errors. Telemetry that is not an error report is dropped, and the standard IP address field is set to 0.0.0.0.
We attach the request headers to an error report so the error stays traceable. Credentials (authorization, cookies, keys) and the IP address are redacted there; the browser identifier (user agent) can be included. Form content, such as the text of a message or booking details, is not written to the error logs. Only a small number of authorised people can access these logs. Retention: 30 days. Legal basis: Art. 6 (1) (f) GDPR.
6.13 Embeddable booking widget
The practice can embed booking on its own website. The widget loads our booking interface; booking data go to us as the practice’s processor, not to the operator of the embedding page. Legal basis: Art. 28 GDPR.
6.14 Website audience measurement
On tempulo.com we count how the site is used — for example whether visitors watch the film on the home page to the end, reach the prices or submit the sign-up form. For such an event the browser sends a short message to our API: the event name from a fixed list, the page path without parameters and the page language.
We set no cookies for this, store nothing on your device and assign no identifier that links page views to each other or to you. The IP address is not stored. The events are kept in Azure Application Insights in the EU and are only analysed in aggregate. Retention: 90 days. Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in improving the website. As nothing is stored on or read from your device, no consent under Section 25 TDDDG is required.
7. Cookies and local storage
We use no tracking cookies and no marketing pixel.
Strictly necessary storage (§ 25 (2) TDDDG) includes:
- short-lived SSO cookies during sign-in with an external provider (section 6.3)
- cookies Cloudflare or Turnstile may set for security
- the session token after login (
tokeninlocalStorage) - preferences such as language and dismissing notices (also stored locally on the device)
This storage is required for the service or for a step you explicitly requested. A tracking cookie banner is therefore not required.
8. Retention
We keep data only as long as needed for the purpose, legal duties or the establishment of claims.
| Data | Period |
|---|---|
| Practice and staff account | until the account is deleted, plus short backups (database 7 days) |
| Patient account | until the person deletes it; the practice record is unaffected |
| Client record, appointments, prescriptions (on the practice’s behalf) | according to the practice’s periods — in Germany usually ten years |
| Record access log | six years, then the link is removed |
| Login codes (OTP) | a few minutes |
| SSO cookies | 10 minutes |
| Demo requests | until the demo has taken place, then 12 months for follow-up unless you object sooner |
| Error logs | 30 days |
| Audience measurement events (section 6.14) | 90 days |
| Payment and invoice data | statutory retention (usually 10 years) |
9. Deletion — two paths
Deleting a record is an instruction from the practice to us as processor. The patient account is unaffected.
Deleting an account covers only that person’s account (practice, staff or patient). The practice record remains where statutory or contractual retention applies.
Where statutory retention or evidence duties apply (for example payment records), those data remain for that period.
10. Your rights
You have the right to
- access (Art. 15 GDPR),
- rectification (Art. 16 GDPR),
- erasure (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- object to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR),
- withdraw consent with effect for the future (Art. 7 (3) GDPR).
For access, export or deletion of the account, write to [email protected] or the address in the legal notice. Questions about the record and appointments go to the practice; we supply the data it needs.
You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). Ours is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW) Kavalleriestraße 2–4 40213 Düsseldorf Germany https://www.ldi.nrw.de
11. Required information
We cannot run an account without an email address. We cannot deliver the website without the technical data in section 6.1. Without name, contact details and a service the practice cannot accept an appointment. Other details are optional but may be required for individual features (practice legal notice, payments, calendar connection).
12. No automated decision-making
We do not take decisions that produce legal or similarly significant effects based solely on automated processing (Art. 22 GDPR).
13. Children
Tempulo is directed at practices, not at children. You must be at least 16 years old to create a practice or staff account; paid plans require full legal capacity to contract (clause 3 of the Terms).
Patients of any age can receive appointments. If a minor books themselves, they do so within what the practice allows; a patient account of their own requires the minimum age of 16.
14. Changes
We will update this notice if the service or the law changes. The version published here, with the date above, is the one that applies.