Privacy Policy
Effective date: October 6, 2026
HM Behavioral Health, LLC, doing business as PracticeCal (“PracticeCal,” “we,” “us”) provides a service that copies appointments from a medical practice’s Tebra account to its providers’ Google Calendars, and, if a provider chooses, places “Unavailable” holds in Tebra for times the provider is busy on Google Calendar. This policy explains what information we handle, why, and how it is protected.
Who uses PracticeCal
PracticeCal is used by practice administrators, who connect a practice’s Tebra account, and providers (clinicians), who connect their own Google account. Patients do not use PracticeCal directly. Practices are our customers. For patient information, PracticeCal acts as a business associate of the practice under HIPAA and handles that information under a Business Associate Agreement (BAA) with the practice.
Information we handle
| Category | What | Why |
|---|---|---|
| Account information | Email addresses of practice administrators and providers; provider name and Tebra provider ID; practice name and Tebra practice ID. | To sign you in with one-time email links and match providers to their Tebra records. |
| Tebra connection | The Tebra API username, password and customer key a practice administrator provides. | To read the practice’s schedule and, if enabled, add “Unavailable” holds. Stored encrypted. |
| Appointment information (from Tebra) | Appointment IDs, dates and times, status, appointment type, whether a visit is virtual or in person, and the patient’s name, which is used only to create initials. | To create and update matching Google Calendar events. We store appointment IDs, times and status, but not patient names. Only initials are written to Google Calendar. |
| Google account access | OAuth tokens for the provider’s Google account; the provider’s list of calendars (names and IDs). | To let the provider choose a calendar and keep events updated. Tokens are stored encrypted. |
| Google Calendar events PracticeCal creates | Events PracticeCal itself adds for Tebra appointments. | To update or remove them when the appointment changes in Tebra. |
| Busy times (only if busy-time sharing is on) | For the calendar the provider chooses: each event’s start and end time, whether it’s marked busy or free, whether the provider declined it, and the event type. We do not read event titles, descriptions, locations or guest lists. | To place “Unavailable” holds in Tebra at those times, and to remove them when the time is no longer busy. |
| Service records | Sync history (times and counts of changes), hold records (Tebra IDs and times) and error logs. | To run, troubleshoot and secure the service. |
| Cookies | A single sign-in session cookie on the PracticeCal app. | To keep you signed in. We do not use advertising or analytics cookies. |
How we use information
We use information only to provide, maintain, secure and support PracticeCal, and to communicate with you about it (for example, sign-in emails and, at a practice administrator’s request, invitations to providers). We do not sell information, use it for advertising, or use it to train artificial intelligence models.
Google user data
PracticeCal requests access to Google Calendar so it can list your calendars, add, update and remove the appointment events it creates, and, if you turn on busy-time sharing, read the times of events on the calendar you choose. PracticeCal’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Google user data is used only to provide the calendar sync you set up. It is not used for advertising, not sold, and not read by people except with your permission, for security purposes, or as required by law. You can remove PracticeCal’s access at any time from your Google Account’s security settings (Third-party apps with account access).
How information is shared
We share information only:
- As you direct: appointment events go to the provider’s Google Calendar, and busy-time holds go to the practice’s Tebra account.
- With service providers that host and operate PracticeCal under contract and appropriate safeguards (including a BAA where required): Google Cloud (hosting) and Google Workspace (email delivery).
- For legal reasons: to comply with law, or to protect the rights, safety and security of users, patients or PracticeCal.
- In a business transfer: as part of a merger or acquisition, subject to this policy and any BAA.
Security
Information is sent over encrypted connections (HTTPS/TLS). Tebra credentials, Google tokens and appointment records are encrypted at rest (AES-256). Access is limited to what’s needed to operate the service. Sign-in uses one-time email links that expire after 15 minutes. No system is perfectly secure. If we learn of a breach affecting your information, we will notify you and the practice as required by law and our agreements.
Retention and deletion
We keep information while a practice or provider uses PracticeCal. When a provider disconnects or a practice ends its use, we delete the related credentials, tokens and appointment records within 30 days, except where the law requires us to keep them. Backups are removed on a rolling 30-day schedule. To ask for deletion sooner, contact us at the address below. Events already on your Google Calendar stay there unless you remove them.
Your choices
- Providers can pause syncing or turn off busy-time sharing at any time. Either way, PracticeCal removes the holds it added in Tebra.
- You can revoke Google access at any time in your Google Account.
- You can ask to access, correct or delete your account information by contacting us. Requests about patient information should go to the practice, which we will assist as its business associate.
Children
PracticeCal is a professional tool and is not intended for anyone under 18.
Changes
If we change this policy, we will update the effective date above and, for material changes, notify practice administrators and providers by email before the change takes effect.
Contact
HM Behavioral Health, LLC (d/b/a PracticeCal) · 3229 Cranberry Highway, Suite 5, Buzzards Bay, MA 02532
hello@practicecal.com