Your clients trust you with sensitive information

Where is my data stored?

Your data stays in your region on enterprise-grade cloud infrastructure. For New Zealand and Australia, booking and client records are stored in Sydney, Australia. Australia's Privacy Act 1988 provides comparable safeguards that support NZ cross-border requirements under Information Privacy Principle 12.

Is my client data secure?

We protect your data with multiple layers of security:

• Encryption in transit with TLS 1.2+ between browsers, the application, and our databases
• Encryption at rest for confidential information, including account passwords and API credentials for third-party connections. That covers payment gateways such as Stripe, POLi, Windcave, and Verifone, plus other integration secrets (for example OAuth tokens)
• Strict access controls so only authorised users in your practice can see client information
• Automatic backups to help prevent data loss
• Ongoing monitoring by our infrastructure providers

Who can access my client information?

Only you and the staff in your practice that you authorise. We have strict internal policies against accessing client data without a legitimate need. Our systems enforce partner-level isolation: queries are scoped so another business cannot see your records.

Is Quikly designed for healthcare privacy?

Yes. Many Quikly customers handle health-related bookings, patient forms, and treatment notes. We design with healthcare privacy requirements in mind:

• Confidential credentials encrypted at rest (passwords, payment gateway API keys, and integration secrets)
• Data encrypted in transit wherever it moves
• Secure authentication for staff and customer accounts
• Data isolation: each practice's data is completely separate
• Practices aligned to the NZ Health Information Privacy Code 2020 and Privacy Act 2020

What happens if there is a security incident?

We maintain multiple layers of protection, including:

• Enterprise DDoS and attack prevention at the infrastructure layer
• Threat detection and monitoring from our hosting providers
• If a notifiable privacy breach occurred, we would notify affected users and relevant regulators promptly, in line with Australian OAIC expectations and New Zealand OPC requirements (as soon as practicable under the Privacy Act 2020)

Can I export or delete my data?

You stay in control. You can export customer and booking records from your dashboard, request account deletion, and we honour data subject access requests. Contact [email protected]. Retention for health records may still apply where law or professional obligations require it. See our Privacy Policy for details.

Do you share data with third parties?

We never sell your data. Data is shared only with service providers needed to run the platform, for example:

• Payment processing (e.g. Stripe) for billing and client payments. Card data is handled by the payment provider
• Cloud infrastructure and database hosting, with encryption at rest and in transit
• Authentication and transactional email / SMS to deliver login codes, reminders, and messages you choose to send
• Optional integrations you connect (Google Calendar, Zoom, Dropbox, and similar), limited to what those integrations need

The full list of purposes is described in our Privacy Policy.