Effective date: September 23, 2026
ScriptMates provides operational software and services for clinics, pharmacy partners, and authorized workforce users. This policy describes the information ScriptMates collects and how it is used. It applies to the public website, authenticated ScriptMates applications, and optional third-party connections.
Information we collect
We collect information that you or your organization provide, such as account identity, contact information, clinic or organization details, support requests, and records created through authorized platform workflows. Public-site analytics remain optional and do not intentionally include form contents, authenticated application activity, patient information, order details, or payment details.
Google user data
ScriptMates accesses Google user data only after an authenticated user chooses to connect a Google account and grants permission on Google’s consent screen. The connection may access:
- Google account identity: the connected email address and account identifier, used to show which account is linked and keep reconnections associated with the correct account.
- Google Calendar events: events on the connected user’s primary calendar, used to display and synchronize appointments and create, update, or delete events and Google Meet links. Authorized administrators can see connected employees’ availability as busy blocks. ScriptMates workspace appointments follow the clinic or team’s access permissions.
- Gmail sending: permission to send user-initiated ScriptMates communications from the connected account. ScriptMates does not request permission to read the user’s Gmail inbox, messages, or contacts.
- Google Sheets (read-only): used by authorized ScriptMates staff to import configured company workbooks into internal sales reports and the product catalog. ScriptMates does not edit, create, or delete the source spreadsheets.
ScriptMates does not use Google user data for advertising, credit decisions, generalized AI-model training, or sale to third parties.
How Google user data is stored and protected
ScriptMates stores the connected email address, granted scopes, connection timestamps, and encrypted OAuth access and refresh tokens needed to keep the connection working. Calendar information is retrieved to provide the calendar experience; event identifiers and related scheduling details may be stored with ScriptMates interaction records when needed to deliver that user-facing feature.
ScriptMates uses encrypted transport, encrypted credential storage, role-based access controls, and audit logging designed to protect connected-account data. No security method can guarantee absolute protection, and users should connect only accounts approved for their organization’s workflow.
Sharing and transfer
Google user data is transmitted to Google APIs to perform the action the user requested and may be processed by infrastructure or service providers solely as needed to operate and secure ScriptMates. ScriptMates may disclose information when required by law or to protect users, the platform, or the public. ScriptMates does not sell Google user data or transfer it for personalized advertising.
ScriptMates’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Retention, disconnection, and deletion
Connected-account data is retained only while needed to provide the connection, meet applicable legal or security obligations, and maintain authorized business records. Disconnecting in ScriptMates revokes Google access and removes the active saved OAuth connection credentials after revocation succeeds. Encrypted infrastructure history or backups may retain revoked credentials under their retention policies. Google revocation can also disconnect Calendar, Gmail sending, and Sheets connections that use the same Google account in the ScriptMates Google project. If revocation or credential removal fails, ScriptMates reports the failure so the user can retry. Users can also revoke ScriptMates access from their Google Account settings. Disconnecting does not erase previously created appointments, delivered emails, or imported business records.
To request deletion of connected Google account data or ask a privacy question, email info@scriptmates.com. We may need to verify the requester’s identity and authority before fulfilling a request.
Healthcare and sensitive information
Organizations are responsible for deciding which accounts and connected services are approved for their regulated workflows. Users should not place protected health information or other sensitive data in a personal Google account unless their organization has expressly approved that use and the required agreements and controls are in place.
Policy changes
We may update this policy as the platform, law, or our data practices change. The effective date above identifies the current version. Material changes will be communicated through the website, platform, or other appropriate channel.