Loyaly01What this covers
This policy is about the Loyaly app: what it collects from you, why, and what happens to it — as opposed to loyalyapp.com, the website you’re probably reading this on, which has its own, separate policy for its own, much smaller "Build my app!" form.
It applies whether you use the app as a clinic’s client, as a clinic owner or manager, or as a clinic staff member (worker).
02Who is responsible
The operator of this website and of Loyaly is Nour Arraf.
For anything on this page, write to support@loyalyapp.com.
03What we collect
If you’re a client of a clinic using Loyaly: your name, email address, phone number, birthday, gender if you choose to share it, a profile photo if you add one, and your city. We also hold your booking history, loyalty points and rewards, any orders you’ve placed through the app, photos a clinic adds to your appointment record, and messages you send through in-app chat.
If you work at a clinic using Loyaly, as an owner, manager or staff member: your name, email, phone number and role, plus your own shift, scheduling and points data where that applies to you.
From your device either way: a push notification token, so we can send you notifications; your device platform; and, if something goes wrong, a basic diagnostic error report that never includes your conversations or clinical notes.
04Why we collect it
To run the loyalty program you signed up for: tracking your points and rewards, managing your bookings, letting a clinic reach you about your own appointments, and sending the notifications you’ve opted into, such as a reminder, a reward unlocking, or a booking confirmation.
None of it is used for advertising, and none of it is sold.
05Who can see it
Only the specific clinic, or clinics, you’re a client of. A clinic you’ve never joined has no access to your data, and each clinic’s client list is completely separate even inside the same app. If you belong to more than one clinic, each one only sees your account and activity with them, not with the others.
06Where it’s stored
Our database runs on Supabase, hosted in Frankfurt, Germany, in the European Union.
Push notifications are delivered through Firebase Cloud Messaging, part of Google. This means a notification token and the notification’s content briefly pass through Google’s infrastructure to reach your device, the same as it does for effectively every app that sends push notifications.
07How long we keep it
An account that’s never verified, by email, phone or otherwise, and has no bookings, visits or orders is automatically removed after 90 days of inactivity.
Diagnostic error logs are kept for 90 days, then deleted.
Notification records we use only to avoid sending you the same reminder twice are kept for one to two years, then deleted.
Otherwise, your account and activity are kept for as long as you remain a client of the clinic, or an active staff member, so your points, history and rewards stay intact.
08Deleting your account
You can request deletion from inside the app. When you do, we remove your name, phone number and email from your account and from every record that referenced them, including bookings, chat, notifications and invitations, delete any photos on file for you, and delete the underlying login.
Your appointment and transaction history is kept in an anonymised form, with your identity stripped out, because clinics may be legally required to retain financial and, where applicable, clinical records for a period after the fact. No name, contact detail or photo survives that process, only the fact that an anonymous transaction occurred.
09Age
The app is not directed at children, but a clinic’s own clients may include people under 18 depending on the services that clinic offers. Where that applies, it is the clinic’s responsibility, as the party with the direct relationship to that client, to obtain any parental or guardian consent their local law requires before that client’s account is created.
10Your rights
You can ask us for a copy of what we hold about you, to correct it, to delete it, to restrict what we do with it, or to object to it. Write to support@loyalyapp.com and we will answer within one month.
If you think we have handled your data badly, you can complain to the Agencia Española de Protección de Datos at www.aepd.es. We would rather you told us first.
11Changes
If this policy changes, the date at the top changes with it. If a change matters to an enquiry you have already sent, we will email you.