Privacy in brief
MyChiro provides practice-management software to chiropractic clinics. We do not sell personal information or use patient information for targeted advertising. Clinics control their patient records; MyChiro processes those records to provide the services requested by each clinic.
1. Who we are and the scope of this policy
“MyChiro”, “we”, “us”, and “our” refer to the provider of the MyChiro website and practice-management platform. This policy applies when you visit our public website, use MyChiro as a clinic or staff member, complete a patient-facing flow, or receive or send communications through a MyChiro integration.
A clinic generally decides why and how its patient information is processed and is the responsible party or controller for that information. MyChiro generally acts as the clinic’s operator or processor. Questions about a patient record, treatment, appointment, or message should normally be directed to the clinic first.
2. Information we collect
Depending on how you interact with MyChiro, we may process:
- Account and practice information: names, work contact details, authentication and access information, roles, clinic details, and configuration preferences.
- Patient and clinical information: identity and contact details, appointment information, intake responses, consent records, clinical records, billing information, and related documents entered by or for a clinic.
- Communications information: email addresses or mobile numbers, message purpose and template data, provider message identifiers, delivery status, timestamps, and limited error information.
- Integration information: business, WhatsApp Business Account, phone-number and template identifiers, connection status, and encrypted credentials needed to operate an integration.
- Technical and usage information: device, browser, IP address, access logs, security events, and diagnostic information generated when the website or service is used.
- Enquiry information: details you choose to provide when contacting us or requesting a demonstration.
We receive this information from you, your clinic, authorised clinic staff, service providers such as Meta, and the systems you choose to connect to MyChiro. Please do not submit patient or sensitive health information through the public marketing-site contact form.
3. How we use personal information
We use personal information where reasonably necessary to:
- provide, configure, support, and secure the MyChiro service;
- manage appointments, intake, records, documents, billing, and clinic workflows;
- send requested transactional notices, invitations, reminders, and updates;
- connect and maintain clinic-selected services, including WhatsApp;
- authenticate users, manage permissions, prevent misuse, and investigate incidents;
- monitor delivery, troubleshoot errors, and improve reliability;
- respond to enquiries and communicate about the service; and
- meet contractual, professional, regulatory, and legal obligations.
Our processing is based, as applicable, on providing contracted services, the instructions and lawful activities of a clinic, consent, legitimate operational interests, and compliance with law. Clinics are responsible for obtaining any patient permissions required for their use of MyChiro.
4. WhatsApp and Meta services
A clinic may choose to connect its WhatsApp Business Account to MyChiro. When it does, MyChiro uses Meta’s WhatsApp Business Platform to register the clinic’s number, manage approved message templates, send clinic-requested transactional messages, and receive delivery, template, and account-status webhooks.
Information disclosed to or received from Meta may include:
- a recipient’s mobile number and the transactional message content;
- the clinic’s WhatsApp Business Account, business, and phone-number identifiers;
- message-template names and status;
- provider message identifiers and sent, delivered, read, or failed status; and
- limited inbound-message identifiers needed for deduplication and audit.
MyChiro currently records inbound WhatsApp event metadata but does not provide a general-purpose WhatsApp chat inbox or use inbound message content for advertising. Meta processes information under its own terms and privacy notices. You can review the WhatsApp Privacy Policy.
Clinic administrators can disconnect the WhatsApp integration. Patients can ask the clinic that contacted them to stop WhatsApp messages or to use another available channel. Disconnecting does not automatically erase records that must be retained for security, audit, contractual, or legal reasons.
6. Website, cookies, and external services
The MyChiro marketing website is static and does not intentionally set advertising cookies or collect patient records. Our hosting provider may generate basic security and access logs. The site loads fonts from Google, which may receive technical information such as your IP address and browser details under Google’s own privacy terms. Links to external websites are governed by those websites’ privacy policies.
7. Retention and deletion
We retain personal information only for as long as reasonably needed to provide the service, follow a clinic’s lawful instructions, maintain security and audit records, resolve disputes, and comply with legal or professional recordkeeping requirements. Retention periods differ by record type and clinic configuration.
When information is no longer required, we delete, de-identify, or securely isolate it in accordance with applicable requirements and backup cycles. A clinic’s termination of MyChiro or disconnection from WhatsApp does not override lawful retention obligations.
8. How we protect information
We use administrative, technical, and organisational safeguards designed for the sensitivity of the information processed. These include authenticated staff surfaces, access controls, separation of clinic data, encrypted integration credentials, webhook signature validation, audit records, and Azure-hosted infrastructure controls. No system can guarantee absolute security.
Learn more in our Security & hosting overview.
9. Your choices and privacy rights
Subject to applicable law, including South Africa’s Protection of Personal Information Act (POPIA), you may have the right to request access to or correction of your personal information, request deletion or restriction, object to certain processing, withdraw consent, or complain to the relevant regulator.
For patient information held for a clinic, contact that clinic first so it can verify your identity and assess clinical or legal retention duties. We assist clinics with valid requests. For information controlled directly by MyChiro, use the contact method below. We may need to verify your identity before acting.
You may also lodge a complaint with South Africa’s Information Regulator.
10. Children’s information
MyChiro is not directed to children for independent use. A clinic may process a minor patient’s information as part of providing healthcare, subject to the clinic’s legal duties and the involvement of a parent, guardian, or other authorised person where required.
11. Changes to this policy
We may update this policy as our services, providers, or legal obligations change. We will publish the revised policy here and change the effective date. We will provide additional notice where a material change requires it.
12. Contact us
For privacy questions or requests concerning MyChiro-controlled information, contact MyChiro and identify your request as a privacy or data request. Do not include clinical details or other sensitive patient information in the public contact form.
For a patient record or a message sent by a clinic, contact the clinic directly. The clinic can then work with MyChiro where support is required.