Plinou Rendez-vous is the online booking application of Plinou, for people and organizations that offer services by appointment. It runs at rdv.plinou.app. It is under development and is not yet open to the public: for now, access is by invitation only.
This policy covers the plinou.com website and the Plinou Rendez-vous application. It follows Quebec’s Act respecting the protection of personal information in the private sector (Law 25) and Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).
1. Who is responsible
Plinou is operated in Quebec, Canada. Plinou is a business name of Services Conseils AMD inc., registered with the Quebec Enterprise Register.
Mailing address: 7360 Avenue de Fougeray, Anjou, Quebec H1K 3K1
David Veilleux is the person in charge of the protection of personal information.
For any question, request or complaint: support@plinou.com.
2. Three different situations
This policy distinguishes people by the way they come into contact with Plinou.
Visitors to plinou.com. These are the people who browse the website, write to Plinou or sign up for the news list. Plinou is responsible for their information. Part A describes it.
Plinou Rendez-vous users. These are the people and organizations who open an account to manage their appointments. For their account information, Plinou is responsible and this policy applies in full. Part B describes it.
Clients of users. These are the people who book an appointment with a Plinou Rendez-vous user. Their information belongs to the user or organization they book with. That organization is responsible for their information and answers their requests. Plinou Rendez-vous acts as its service provider: it keeps and uses this information only to provide the service, following the organization’s instructions. A client who wants to see, correct or withdraw their information should first contact the organization they booked with. Plinou helps it respond.
Part A. The plinou.com website
3. What the website collects
The contact form
When you write to Plinou through the contact form, the message is sent by the website’s server. It contains what you write: usually your name, your email address and your message. This information is used to answer you. It arrives in Plinou’s mailbox, hosted by WHC, and is kept for as long as it takes to handle your request and follow up. It is not sold or used for any other purpose.
Protection against bots
The forms are protected by ALTCHA. This tool asks your browser to do a small calculation to show that you are not a bot. It sets no cookie, does not follow you from site to site and calls no third-party service: the check runs on Plinou’s own server.
The news list
You can sign up your email address to be told about new Plinou applications and news. You first receive an email with a confirmation link. Until you confirm, you are not subscribed. Every email contains a link to unsubscribe in one click. The list is private, kept at WHC, and shared with no one. It is used only to write to you about Plinou.
The embedded booking page
The contact page may display the booking page of rdv.plinou.app, in the Plinou organization, so you can book a meeting with David. When it is displayed, your browser connects to rdv.plinou.app. If you book, the information you enter is handled by Plinou Rendez-vous, as described in Part B. Plinou is then the organization you are booking with.
Hosting
The website is hosted by WHC, in Canada. Like any host, WHC may keep technical server logs (for example the IP address and the page requested) to keep the service secure and running. Plinou does not use them to measure audience or to follow you.
What the website does not do
- No tracking, advertising or analytics cookies.
- No analytics tools and no advertising pixels.
- Fonts and images are served by the website itself, not by a third-party service.
Links to other websites open sites that have their own practices.
Part B. The Plinou Rendez-vous application
4. Information collected
For users
- Account information: name, email address, password (stored in a form that cannot be read back), language and time zone.
- Information the user chooses to show their clients: practice name, office address, phone number, signature, Interac e-Transfer payment details, and the text of their pages and emails.
- Account and organization settings: hours, appointment types, prices, cancellation policies.
- The connections the user makes with other services (calendar, video conferencing, payment). Access tokens are encrypted.
For clients of users
- Contact information given when booking: name, email address, phone number and, if the organization asks for them, mailing address or date of birth.
- Appointments: date, time, appointment type, location or video link, cancellations and changes.
- Payments and receipts: amount, payment method and status. Plinou Rendez-vous never sees a credit card number: online payments are made with the payment provider.
- Consents given: the exact version of the text accepted, the language and the time.
- Fields the organization adds to its client records. Each field carries a warning not to enter any health information.
The intake form
An organization can ask its clients to fill out a form before the first meeting. This form may contain health questions. Plinou Rendez-vous does not keep these answers in its database. They are encrypted as soon as they arrive, turned into a PDF, then delivered to the organization at the place it chose (its online storage or its email), or kept encrypted until it picks them up, for 60 days at most. They are then destroyed. The client can download their own copy for 7 days. No one at Plinou reads these answers, and no artificial intelligence reads them.
What Plinou Rendez-vous does not collect
- No IP address is kept.
- No advertising or analytics cookies. The only cookie is the session cookie, needed for forms and sign-in to work.
- No analytics tools and no advertising pixels, on the website or in the application.
- No clinical notes and no stored health information.
5. What the information is used for
Plinou Rendez-vous uses the information only to provide the service:
- show availability and record appointments;
- send confirmations, reminders and appointment management emails;
- add appointments to the user’s calendar and prevent double bookings;
- create video meeting links;
- receive payments and issue receipts;
- answer support requests;
- protect the service against abuse and keep it secure.
Plinou Rendez-vous does not sell any personal information, does not do targeted advertising and does not build profiles of clients.
6. Google user data
A user can connect their Google account to Plinou Rendez-vous. Plinou Rendez-vous then asks for the following access:
- The Google account email address, to show which account is connected.
- Read access to calendars (the list of calendars and busy times), so that a client is never offered a time when the user is already busy. Plinou Rendez-vous reads busy times, not the content of the user’s events.
- Creating, updating and deleting the events Plinou Rendez-vous creates itself, to add appointments to the user’s calendar and, if the user chooses, attach a Google Meet link. The user can turn off writing to their calendar.
- Google Drive, only for files Plinou Rendez-vous creates, if the user chooses Google Drive to receive their intake forms. Plinou Rendez-vous cannot see the other files in their Drive.
This data is used only for the features described above, which the user sees and uses. Plinou Rendez-vous does not sell it, does not use it for advertising, does not share it with anyone else and does not use it to train any artificial intelligence model. No one at Plinou reads it, except with the user’s permission, for security reasons, or to comply with the law.
Plinou Rendez-vous’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
The user can remove this access at any time: by disconnecting Google in Plinou Rendez-vous, or in their Google account settings (myaccount.google.com/permissions). The access tokens are then deleted from Plinou Rendez-vous.
The same rules apply to the Microsoft (Outlook, OneDrive, SharePoint), Apple iCloud and Zoom accounts a user connects.
7. Who the information is shared with
Plinou relies on providers to run the website and the application. Each one receives only what it needs for its task.
| Provider | Role | Location |
|---|---|---|
| OVHcloud | Hosting of the application’s server and database | Beauharnois, Quebec |
| WHC | Email delivery, hosting of the plinou.com website and of its news list | Canada |
| Google, Microsoft, Apple, Zoom | Calendars, video conferencing and file storage, only if the user connects them | United States and elsewhere |
| Stripe, PayPal | Online payments, only if the user turns them on | United States and elsewhere |
| Twilio | Text message reminders, only if the user turns them on | United States |
| Anthropic | Help assistant in the user’s panel | United States |
Protection against bots (ALTCHA) runs on Plinou’s own servers and uses no provider.
Some of these providers are outside Quebec. Before using them, Plinou assesses the protection they give to personal information.
The help assistant. In their panel, the user can ask questions to an assistant that helps them set up Plinou Rendez-vous. The assistant receives the user guide and the user’s account settings, to answer for their situation. It never receives any information about clients: no names, appointments, documents, notes or payments. Passwords and keys are never sent to it. Plinou Rendez-vous does not keep the conversations.
Other cases. Plinou may disclose information when the law requires it, for example under a court order.
8. How long information is kept
- Contact form messages: for as long as it takes to handle the request and follow up.
- User account: as long as the account is open. When an organization closes, its data is given to it in an export, then destroyed 30 days later.
- Clients: a client with no appointment for 24 months is anonymized. The organization can change this period.
- Payments and receipts: 7 years, as tax rules require, without the client’s name once the client is anonymized.
- Intake form: destroyed as soon as it is delivered, and at most 60 days after it is received if it was not picked up. The client’s copy: 7 days.
- Backups: encrypted, kept 14 days on the server and 30 days in a backup copy in Quebec.
9. Security
- All communications use an encrypted connection (HTTPS).
- Access tokens to other services, intake forms and backups are encrypted.
- Each organization sees only its own data. A user sees only their own clients, unless their organization gives them another role.
- A log records sensitive access, without its content.
- The Plinou team enters an organization’s account only with its permission, for a limited time, and each access is logged.
If a privacy incident presents a risk of serious injury, Plinou notifies the people concerned and the Commission d’accès à l’information du Québec, as the law requires.
10. Your rights
You can ask:
- to see the personal information Plinou holds about you;
- to have it corrected;
- to receive it in a common format, so you can take it elsewhere;
- to withdraw a consent, or to have your information deleted where the law allows it.
Write to support@plinou.com. Plinou answers within 30 days. If you are a client of a Plinou Rendez-vous user, first contact the organization you booked with (see section 2).
If you are not satisfied with the answer, you can file a complaint with the Commission d’accès à l’information du Québec (cai.gouv.qc.ca) or with the Office of the Privacy Commissioner of Canada (priv.gc.ca).
11. Changes
Plinou may change this policy. The date at the top of the page shows the latest version. If a change affects how your information is used, users are notified by email before it takes effect.