Calendar Privacy for Wellness Providers: What Your Scheduling Tool Can See

By the Riverd Editorial Team. Last updated: 2026-06-17.

Scheduling software privacy is one of the questions wellness providers think about least and should think about most. When a wellness provider connects a scheduling tool to Google Calendar, most tools by default read the full event details. The title. The description. The attendees. The location. The scheduling vendor stores some of that on their servers to render conflict messages and reminders. For a therapist whose Google Calendar has events titled "Couples therapy with the Smiths" or "Pelvic floor PT, follow-up," that is a privacy footprint worth understanding before you click "Allow."

This is for solo and small-practice providers in modalities where client context is sensitive: therapists, counselors, acupuncturists, pelvic floor PTs, sex therapists, anyone who has thought twice about HIPAA before. Even if you are not under a strict HIPAA obligation, the principle holds. Personal context should stay personal.

What a scheduler can technically see

Google Calendar's API exposes several scopes (documented in Google's Calendar API auth reference). The two that matter for scheduling integrations are:

• calendar.events. Full read and write to your events. This includes titles, descriptions, attendees, locations, conference data. Most scheduling tools request this scope by default because it makes the engineering easier (one scope handles both reading existing events and writing new bookings into the calendar).
• calendar.freebusy. A more limited scope that returns only the busy time blocks (start and end), with no event details. This scope is what a privacy-aware scheduler asks for on the read side, with calendar.events only on the specific calendar where the scheduler is allowed to write its own bookings.

The difference matters because of the OAuth consent screen. When you grant calendar.events, you are giving the vendor's servers the ability to fetch every title and description in your calendar. Whether they store that data, surface it to staff, or display it back to clients depends on the vendor's choices. Most do not publish a granular policy on this.

This is where the question to ask becomes specific: "Does your scheduler read event titles, or only free or busy time?" If a vendor's website does not say, assume the answer is "we read everything, that is the default."

Why this matters more for clinical providers

Three reasons.

First, calendar event titles for a clinical practitioner are protected health information by inference. A title that says "Therapy with Jane Doe, intake" combined with a recurring 4pm Wednesday slot tells anyone with access that Jane Doe is in therapy with you. The fact pattern is the diagnosis hint. HIPAA does not require the title to literally say "depression" for the event to be sensitive.

Second, vendor breaches happen. The fewer vendor servers that have your calendar event titles, the smaller your exposure surface. A scheduler that reads only free or busy time has nothing to leak about what your Wednesday at 4pm actually is.

Third, client trust is downstream of provider trust. Clients in modalities like couples therapy, sex therapy, addiction counseling, or pelvic floor PT are choosing the practice partly on the question "is this person careful about my privacy." A provider who can answer "my scheduling tool cannot see your name on my calendar" is in a better position than one who cannot.

A note on HIPAA specifically. A standard Google Workspace account is not covered by Google's HIPAA Business Associate Agreement unless the organization has signed one and configured it. Many solo providers operate in this gray zone, neither fully covered nor fully exempt, and the right defensive posture is the same either way: keep clinical detail off Google Calendar, prefer tools that read only free or busy time, and document what your tools have access to. This is informational, not legal advice.

What to ask before connecting any scheduler

Five questions, in this order. If a vendor cannot answer in plain language, that is itself an answer.

1. What OAuth scopes does your integration request? A clear answer names the scopes (calendar.freebusy, calendar.events) and explains which is used for what. A vague answer ("standard calendar access") is a yellow flag.

2. Do you read event titles or descriptions, even if you do not display them? Reading and displaying are separate questions. A vendor can technically request the full event scope but only display "Busy" inside their UI, while still storing the title on their servers. Press for both.

3. Do you store any of my calendar data on your servers, and for how long? The honest answer is usually "we cache busy blocks for performance, with a TTL of N days, and we do not persist event titles." If the answer is "we sync your full calendar," ask for the retention policy.

4. What does the conflict UI say? When a scheduling conflict happens, does the vendor's UI show "Conflict with: Therapy with Jane" or "Conflict with: your Google event"? The first leaks. The second does not.

5. Can I revoke and what happens to the cached data? Disconnect should be one click and should purge any cached calendar data on the vendor side, not just stop new syncs.

The answers to these five questions sort the privacy-careful tools from the rest. Most general-purpose schedulers fail at least one. Wellness-specific tools are usually better, but it is still worth asking.

How Riverd handles this

We made a few choices that follow from the section above. They are locked, not toggleable.

• Free or busy time only on the read side. Riverd's Google Calendar integration reads freeBusy only, never event titles or descriptions. This is by design. There is no admin setting that opens up full event access. We never see your event titles, so we cannot leak them.
• The conflict banner says "your Google event," not the title. When a personal event lands on top of an existing client booking, the banner you see inside Riverd reads "Heads up, your Google event overlaps a confirmed booking." It does not read "Heads up, your therapy appointment overlaps." This matters in the cases where another person (a virtual assistant, an admin) might see your screen.
• One write target, your choice. You pick exactly one Google calendar where Riverd writes its bookings. If you want bookings in a separate "Work" calendar so your family-shared calendar shows nothing identifiable, that works. If you want everything on your primary calendar, that works too.
• Disconnect is one click and revokes immediately. Disconnect stops both the read and the write. We also delete the cached busy blocks and revoke the webhook channel registered with Google. The OAuth refresh token is removed.

You can read the full feature description on the calendar sync feature page and our privacy policy. The companion blog post on stopping double-bookings covers the workflow side of the same feature. For more on regulatory and professional standards in wellness practice, see the compliance hub.

Key takeaways

• Most schedulers request full Google Calendar event access by default, including titles and descriptions. Free or busy only is a deliberate, smaller-footprint choice that few competitors make the default.
• For clinical and wellness providers, calendar event titles are sensitive by inference. A title plus a time slot can imply a diagnosis or relationship.
• Five questions to ask any scheduler: which scopes, whether titles are read, what is stored and for how long, what the conflict UI shows, and how disconnect works.
• Riverd reads free or busy only, says "your Google event" generically in the conflict banner, and treats disconnect as a full revoke.

This article is for informational purposes only and does not constitute legal advice. Consult a HIPAA attorney or compliance specialist for guidance on your specific situation.

[HERO IMAGE NEEDED: A clinical or wellness desk in soft, low-key natural light, showing a closed laptop with a small printed appointment list face-down beside it (privacy as a posture). Or a stylized abstract of a calendar week with two layers, one fully detailed and one redacted to plain "Busy" blocks, in muted Nordic palette. No people as focal subject. No readable PHI. 16:9 landscape, documentary 35mm or wabi-sabi style.]

Ready to simplify your practice? Start Free →