How Book Lab protects patient information

Where does a booking actually go?

A patient fills in the booking form on your booking page. Book Lab checks the details are valid, then writes the appointment directly into your practice management software. That's the whole journey. The appointment sits in your appointment book alongside the ones reception entered by hand, and your practice software takes over from there.

What does Book Lab store?

Nothing. Each booking is validated, passed on and gone. Zero retention is a design rule, not a setting: there is no database in the platform to store patient details in. If you ever change plans or leave, there is no data to migrate or ask us to delete, because we never had it.

Who can see patient details?

Your team, inside your practice software, under the access controls you already manage. Book Lab's connection does two things: it checks appointment availability and it creates bookings. It has no endpoint for reading patient records, notes or history, so patient information cannot be browsed or exported through it. Each practice's integration credentials sit in their own encrypted vault, separate from every other practice.

Does data leave New Zealand?

No. Bookings are health information under the NZ Health Information Privacy Code 2020, and Book Lab treats them that way: collect the minimum, retain nothing, and keep processing in a New Zealand data centre.

What happens when something breaks?

If a booking can't reach your practice software, the patient sees an honest message asking them to phone the practice. Nobody gets a confirmation for an appointment that doesn't exist. We'd rather lose a booking than fake one.

How is the platform tested?

We attack it ourselves, continuously. Book Lab uses the latest AI-driven security testing to probe the platform around the clock, the way a real attacker would, proving what's exploitable instead of guessing. A traditional penetration test happens once a year and starts ageing the day the report lands. Ours never sleeps. Testing is included in every plan, never sold as an extra. The site you're reading now runs with a strict content security policy and makes no third-party requests at all.