API Terms of Use

These API Terms of Use apply when your business connects software to Daobook through the Daobook API: software of your own, built or run by your developer, and apps that members of your team connect to act as themselves, such as an AI assistant. They sit alongside our Terms of Service and Privacy Policy, which continue to apply. The owner of your Daobook subscription accepts these terms once, in Settings → Integrations → Developer API, before a key is made or an app is connected, and Daobook records which version was accepted, by whom, and when.

1. The words used here

You and your business mean the business that holds the Daobook subscription. Emba Digital (ABN 89 683 319 486) is we and Daobook.
Your developer means anyone you let build or run software that uses your keys: an employee, a contractor, or an agency.
Your software means software of your own that uses a key: a website, an app, a phone receptionist, a CRM, or a server, wherever it runs.
A key is an API key made in Daobook under Settings → Integrations → Developer API. It acts for your business.
A connected app is software a member of your team connects to Daobook through Daobook's own sign-in screen, to act as that member: an AI assistant, a desktop tool, or a service that works for one person. It acts as that member, within their role, and only where they work.
Scopes are what a key or a connected app is allowed to do, ticked in Daobook's own words when the key is made or the app is allowed.
Patients are the people your clinic treats, called clients in Daobook.

2. What the API is for

The Daobook API lets your software, and your team's connected apps, do for your own business what Daobook itself does for the diary, within the scopes you allow: read which locations, practitioners, and appointment types are bookable online and when; make, move, cancel, and confirm bookings under the online-booking rules you set in Daobook; read the diary; read and update your client list (names, contact details, addresses, contact preferences, and each client's home location and practitioner); put callers on the waiting list; and, for a phone receptionist, check who is calling. It also tells your software when something changes.

It is never a way into clinical records. No consultation, note, prescription, file, or form answer leaves Daobook through the API, and nor do invoices or payments. What the API offers grows over time. The current scope, the reference, and the changelog are published at daobook.com.au/developers.

3. Your keys and your team's connections

Keys belong to your business. Only the subscription owner can make or revoke one, and a key is shown once, when it is made.
A key lives on your server. It is never placed in a web page, in an app on a patient's device, or anywhere else a patient could read it.
Give each piece of software its own key, named for what it is, with only the scopes and locations it needs, so that you can revoke one without touching the rest.
A connected app holds tokens of its own, issued when a member allows it. It acts as that member and reaches only what their current role allows at each location, so a change of role, or leaving the clinic, takes effect at once. The member can end the connection at any time under Settings → Security → Connected apps, and an owner or admin can end any member's.
Daobook will never ask you for a key or a token. A message asking for one is not from us.

4. Your developers, your systems, and the apps your team connects

You are responsible for everyone and every system that uses your keys, wherever they are and wherever they are hosted. Their use of the API is your use, under these terms and the Terms of Service.

A connected app is your business disclosing its information to that app's provider, on the agreement your business has with them. When a member connects an assistant, what they ask it and what it reads go to the assistant's provider under that member's account with the provider. Decide which apps your team may connect; an owner or admin can see and end every connection.

If your software, a connected app, or their servers are outside Australia, your business is disclosing patients' personal information overseas and remains accountable for it under the Privacy Act 1988 (Cth), including Australian Privacy Principle 8. Make that decision knowingly, and tell your patients where your own privacy notice requires it.

5. Patient information

Appointment details and a patient's record are health information under Australian privacy law, which makes them sensitive information. Within the scopes you allow, your software or a connected app receives patients' names and contact details, their bookings, and the client details described above. You agree to:

collect and hold that information under the Privacy Act and any health-records law that applies to your practice, with the consent your patients need to give
use it only to run your practice, and never for marketing, profiling, or sale unless the patient has separately agreed; where your software records a patient's marketing consent through the API, your business holds that consent and the proof of it
keep it only as long as your business needs it, and protect it in transit and at rest
show patients your clinic's booking terms and privacy information before they book through your software wherever your Daobook booking settings require their acceptance, because your software records that acceptance on the patient's behalf, and the API refuses a booking without it

Daobook writes every read of a patient's record through the API on that record, naming the key, or the member and the app, so your clinic can always see who looked at what.

6. If a key leaks or something goes wrong

If you suspect a key or a connection has been compromised, revoke the key or end the connection in Daobook at once, then tell us at admin@daobook.com.au straight away. We would rather hear about a false alarm than hear nothing.
Daobook keeps a record of every request a key or a connected app makes and the record it read or wrote, for 90 days. When something is compromised, that record is the starting point for working out who was affected, and we share it with you.
Where patients' information is exposed through your software, your systems, or an app your team connected, your business assesses the breach and notifies the patients and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme. Where it is exposed through Daobook's own systems, we do. Either way, each of us tells the other what we know, promptly.
Daobook may suspend or revoke a key, end a connection, disable an app for everyone, or switch off API access for your business, if a key is leaking or misused, if these terms are broken, or if software sends traffic that harms the service for others. We tell you when we do and why, and we restore access once the cause is fixed.

7. Fair use

Stay within the published rate limits, which apply to each key and each connection. Cache what you can. If you need more, ask us.
Use the API for your own business only. Do not resell, sublicense, or share access. Software that serves several clinics connects as an app Daobook registers, with each clinic's owner allowing it: write to us before you build one.
Do not use the API to copy Daobook's data at scale, to probe the service, or to reach another business's data.
Version 1 is young. How it works may still change, with notice to the businesses using it, within the rules below.

8. Changes to the API

Within version 1 we only add. A new endpoint, field, event type, or error code may appear at any time, each noted on the changelog. Your software should ignore what it does not recognise and treat every id as opaque.
We will not remove or change the meaning of anything in version 1 without at least twelve months' notice, sent by email to every business whose keys use it.

9. Availability and liability

The API is provided on the same "as is" and "as available" basis as the rest of Daobook, and the warranties and liability section of the Terms of Service applies to it. We are not responsible for your software or for a connected app, for their availability, for how they present Daobook's information to your patients, or for what an assistant does or says with it.

10. Changes to these terms

We may update these terms. When a change matters, we ask the subscription owner to accept the new version before another key can be made or another app connected, and we give notice by email where the change affects keys or connections already in use. Continuing to use them after the notice period means you accept the updated terms.

11. Governing law and contact

These terms are governed by the laws of Victoria, Australia, and the courts of Victoria have non-exclusive jurisdiction over any dispute about them. Questions about these terms or the API: admin@daobook.com.au.