> How Acuity Scheduling processes appointment data, which cookies the booking widget sets, when consent is required and how EU businesses comply with GDPR. > > Canonical: https://www.flowconsent.com/en/services/other/acuity-scheduling Other # Acuity Scheduling Preferences Acuity Scheduling, now branded Squarespace Scheduling, is an appointment booking platform widely used by coaches, therapists, salons, photographers, consultants and small healthcare practices. It offers a calendar centric booking experience with intake forms, reminders, recurring appointments and integrations with Stripe, Square, Zoom, Google Meet and most calendar systems. The Acuity widget loads on the customer site and transmits booking data to Squarespace, Inc. servers in the United States. [Block Acuity Scheduling until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=other) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Other](https://www.flowconsent.com/en/services/other) - Consent Preferences - Prior consent Required - Documented cookies 6 - Third-party domains 6 - Servers United States (Squarespace, Inc., New York City; Acuity Scheduling was acquired by Squarespace in 2019 and is now Squarespace Scheduling) on AWS US infrastructure Overview ## What does Acuity Scheduling do? ## **What is Acuity Scheduling** Acuity Scheduling, now formally Squarespace Scheduling since the 2019 acquisition by Squarespace, is an online appointment booking platform aimed at independent professionals and small businesses. Coaches, therapists, hairdressers, photographers, consultants and small healthcare practices use it to publish a public booking page, manage availability, send automated reminders and reduce no shows. Customers can book single or recurring appointments, complete intake forms, pay through Stripe or Square at booking, and join video meetings via Zoom or Google Meet. ## **What data and cookies Acuity collects** At booking time, Acuity collects name, email, phone, address, optional date of birth, intake form responses (which may include health information for medical practices), payment data forwarded to Stripe or Square and IP address. The embedded widget sets cookies on acuityscheduling.com such as \_acuityscheduling\_session, acuity-csrf-token and several Squarespace tracking cookies (ss\_cookieAllowed, RecentRedirect). Webhook integrations expose data to Mailchimp, ConvertKit, ActiveCampaign or Zapier depending on the practitioner's configuration. ## **GDPR and ePrivacy implications** The embedded widget loads automatically on the host page and sets cookies before any booking starts, which triggers Article 5(3) ePrivacy. The processing of appointment data after the user actively books rests on contract performance under Article 6(1)(b) GDPR. Intake forms collecting health information bring Article 9 special category data into play, requiring an explicit consent or a healthcare professional secrecy basis. The US transfer must be referenced with the DPF or SCC mechanism. ## **Is consent required** For the embedded widget, yes: gate the script behind a consent banner under the Functional or Marketing category. If you only link to a hosted booking page on acuityscheduling.com, the consent shift moves to that destination and the user is then on Acuity's privacy notice. Inside the booking flow itself, once the user has actively chosen to book, processing can run under contract, but intake forms with health data still need their own explicit consent. ## **Data transfers to the United States** Acuity Scheduling stores all appointment, customer and payment data on Squarespace, Inc. infrastructure in the United States. Squarespace is self certified under the EU US Data Privacy Framework. EU SCCs are included in the Squarespace DPA. For healthcare professionals, the US storage of Article 9 data requires a documented Transfer Impact Assessment and is in tension with several national health data laws (notably the Health Data Hub doctrine in France and the BfArM Hosting requirements in Germany). ## **Practical compliance steps** Gate the widget behind your consent manager, sign the Squarespace DPA, configure intake forms to avoid collecting sensitive data unless strictly necessary, and obtain explicit consent for any health information. Document Squarespace, Inc. as a recipient in the privacy policy with the DPF and SCC mechanism. For practices subject to French Health Data Hosting (HDS) certification or German healthcare hosting requirements, consider an EU based alternative. Compliance ## Acuity Scheduling and the GDPR Acuity Scheduling is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy) for the embedded scheduling widget that loads scripts before any booking is initiated; contract (Art. 6(1)(b)) for processing the appointment data after the user actively books; legal obligation (Art. 6(1)(c)) for invoicing related retention - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, TTDSG, LIL, PSD2 for any payments processed through Stripe or Square within Acuity ### Impact assessment (DPIA) A DPIA can be required when Acuity is used by healthcare professionals collecting health data, by therapists handling sensitive disclosures, or at large scale across multiple practices. Document the categories of data collected through intake forms, the US transfer mechanism, the integrations with payment and video providers, and the retention. ### Sample text for your banner > We use Acuity Scheduling (Squarespace Scheduling) to manage appointments. Loading the booking widget sends your IP and booking details to Squarespace, Inc. in the United States. Do you accept? Cookies and trackers ## What Acuity Scheduling sets and contacts - Tracking method Embeddable scheduling widget (acuityscheduling.com iframe) or full redirect to a hosted booking page; client side script embed.js for inline integration; REST API for server side appointment management; webhooks for integrations with CRM and calendar providers - Server location United States (Squarespace, Inc., New York City; Acuity Scheduling was acquired by Squarespace in 2019 and is now Squarespace Scheduling) on AWS US infrastructure - Data transferred outside the EU Acuity Scheduling is operated by Squarespace, Inc. in the United States. All appointments, customer contact details, payment metadata and intake form responses are stored on US infrastructure. Squarespace is self certified under the EU US Data Privacy Framework and signs SCCs through the Squarespace Data Processing Addendum. ### Cookies set (6) | Name | Type | Duration | Purpose | | --------------------------------- | ----------- | ----------------- | ------------------------------------------------------------------------------------------------------ | | \_acuityscheduling\_session | third party | Session | Maintains the booking session between the embedded widget and the Acuity backend during a reservation. | | acuity-csrf-token | third party | Session | Cross site request forgery protection token used by Acuity during the booking flow. | | ss\_cookieAllowed | third party | 1 year | Squarespace cookie that remembers the user's cookie banner choice on the Squarespace platform. | | RecentRedirect | third party | Session | Squarespace cookie used to track the previous URL when redirecting between Squarespace properties. | | crumb | third party | Session | Squarespace CSRF protection cookie set on the booking page. | | \_\_stripe\_mid / \_\_stripe\_sid | third party | Session to 1 year | Stripe payment cookies set when paying through Acuity, used for fraud prevention by Stripe. | ### Third-party domains contacted (6) - `acuityscheduling.com` - `app.squarespacescheduling.com` - `cdn.acuityscheduling.com` - `squarespace.com` - `js.stripe.com` - `squarecdn.com` Questions ## Frequently asked questions about Acuity Scheduling Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Acuity Scheduling set? The widget sets \_acuityscheduling\_session for the booking session, acuity-csrf-token for CSRF protection and a few Squarespace cookies (ss\_cookieAllowed, RecentRedirect). If payment is configured, Stripe or Square cookies are also set during checkout. ### Do I need consent for the Acuity widget? For the embedded widget yes, because it sets cookies and loads scripts before any booking. Once the user actively books, the strictly necessary cookies (session, CSRF) can run under contract performance, but the initial load still needs consent. ### What is the legal basis for Acuity Scheduling? Contract performance (Art. 6(1)(b) GDPR) for the booking and any service delivered after, legal obligation (Art. 6(1)(c)) for invoicing retention, consent (Art. 6(1)(a)) for the widget loading on the host page and for intake forms collecting Article 9 health data. ### Are personal data transferred to the United States? Yes. Squarespace, Inc. operates Acuity from US infrastructure. The EU US Data Privacy Framework certification and EU SCCs in the Squarespace DPA cover the transfer. Health data raises an additional layer requiring a Transfer Impact Assessment. ### Do I need a DPIA for Acuity Scheduling? For independent coaches or beauty salons, generally no. For healthcare professionals collecting health data, therapists or multi practitioner platforms, a DPIA is recommended to cover the Article 9 processing, the US transfer and the integrations with Stripe, Square, Zoom or Google Meet. ### How do I deploy Acuity compliantly? Gate the widget behind a CMP, sign the Squarespace DPA, configure intake forms to ask only what is necessary, anchor health data on explicit consent, list Squarespace, Inc. as a recipient with the DPF or SCC mechanism, and consider an EU alternative for HDS or BfArM regulated practices. ### What are the alternatives to Acuity Scheduling? EU based alternatives: Doctolib (FR, healthcare), Maiia (FR), Planity (FR, salons), Treatwell (UK/EU, salons), Calendly (US, but ISO 27001 with EU region), TIMIFY (DE), SimplyBook.me (UK/Cyprus). Open source: Cal.com (self hostable). ### How should I describe Acuity in the cookie policy? Add an entry under Functional or Marketing: provider Squarespace, Inc. (USA), domains acuityscheduling.com, app.squarespacescheduling.com, cookies (\_acuityscheduling\_session, acuity-csrf-token, ss\_cookieAllowed), purpose appointment booking, transfer mechanism EU US Data Privacy Framework and SCCs, retention according to your appointment retention policy. Same category ## More services: Other [See the whole category](https://www.flowconsent.com/en/services/other) ### [Sheety](https://www.flowconsent.com/en/services/other/sheety) [Sheety is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Sheety supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Sheety enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/other/sheety) [Other](https://www.flowconsent.com/en/services/other/sheety) · ### [Sherlock](https://www.flowconsent.com/en/services/other/sherlock) [Sherlock is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Sherlock provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Sherlock helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/other/sherlock) [Marketing](https://www.flowconsent.com/en/services/other/sherlock) · ### [Crexi](https://www.flowconsent.com/en/services/other/crexi) [Crexi is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Crexi supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Crexi ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/other/crexi) [Other](https://www.flowconsent.com/en/services/other/crexi) · ### [Plutio](https://www.flowconsent.com/en/services/other/plutio) [Plutio is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Plutio provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Plutio helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/other/plutio) [Marketing](https://www.flowconsent.com/en/services/other/plutio) · ### [Phabricator](https://www.flowconsent.com/en/services/other/phabricator) [Phabricator is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Phabricator supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Phabricator ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/other/phabricator) [Preferences](https://www.flowconsent.com/en/services/other/phabricator) · ### [Northstar Club Management](https://www.flowconsent.com/en/services/other/northstar-club-management) [Northstar Club Management is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Northstar Club Management enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Northstar Club Management empowers marketing.](https://www.flowconsent.com/en/services/other/northstar-club-management) [Marketing](https://www.flowconsent.com/en/services/other/northstar-club-management) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)