Privacy Policy

1. Two kinds of information

Patient records: the patients, appointments, charts, notes, images and invoices a clinic enters belong to that clinic. The clinic decides what to record and why; we store and process it only on the clinic's behalf, to run DentaFlow for it.

Account and business information: the details of clinic owners and staff, billing, and people who contact us through the website. For this information, we decide how it is used, as described below.

2. What we collect

Clinic sign-up: clinic name, owner's name, email, phone number and username, chosen plan and time zone.

Billing: invoices, payment references and any payment screenshots the clinic sends. We do not see or store bank card numbers.

Website forms: the details you type into the demo request or pilot forms.

Technical records: sign-in times, errors and an audit log of actions in each clinic, kept for security and to fix problems. IP addresses are used only briefly, to block repeated wrong passwords.

Cookies: only those needed to keep you signed in and remember your language. We use no advertising or tracking cookies.

3. How we use it

To provide DentaFlow, to bill for it, to send emails about the account (such as email confirmation, invoices and reminders), to give support, and to keep the service secure.

We never sell information, never use patient records for advertising, and never share them with other clinics.

4. Each clinic is kept separate

Every clinic has its own database and its own file folder. Staff of one clinic cannot see another clinic's information, and every request is checked against the signed-in clinic.

5. Who can see clinic data

The clinic's own staff, according to the permissions the clinic gives them.

Us, only when needed to fix a problem the clinic reported, to restore a backup, or to keep the service secure or meet a legal obligation. These actions are logged.

6. Where data is stored, and service providers

DentaFlow runs on cloud servers operated by Railway Corporation, in Singapore. Information travels to and from them encrypted (HTTPS).

Emails are sent through Resend. Our domain name is managed with Cloudflare. If a clinic connects its own Telegram bot, messages it chooses to send go through Telegram.

These providers process information only to provide their service to us.

7. How we protect it

Encrypted connections, passwords stored only as salted hashes, optional two-step sign-in, role-based permissions, an audit log of changes, and regular backups of each clinic's data.

8. How long we keep it

While the clinic's account is active. After it is cancelled, we keep the data for 90 days so the clinic can return or download it, then delete it; sooner if the owner asks in writing.

Billing records may be kept longer where accounting or tax law requires. Website form details are deleted when no longer needed to reply.

9. Your choices

Clinic owners can see, correct and download their clinic's data in DentaFlow, and can ask us to delete it.

Patients who want to see, correct or delete their records should contact their clinic, which controls those records. We will help the clinic answer.

10. Changes to this policy

If we change this policy in a way that matters, we tell clinic owners by email or in DentaFlow before the change applies.

11. Contact

Questions about privacy: somannan123@gmail.com. Som Annan, trading as DentaFlow, Phnom Penh, Kingdom of Cambodia.