Plain-language summary: We collect only what's needed to run the platform. We never sell your data. Patient health data stays encrypted at rest. You can request deletion at any time.
DentaPro Ltd ("we", "us") operates Dental Assistant Pro at dentapro.org. For clinic staff and owners, we are the data controller. For patient data entered by clinics, the clinic is the data controller and we are the data processor.
Contact our data protection contact at: privacy@dentapro.org
| Category | Data | Who it applies to |
|---|---|---|
| Account data | Name, email address, password (hashed), role, clinic name | Clinic staff / owners |
| Patient records | Name, email, phone, date of birth, address, medical history, appointments, invoices, X-rays, prescriptions, consent records | Patients (entered by clinic) |
| Usage data | Login timestamps, audit log entries, IP address | All users |
| Payment data | Billing name, email — card details are handled by Stripe and never stored by us | Clinic owners |
| Portal data | Messages, appointment requests, intake forms submitted by patients via the patient portal | Patients |
We do not use patient health data for advertising, profiling, or sale to third parties.
| Processing activity | Legal basis |
|---|---|
| Running the Service for clinic staff | Contract (Art. 6(1)(b)) |
| Processing patient health records | Explicit consent + health care exemption (Art. 9(2)(h)) |
| Billing and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Legal compliance | Legal obligation (Art. 6(1)(c)) |
All data is stored on Amazon Web Services (AWS) servers in the EU West (Ireland) region. Data is encrypted at rest (AES-256) and in transit (TLS 1.2+).
Access to production databases is restricted to authorised personnel only. We use row-level security (RLS) to ensure each clinic can only access its own data.
We maintain backups with a 30-day retention period.
| Processor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Cloud hosting, database, file storage | EU (Ireland) |
| Stripe | Payment processing | EU / USA |
| SendGrid / SMTP provider | Transactional email | EU / USA |
All processors are contractually bound to process data only on our instructions and in compliance with GDPR.
We use only essential cookies and browser storage (localStorage, sessionStorage) to maintain your login session and application preferences. We do not use tracking cookies or third-party analytics.
If you are located in the EU/EEA, you have the following rights:
To exercise any of these rights, email privacy@dentapro.org. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.
Patients access the portal by providing their email address and date of birth — no password is required. The portal is scoped to the specific clinic the patient registered with. Patients may send messages and appointment requests; these are stored and visible to clinic staff.
The patient portal is not intended for use by children under 16 without parental consent. Clinics are responsible for obtaining appropriate consent when entering records for minors.
We may update this policy from time to time. We will notify account holders by email at least 14 days before material changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.
For privacy questions or to exercise your rights: privacy@dentapro.org
For general support: support@dentapro.org