Privacy Policy

Overview

DentaFlow (“DentaFlow,” “we,” “us,” or “our”) operates a software-as-a-service platform that provides an AI-powered front desk chatbot for dental clinics. This Privacy Policy describes how we collect, use, disclose, and safeguard information when you use our website, services, and embedded chatbot widget (collectively, the “Services”).

In this policy, two groups of people are involved:

Clinic Customers — the dental practices that create an account and use our Services to manage patient communications.
End Users— visitors to a Clinic Customer's website who interact with the chatbot widget, including patients and prospective patients.

By using the Services, you agree to the practices described in this Privacy Policy. Please read it carefully.

Information We Collect

Information from Clinic Customers

When you create an account and use our Services, we collect:

Account information: name, email address, password (stored as a hashed value), and clinic profile details such as clinic name, address, phone number, and website URL.
Configuration data: services and pricing, office hours, accepted insurance, FAQs, and knowledge-base content you upload to train the chatbot.
Billing information: when you upgrade to a paid plan, we process payment through a third-party payment processor. We do not store full credit card numbers on our servers.
Usage data: information about how you use the dashboard, feature preferences, and device/browser information.

Information from End Users

When a visitor interacts with the chatbot widget on a Clinic Customer's website, we collect:

Conversation content: the messages exchanged between the visitor and the chatbot.
Lead information: information the visitor voluntarily provides, such as their name, phone number, email address, and reason for inquiry.
Appointment requests: preferred dates, times, and reason for visit submitted through the chatbot.
Technical data: IP address, browser type, and basic interaction events used to provide and improve the chatbot.

Information Collected Automatically

We automatically collect certain information using cookies and similar technologies, including log data, device information, and usage analytics. See the Cookie Policy for details.

How We Use Information

We use the information we collect to:

Provide, operate, and maintain the Services;
Generate AI responses to patient questions based on the Clinic Customer's uploaded knowledge base;
Capture, store, and display leads and appointment requests in the Clinic Customer's dashboard;
Process payments and manage subscriptions;
Communicate with you about your account, updates, security alerts, and support requests;
Monitor, analyze, and improve the performance, safety, and quality of the Services;
Detect, prevent, and address fraud, abuse, and security issues;
Comply with our legal obligations.

Legal Basis for Processing

For individuals in the European Economic Area, the United Kingdom, and other regions with comprehensive privacy laws, we process personal data under the following lawful bases:

Performance of a contract: to deliver the Services you requested.
Legitimate interests: to operate, secure, and improve our business, provided those interests are not overridden by your rights.
Consent: for activities such as analytics and marketing, where applicable.
Legal obligation: to comply with applicable laws.

AI & Conversation Processing

Our Services use artificial intelligence and large language models to generate responses to patient questions. When an End User sends a message, the message is processed to produce a relevant answer based on the Clinic Customer's configured knowledge base.

Important: DentaFlow is a business tool provided to dental clinics. We are not a healthcare provider, and the chatbot is not intended to provide medical advice, diagnosis, or treatment. Clinic Customers are responsible for determining what information their patients submit and for complying with applicable healthcare privacy laws, such as HIPAA in the United States, that may apply to their practice.

We process conversation data to operate the chatbot for the Clinic Customer. We do not sell conversation content or lead data to third parties.

We do not sell your personal information. We share information only as described in this policy:

With Clinic Customers: End User conversation content and lead data is shared with the Clinic Customer whose website the End User contacted. The Clinic Customer controls this data within their account.
Service providers: We use trusted third parties to host infrastructure, deliver email, process payments, and provide AI inference. The full list of our sub-processors is available on our Sub-Processors page. These providers are bound by confidentiality obligations and may only use data to provide services to us. We maintain Data Processing Agreements with all sub-processors as required by GDPR.
Legal compliance: We may disclose information when required by law, court order, or to protect the rights, property, or safety of our users or the public.
Business transfers: In connection with a merger, acquisition, or sale of assets, information may be transferred subject to the protections of this policy.

Data Retention

We retain information for as long as your account is active or as needed to provide the Services. Conversation content, leads, and appointment requests remain available to the Clinic Customer within their account until they choose to delete them or close their account.

When an account is closed, we delete or anonymize the associated data within a reasonable period, except where we are required to retain information for legal, accounting, or compliance purposes.

Data Security

We implement industry-standard administrative, technical, and physical safeguards designed to protect personal information. This includes encryption in transit, access controls, and database row-level security policies that isolate each clinic's data.

However, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we work to protect your information using reasonable measures.

Your Privacy Rights

Depending on where you live, you may have the right to:

Access the personal information we hold about you;
Correct inaccurate or incomplete information;
Request deletion of your personal information;
Object to or restrict certain processing;
Request a portable copy of your data;
Withdraw consent at any time (without affecting prior processing);
Opt out of the “sale” or “sharing” of personal information as defined under applicable law.

Clinic Customers can manage data directly within their dashboard via the Privacy Center, including exporting their data, managing consent preferences, and deleting their account.

End Users(visitors to a clinic's chatbot widget) can submit a Data Subject Rights request directly using our Privacy Request form. We will direct your request to the relevant Clinic Customer, who is responsible for fulfilling it within 30 days as required by GDPR.

You can also reach out to us at support@dentaflow.chat and we will direct your request appropriately.

Cookies

We use cookies and similar technologies to operate and improve the Services. Details about the specific cookies we use and how to manage them are in our Cookie Policy.

Children's Privacy

The Services are not directed to children under the age of 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

International Transfers

Your information may be processed in countries other than your own, including the United States and European Union. Where this occurs, we take steps designed to ensure your information is handled in accordance with this Privacy Policy and applicable data protection laws, including through Standard Contractual Clauses (SCCs) approved by the European Commission and reliance on adequacy decisions.

A formal Data Processing Agreement (DPA) is available for Clinic Customers upon request and on our DPA page.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. For material changes, we will provide a more prominent notice, such as within the Services or via email. We encourage you to review this page periodically.

Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at support@dentaflow.chat.