Privacy policy
1. Who we are
Odonto Flow is a cloud service for private dental practices and clinics: patients, tooth chart, visit calendar, files and WhatsApp reminders to patients.
The service and this website are provided by Tymofii Shevchenko, trabalhador independente, NIF 309697107, R. Tenente Coronel Jorge Vargas Mogo 3DT, 8375-129 São Bartolomeu de Messines (Silves, Faro), Portugal (“we”, “us”). Questions about data: privacy@odontoflow.io. Data protection officer (DPO): not appointed.
2. Two roles: whose data it is
- Account and clinic data — data about the people who work in the service (owners, administrators, doctors) and information about the clinic. For this data we are the controller: we decide why and how it is processed. This policy mainly describes this data.
- Patient data (cards, visits, images, messages) is entered and used by the clinic. The clinic is the controller of this data and we are the processor: we process it only on the clinic’s instructions and only to run the service. The terms are in the data processing agreement. A patient with a question about their data should contact their clinic; if the request comes to us, we will pass it on to the clinic.
3. What data we process
Account: first and last name, e-mail, phone (if given), password (only as a hash — we do not know the password itself), interface language, e-mail confirmation status, companies and roles in them, acceptance of the terms and its date; if the sign-up came by a link with UTM tags (for example, from an advertisement), those tags — they are also copied to the clinic created.
Clinic: name, address, phone, map coordinates, language, time zone, message sending hours; the WhatsApp number and profile name, if the clinic has connected it.
Subscription and payment: plan, term, subscription status, payment history and links to invoices. Payment details (card number etc.) are entered on Paddle’s side — we do not have them.
Use of the service: the activity log (who created, changed or deleted a record and when — with the data entered, without passwords), technical logs and sessions (IP address and browser when signing in to the admin panel), the notification centre.
Patient data (as a processor): name, date of birth, sex, phone, address; medical alerts (allergies, contraindications, chronic conditions, medication) and notes; tooth chart; visits, procedures, prices, doctors’ notes; files (X-rays, photos, documents); consent to WhatsApp messages and its date; message texts and statuses. Part of this data is health data (a special category, Art. 9 GDPR): the clinic processes it on its own legal basis (providing medical care), and we only on its instructions.
Support requests: through the form on the website — name, e-mail, clinic (if given), topic and text; from the app — topic and text, while the name, e-mail, clinic, language and platform (web, iOS, Android) are taken from the account. A copy of the request is sent to our support address.
Website visitors: the web server keeps a technical log of requests (IP address, browser, page address, time) for 30 days — for security and troubleshooting. Visit statistics are counted by Umami — on our own server, without cookies and without storing IP addresses: page views, where the visitor came from (including UTM tags), country, browser, operating system and device type, clicks on the main buttons, scroll depth and the blocks viewed (without personal data). The pages of the service before sign-in (the web version) are counted the same way: sign-in, sign-up, password recovery, e-mail confirmation; their addresses are recorded without parameters other than UTM tags (e-mails and codes from the links in e-mails are not included). Inside the service, after sign-in, there are no statistics. This data cannot tell who exactly visited; we only look at overall figures to understand which pages are useful. The website’s fonts and scripts are loaded from our server; there are no third-party trackers or advertising networks on the website.
4. Purposes and legal bases
| Purpose | Legal basis (GDPR, Art. 6) |
|---|---|
| Sign-up, sign-in, running the service, support | performance of the contract |
| Replying to support requests | legitimate interest (answering the question); for customers — performance of the contract |
| E-mail confirmation, password recovery, service e-mails (invitations, subscription status, WhatsApp disconnection, data deletion) | performance of the contract |
| Subscription payment, invoices, accounting | performance of the contract; legal obligation (tax records) |
| Security, activity log, web server log, preventing abuse | legitimate interest |
| Visit statistics of the website and of the service’s pages before sign-in (without cookies, anonymised) | legitimate interest |
| Source of the sign-up (UTM tags): which advertising brings customers | legitimate interest |
| WhatsApp reminders to patients | the clinic’s instructions; the clinic obtains the patient’s consent — without a consent mark, messages are not sent |
Your name, e-mail and password are needed to conclude and perform the contract: without them the service cannot be used. Other data is optional. We do not use automated decision-making with legal effects for you, nor profiling.
We do not sell data, do not use it for advertising and do not show advertising. Patient data is not used for any purpose of ours other than running the service for the clinic.
5. Who data is shared with
Only those needed to run the service (sub-processors):
- Hosting: Hetzner Online GmbH, Germany and Finland — servers, file storage and backups.
- E-mail: mailbox.org (Heinlein Hosting GmbH) (Germany) — sending service e-mails and receiving e-mails to our addresses (support, data questions).
- Paddle (Paddle.com Market Ltd, United Kingdom) — the seller of the subscription (Merchant of Record): payment, taxes, invoices, refunds. Paddle is an independent controller of its payment data; its policy: paddle.com/legal/privacy.
- Later — Firebase Cloud Messaging (Google) — push notifications in the apps, if enabled. Push notifications contain no patient data.
WhatsApp is the clinic’s own service, not our sub-processor. The clinic connects its WhatsApp account; on its instructions the service passes the patient’s number and the reminder text to that account, after which they are processed by WhatsApp Ireland Ltd (Meta) under its own terms and privacy policy, which the clinic accepts.
Support: only if the clinic’s owner has turned on “Support access” (for 7 days) can a Odonto Flow employee enter the account on behalf of a user (via a one-time link, recorded in a log that the clinic sees), and see the log of sent messages (number, text, status). Patient cards are not shown in the admin panel.
Data is disclosed to authorities only on a lawful request.
Transfers outside the EEA: the main data is stored in the EU (Germany and Finland). Paddle (United Kingdom) — European Commission adequacy decision; Google — EU standard contractual clauses; data transfers by WhatsApp are handled by Meta under its own terms.
6. Retention periods
- Account — as long as it exists. An account that does not belong to any clinic is erased immediately and completely when deleted. A deleted account that belongs to a clinic is deactivated (it can be restored by signing up again with the same e-mail) and is erased completely as soon as it has no clinics left. A sign-up not confirmed within 30 days is erased.
- Clinic and patient data — while the subscription is active. After it ends, the account closes and the data is kept for 12 months (with a reminder to the owner and administrators 30 and 7 days before deletion), then deleted completely, including files. Earlier at the clinic’s request.
- A patient deleted by the clinic (“Delete forever”) is deleted immediately and completely: card, visits, messages, files; only entries without data remain in the activity log.
- Backups — deleted data disappears from them after 30 days.
- Payments and invoices — as long as tax law requires (in Portugal, 10 years; invoices are kept by Paddle).
- Activity log — 24 months.
- Support requests and the correspondence about them — 24 months.
- Web server log — 30 days.
7. Security
Encrypted connections (HTTPS), passwords only as hashes, payment system keys stored encrypted; each clinic’s data is isolated from the others (verified by automated tests); access within a clinic is role-based (owner, administrator, doctor: a doctor sees their own visits); files are served through temporary signed links; backups — daily, to separate storage in the EU (not on the same server). No measure gives a complete guarantee; we will report a breach affecting your data within the GDPR deadlines.
8. Your rights
Access to data, rectification, erasure, restriction of processing, portability, objection to processing based on legitimate interest, withdrawal of consent. Most of this can be done in the app (profile: data, password, leaving a company, deleting the account — how to delete an account); the rest — on request at privacy@odontoflow.io, we will reply within one month. You can lodge a complaint with a supervisory authority — in Portugal this is the CNPD (www.cnpd.pt), or the authority of your EU country.
Clinic patients exercise their rights through the clinic: it can print or save everything about the patient as PDF (export) and erase their data.
9. Cookies and browser storage
We do not use advertising or analytics cookies (Umami statistics work without them), so the website does not ask for consent to them. Only data needed for the service is stored in the browser: the sign-in token, the chosen language and theme, the UTM tags of the arrival (on the website — until the tab is closed, in the service — until sign-up, to save them with the account); in the iOS and Android apps the token is stored in the device’s secure storage (Keychain / Keystore). The service’s admin panel uses a session cookie.
10. Children
The service is intended for professionals and is not designed for users under 16. Data of underage patients is entered by the clinic as their controller.
11. Changes
We will notify clinic owners of material changes to this policy by e-mail and in the app at least 30 days in advance. We will also notify in advance if the service passes to another provider — for example, to a company we set up for the service: it will continue to process data under this policy. The current version is always on this page; the effective date is at its top.
12. Contacts
Tymofii Shevchenko, R. Tenente Coronel Jorge Vargas Mogo 3DT, 8375-129 São Bartolomeu de Messines (Silves, Faro), Portugal, privacy@odontoflow.io.