Security and data protection

A clinic trusts us with its patients' records. This page lists only what the software does today, and, separately, what we do not claim.

What we do

Each clinic's data is separate from every other clinic's: every database request is limited to the clinic of the signed-in user, and an automatic audit plus a test suite check this on every code change. A user of one clinic who sends another clinic's patient or invoice id gets nothing.
Every user has a role (owner, dentist, assistant, receptionist, accountant …) and opens only what that role needs; recording clinical information is closed to the money-only roles.
Sign-in lockout: after 5 wrong passwords in a row, sign-in to that account is locked for 15 minutes.
Two-step sign-in with an authenticator app (TOTP) is available, optionally, for clinic users.
The site and the app are reached over HTTPS only (HSTS header), and the browser protection headers (CSP, no framing by other sites) are on.
Important actions (for example changes to sensitive records) are written to an activity log with the user's name and the time.
A clinic can download a full copy of its data whenever it wants.
The AI in radiology sends the selected image only when a dentist starts an analysis; no image is analysed automatically, and an AI finding reaches the chart or a draft treatment plan only after the dentist accepts it.

We hold no certification (ISO 27001, HIPAA, GDPR or the like) and do not claim one.
This page makes no claim about the encryption of stored data (patient records or connection secrets) or about where the servers are.
No system is risk-free. If you find a security problem, tell us.
AI assists the dentist and does not replace professional diagnosis or treatment decisions.

Write to us from the contact page; we read security messages first. Please do not put real patient data in a report. Contact page