Privacy Policy

1. Introduction & Scope

This Privacy Policy describes how DentAssist AI Technologies (“DentAssist AI”, “we”, “our”, or “us”) collects, uses, processes, stores, and protects information when dental clinics (“Practices”, “Subscribers”) and their authorized staff use the DentAssist AI platform, clinic management dashboard, and website chat widget.

DentAssist AI operates as a software service provider to dental practices. Practice owners configure the system, upload knowledge documents, connect Google Calendar, and embed the chatbot widget onto their clinic websites.

2. Information Collected from Practice Owners & Account Users

When practice owners and clinic staff create an account, log in, or manage practice settings, we collect:

• Account Credentials: Full name, professional work email address, and cryptographically hashed password.
• Practice Profile Details: Clinic legal name, tenant slug, physical address, clinic contact phone number, public email address, and clinic timezone.
• Authentication Logs: Session tokens, IP addresses, browser user agent strings, and timestamps recorded by our authentication system (Better Auth) for account security.

3. Clinic Configuration & Uploaded Knowledge Documents

To provide accurate patient chat responses, practice administrators upload informational files and configure clinical operating rules:

• Knowledge Documents: Practice policy documents, fee schedules, insurance guides, accepted payment details, and pre-appointment instructions uploaded in PDF, DOCX, or text format. These files are stored in private cloud object storage (AWS S3) and segmented into text chunks.
• Semantic Embeddings: Text chunks are processed into mathematical vector embeddings and stored in our vector database (Pinecone) tagged with your clinic’s unique tenant identifier.
• Operational Schedules: Weekly working hours, break windows, holiday closures, dentist rosters, and procedure chair durations configured in your practice dashboard.

4. Patient Inquiries Submitted Through the Website Chatbot

When website visitors interact with the DentAssist AI widget on a practice website:

• Conversation Messages: We record the text inquiries submitted by the visitor and the generated assistant replies to maintain multi-turn conversational context during the active session.
• Widget Sessions: Transient widget session tokens identify ongoing visitor threads without requiring patient account creation.

5. Appointment Booking Information

When a patient requests an appointment through the chatbot, DentAssist AI collects essential scheduling details to complete the booking:

• Patient full name.
• Patient contact email address.
• Patient contact telephone number.
• Selected dental procedure or service category and assigned dentist.
• Requested appointment date and start/end time.
• Voluntary patient notes or visit reasons.

These records are stored in the practice’s database table and linked to the clinic’s connected Google Calendar event.

6. Google OAuth & Calendar Integration

DentAssist AI integrates with Google Calendar via Google OAuth2 with explicit practice administrator authorization:

• Scope of Access: We request calendar permissions strictly to read existing appointment busy blocks (preventing double bookings) and to insert newly booked patient appointments into your practice calendar.
• Credential Security: OAuth access tokens and refresh tokens are encrypted at rest using AES-256 encryption (GOOGLE_CALENDAR_TOKEN_ENCRYPTION_KEY) before storage in the database.
• No Advertising Use: Google Calendar data is never shared with external advertisers, data brokers, or used to train public foundation models.

7. How Information Is Used

We use collected data solely to deliver, operate, and maintain the platform:

• Retrieving practice knowledge chunks to provide grounded patient chat answers.
• Evaluating clinic opening hours and doctor availability against Google Calendar.
• Creating and managing confirmed appointment bookings.
• Authenticating practice users and securing clinic administration access.
• Sending transactional emails (account verification, password reset) via Resend.

8. AI Processing & Third-Party Infrastructure Subprocessors

To generate conversational responses, patient inquiries and retrieved snippets from your clinic’s documents are transmitted to configured AI providers via encrypted API calls. Our actual configured subprocessors include:

9. Data Security & Multi-Tenant Isolation

We implement technical safeguards to protect practice data against unauthorized access:

• Multi-Tenant Database Isolation: All documents, appointments, services, and conversations are strictly segmented by practice organization ID in PostgreSQL.
• Encryption in Transit & at Rest: Web traffic is encrypted with TLS/HTTPS. Stored OAuth tokens are encrypted with AES-256.
• Access Controls: Authenticated sessions use HTTP-only, secure cookies with role-based authorization guards.

10. Data Retention & Deletion

Practice data is retained for as long as the clinic maintains an active account on DentAssist AI. Practice administrators may delete uploaded knowledge documents through the dashboard at any time, which purges document chunks from the database and corresponding vectors from Pinecone. Account closure requests result in the deletion of practice records subject to legal retention obligations.

11. Cookies & Tracking Technologies

DentAssist AI uses essential functional cookies strictly required for authentication and session management (better-auth.session_token). We do not use third-party advertising cookies, trackers, or commercial data broker pixels on the website or within the dashboard.