Privacy Policy
Last updated: October 7, 2026
This policy explains what personal data Dentify3D ("we", "us") processes when you visit dentify3d.com, when a clinic uses the Dentify3D service, and when a patient opens a treatment link — and how we handle it. Dental scans are health data; we treat them that way.
Two roles
For the accounts of a clinic's team and for the clinic's own details we are thecontroller. For the information a clinic stores about its patients — names, file numbers, dates of birth, notes and treatment models — the clinic is the controller and we are the processor, acting only on the clinic's instructions. That data belongs to the clinic; we access it only to run the service, to support the clinic when it asks, and as required by law.
What we process
- Team accounts — names, email addresses and passwords (stored only as an irreversible hash) of the clinic's users, and their roles.
- Clinic data — everything a clinic enters about its patients and treatments, including the 3D models of each step. These models and notes are health data.
- Share links — who created a link, its label, expiry and optional passcode (stored only as a hash), and how many times and when it was last opened.
- Technical and support data — an activity trail inside each clinic (who changed what, from which address), security and rate-limiting logs, and emails sent to support.
When a patient opens a link
The treatment page needs no account. We count the visit, keep a session cookie that remembers a correctly entered passcode, and log the visitor's IP address briefly for security and to stop passcode guessing. The page runs no advertising or analytics scripts. Model files are delivered through short-lived signed addresses that stop working after about an hour.
This website
dentify3d.com and the help site docs.dentify3d.com set no cookies and run no advertising scripts. We count visits with Cloudflare Web Analytics, which uses no cookies, does not identify visitors and does not follow them across sites: it records the pages viewed, the referring site, and the visitor's browser, device type and country. The treatment pages patients open run no analytics at all.
Who processes it for us
- Laravel VPS — application servers and databases in the European Union (Frankfurt).
- Cloudflare — DNS, object storage for treatment models (R2), and hosting of this website and the help site, and the cookieless visit statistics described above.
- Resend — transactional email such as invitations and password resets.
- Paddle — our reseller and merchant of record for subscriptions: checkout, payments, invoices and tax.
When a clinic subscribes, it enters its billing details — name, email address, country and payment method — directly in Paddle's checkout. Paddle processes them as a controller in its own right, under its privacy policy, and keeps the records tax law requires. Card details never reach our servers; we receive the clinic's Paddle customer and subscription identifiers and the status of its subscription.
Why we process it
To provide the service a clinic uses, to deliver the treatments it shares, to answer support requests, to keep the service secure, and to comply with legal obligations. We do not sell data, and we do not use clinic or patient data for advertising, profiling or training models.
Retention and deletion
A clinic's data is kept for as long as its account exists. Clinics can export everything — records and model files — from the panel at any time. Deleting a patient permanently removes their treatments and models; expired and revoked share links are deleted after 90 days. When a clinic asks us to close its account, we delete its database and files; nightly backups age out within a short, fixed window afterwards.
Security
Every clinic has its own database, and its model files live under its own storage area. Connections are encrypted in transit, passcodes and passwords are stored only as hashes, links are long random tokens, access to servers is limited to our team, and every change inside a clinic is written to an audit trail the clinic can inspect.
Your rights
Clinic users can access, correct, export or delete their data from the panel or by writing tosupport@dentify3d.com. Patients should contact their clinic, which decides about their data; we help the clinic answer. If you are in the EU, the UK or Turkey you also have the right to complain to your data protection authority.
Changes
Updates to this policy will be posted on this page with a new "last updated" date.