Data-processing agreement

1. Parties and roles

This data-processing agreement applies between the dental practice or organisation that holds the Denty AI workspace (the controller) and Denty Si (the processor). It is accepted when a workspace is created and whenever a new version is published.

The practice decides what is recorded, why, and how long it is kept. We process patient data only on the practice’s documented instructions, which include the settings made in the app itself.

2. What we do with the data

• Store and organise patient records, clinical documents, images and signatures for the practice.
• Send AI requests on the practice’s instruction, only for a case where AI consent has been recorded, with clinician approval required before anything is saved.
• Send signing invitations and reminders to the addresses the practice supplies, and produce the signed record.
• Keep a tamper-evident audit trail of clinical and administrative activity.
• We do not sell data, use it for our own purposes, or use patient content to train models.

3. Security

• Encryption in transit and at rest; private files reached only through short-lived signed links.
• Access is scoped to the clinics a member is assigned, enforced on the server and by row-level rules.
• Two-factor authentication, idle sign-out and per-session timeouts are available to every practice.
• Staff access to production data is limited to what support and incident response require, and is logged.

4. Sub-processors

The practice authorises the sub-processors below. We give at least 30 days’ notice before adding or replacing one, so the practice can object. A sub-processor is bound by data-protection terms no less protective than this agreement.

• Base44 — Application hosting, database and private file storage · UK (eu-west-2)
• Base44 AI gateway — Routes each AI request to a frontier model provider under a no-training agreement. The provider is OpenAI, Anthropic or Google depending on the model selected for that request. · UK, EEA or US — for the length of the request only
• Stripe — Subscription billing and card payments. Card details never reach our servers. · EEA and US
• Email delivery provider — Signing invitations, reminders and account emails · EEA

5. International transfers

Where a sub-processor processes data outside the UK, the transfer relies on the UK International Data Transfer Agreement or the UK Addendum to the standard contractual clauses, supported by a transfer risk assessment.

Patient records are stored in the UK. AI requests may be processed in another region for the length of the request only, and identifiers are redacted before they are sent unless the practice turns redaction off.

6. Retention, deletion and return

UK dental records guidance: keep adult records for 11 years after the last treatment, and records for patients under 18 until their 25th birthday.

The practice sets its retention period in Settings. Deleting a case removes the record, its documents, attachments, signatures and signing records, and its file references, immediately. The stored files can no longer be opened by anyone; because the hosting platform does not expose per-object deletion, the encrypted file objects are destroyed with the workspace’s storage.

Operational logs (metering, account lifecycle, signing access) are trimmed each night to the period the practice configures. The audit trail is kept, because it is the evidence that deletions happened.

At the end of the agreement the practice can export every record as machine-readable data before closing the workspace.

7. Breaches and assistance

We notify the practice without undue delay, and in any event within 48 hours, after becoming aware of a personal-data breach affecting its records, with what happened, the data and people affected, and the steps taken. The practice remains responsible for deciding whether to notify the Information Commissioner’s Office within 72 hours or the patients affected.

We assist the practice in answering patient requests — access, rectification, erasure, restriction, portability and objection — using the tools in the app. Restriction is applied with a flag on the case that stops further clinical processing until it is lifted.

8. Records and audit

The compliance console in Settings holds the practice’s record of processing activities, its data-protection impact assessment checklist, its breach log and its rights-request log with response deadlines. Every change to those records is written to the hash-chained audit trail.

Contact Denty Si at privacy@denty.si for anything in this agreement.