Privacy Policy

This policy explains what personal data we process through Dent Lab Pro, for what purpose, on what legal basis, and what rights you have.

Controller: [DENUMIRE SOCIETATE], [IDNO], [ADRESĂ SEDIU]. Data protection contact: [EMAIL PROTECȚIA DATELOR].

The policy is written to the standard of Regulation (EU) 2016/679 (GDPR) and complies with Law no. 133/2011 on the protection of personal data.

1. Our role: controller or processor

The distinction matters, because it determines who you should contact.

We are a controller for account data: who you are, how you sign in, how you use the Platform, how we invoice you.

We are a processor for patient data. The Doctor and the Laboratory decide what is entered and why; we only host and process it on their instruction. If you are a patient, requests go to your doctor or laboratory, not to us — we will support them in answering you.

2. What data we process

2.1. Account data

Name, email address and profile picture, received from Google at sign-in. Your chosen role, preferred language, and the laboratory you belong to.

We never receive or store your Google password.

2.2. Professional data

For doctors: clinic name, phone number, the laboratories you work with, the orders you send, and your financial position with each laboratory.

For technicians: first and last name, assigned stages, activity on cases, earnings and payslips.

For laboratories: name, logo, address, phone, workflow settings, products, prices, and client and staff records.

2.3. Health data (special category)

This is the most sensitive category and we treat it as such.

The Platform carries: the patient's name, the treated teeth and shades, appointment dates, clinical notes, rework reasons, and uploaded files — intraoral photographs, radiographs, 3D intraoral scans and PDF documents.

This data is entered by the doctor or the laboratory. We do not request it, do not enrich it, and do not use it for any purpose other than providing the service.

2.4. Technical and security data

IP address and browser type, at sign-in and on sensitive actions. Active sessions, with the time last used. Audit logs of administrative actions. Device notification tokens, if you enable notifications.

2.5. Billing data

The Laboratory's legal name, tax identification number, address and billing email; invoices and payments.

2.6. Data about third parties, entered by our users

Laboratories record data about people who have no account: doctors outside the Platform, external partners, and patients.

If this describes you — your data is in the Platform although you never interacted with us — you may contact the laboratory that entered it, or write to us at [EMAIL PROTECȚIA DATELOR], and we will direct you to the appropriate controller.

3. Why we process, and on what basis

We do not process data for advertising, do not sell data, and do not take automated decisions producing legal effects on you.

3.1. Whether you are obliged to provide the data

Account data — the name and email address received from Google — is a contractual requirement: without it we cannot create the account or give you access to the Platform. The Laboratory's billing data is a statutory requirement under tax legislation; without it we cannot issue invoices, and so cannot maintain the subscription.

Everything else is optional: phone number, profile picture, notification token. If you do not provide them, the Platform works — minus the feature each one supports.

Patient data is not provided to us by you as the data subject: the doctor or the laboratory enters it. Where providing it is mandatory, that obligation arises from your relationship with them, not with us.

4. Who we share data with

We work with providers who process data strictly on our instruction:

The current list is published separately and changes with prior notice.

Transfers outside the European Economic Area rely on the European Commission's standard contractual clauses. A copy of the clauses applying to a particular transfer can be obtained by writing to [EMAIL PROTECȚIA DATELOR].

We may also disclose data: to authorities, where the law requires it; to our advisers, under confidentiality; and to an acquirer in a reorganisation, with prior notice to you.

5. How long we keep data

When a period expires, data is deleted or irreversibly anonymised.

6. Your rights

You have the right: of access to your data; to rectification of inaccurate data; to erasure, within the limits below; to restriction of processing; to portability in a machine-readable format; to object to processing based on legitimate interest; and to withdraw consent at any time, without affecting prior processing.

One limit we prefer to state plainly: deleting an account cannot remove everything. A technician's name is tied to completed tasks and payslips the laboratory is legally required to keep, as are accounting records. In those cases we anonymise the account — severing the identity from the records — and keep only what the law requires.

How to exercise them. Some rights have a button in the app: data export and account closure are requested from your account settings, and doctors can edit their own profile. For the others — rectification of account data for technicians and laboratory owners, restriction of processing, and objection — there is no screen yet; write to [EMAIL PROTECȚIA DATELOR] and we carry them out for you, within the same deadline. The email address cannot be changed: it is the identifier of the Google account you sign in with.

Send requests to [EMAIL PROTECȚIA DATELOR]. We respond within 30 days at most. If we are not the right controller, we tell you who is.

You have the right to lodge a complaint with the competent supervisory authority. In the Republic of Moldova this is the National Center for Personal Data Protection (CNPDCP), www.datepersonale.md. If you are in the European Union, you may lodge a complaint with the supervisory authority of the state of your habitual residence, place of work, or place of the alleged infringement.

7. Security

Access is limited by role and by laboratory membership, checked on every request. Traffic is encrypted. There are no passwords — authentication is delegated to Google. Sessions can be revoked individually. Files are served through temporary, time-limited addresses. Sensitive administrative actions require a written reason and are written to a log that cannot be altered.

No system is perfectly secure. If a breach occurs that may affect your rights, we inform you and notify the authority as the law requires.

8. Cookies

We use strictly necessary cookies for operation, and ask for your consent for statistics through a banner. Details are in the Cookie Policy.

9. Children

The Platform is aimed at professionals and is not intended for people under 18. Data about minor patients is entered by the doctor, under their responsibility.

10. Changes

When we change this policy, we update the version and date at the top of the document. Important changes are communicated in advance.