Privacy Policy
ES

Privacy Policy for Dentyco

Last updated: August 8, 2026

1. Introduction

Welcome to Dentyco. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our application (the "App"). We are committed to protecting your privacy and to being transparent about our data practices.

Dentyco is a practice-management application for dental offices. It lets dental professionals manage their schedule, their patients, clinical records (including the odontogram), treatment plans, and recorded payments; and it lets patients find professionals, book and manage appointments, and message their dentist.

Dentyco is operated by Blue Peak Software Solutions ("we", "us").

1.1 Two roles, two responsibilities

It matters who decides about each piece of data:

  • Your account data (email, name, phone, profile picture, preferences): we are the controller.
  • Patient clinical data (clinical records, odontogram, diagnoses, treatments, recorded payments): the professional or clinic entering it is the controller. We act as a processor: we host and process that data on the professional's behalf, following their instructions, and we never use it for our own purposes.

If you are a patient and want to access, correct, or delete information in your clinical record, please contact the professional who treated you. We can assist technically, but the decision is theirs.

2. Information We Collect

2.1 Information You Provide Directly

Account Information

  • Email address (required to create an account)
  • Full name (required)
  • Password (stored encrypted; never in plain text)
  • Role (patient or professional)
  • Professional license number (required for professional accounts only)
  • Phone, city, state/province, country, and office address (optional, professional profile)
  • Biography, specialties, services, and published prices (optional, professional profile)
  • Profile picture and banner image (optional)
  • Date of birth (optional, patient accounts). Professionals see only your age, never the exact date
  • Record of the age declaration: the date and time at which, on sign-up, you ticked that you are 18 or older. That box does not record your age or your date of birth, only when the declaration was made

Booking Without an Account (Guest Mode)

If you book an appointment without registering, we collect the full name, email address, phone number, and any reason or notes you provide. That information is shared with the professional you choose so they can handle the appointment.

Clinical Data (Entered by the Professional)

  • Chief complaint, medical history, allergies, and anticoagulation status
  • Clinical evolutions: date, notes, diagnosis, and observations
  • Odontogram: status and findings per tooth
  • Treatment plans and their items and statuses
  • Payments recorded by the professional: amount, date, and notes
  • Clinical and patient profile images
  • Imaging studies: radiographs, tomographies, and other studies the professional receives from the radiology centre and files in the clinical record. Alongside the file (an image or a PDF document) we store the study type, the date it was taken, the radiology centre it came from, and any notes the professional adds

This is health data and receives the heightened protections described in section 6.

Appointments and Schedule

Date and time, duration, appointment type and status, reason, notes, cancellation reason, professional availability, and waiting lists.

Messaging

The messages and files you send through the in-app chat, together with the user identifier associated with that service. If you use chat without an account, a guest identifier is generated and linked to your account if you register later.

Preferences and Settings

  • Theme preference (light/dark/system)
  • Language selection (Spanish/English)
  • Notification preferences

2.2 Information Collected Automatically

  • A unique identifier assigned to your account
  • Your device's push notification token, along with the platform, so we can send you appointment and message alerts
  • Audit logs of sensitive actions inside the App (who did what and when), for security and traceability
  • Origin of each appointment created: IP address, user agent, date and time, and technical device data (platform, operating system, model, App version, language and time zone) along with the screen the booking was made from. We use it solely to prevent schedule abuse and detect bulk or malicious bookings. It is kept for 12 months and then deleted. Only the professional for that appointment and authorized staff can consult it
  • Basic technical data required to serve real-time requests (not used for advertising or cross-app tracking)

2.3 Third-Party Services

Supabase

Cloud backend used for account authentication, the database (profiles, appointments, clinical records, payments), and file storage (profile images, clinical images, and imaging studies).

Firebase Cloud Messaging (Google)

Push notification service. It receives your device token and the alert content (for example, "you have an appointment tomorrow at 10:00"). We do not include clinical data in notification bodies.

Stream Chat

Provider of the patient–professional messaging. It hosts messages, attachments, and the user's display name.

Sign in with Google and Sign in with Apple

If you choose to register or sign in with these providers, we receive your email address and name from them. We never receive your password. If you use Sign in with Apple and choose to hide your email, we receive the private relay address Apple generates.

We do not use advertising networks, analytics SDKs, or crash-reporting SDKs in the App. We do not track you across third-party apps or websites, and we do not sell or share your data for advertising purposes.

3. How We Use Your Information

3.1 Core App Functionality

  • Account management: creating and securing your account and signing you in.
  • Schedule and appointments: showing availability, booking, rescheduling, cancelling, and tracking attendance.
  • Clinical records: allowing the professional to record and review their patients' clinical information.
  • Messaging: enabling direct communication between patient and professional.
  • Notifications: alerting you about upcoming appointments, status changes, and new messages.
  • Public profile: showing a professional's profile, specialties, and services to people looking for care.
  • Moderation and safety: reviewing reports, removing objectionable content, and blocking abusive users.

3.2 App Improvement and Communication

  • Diagnosing and fixing errors from reports you send us.
  • Responding to your support requests.
  • Sending essential operational communications (for example, password resets or changes to these terms). We do not send advertising.

3.3 What We Never Do

  • We do not use health data for advertising, commercial profiling, or data mining.
  • We do not sell your personal information.
  • We do not share clinical data with third parties other than the infrastructure providers listed in section 2.3.

4. Legal Basis for Processing

Depending on the law that applies to you, we process your data on the basis of: performance of a contract (providing the App), your consent (for example, push notifications or image uploads), our legitimate interest (security, abuse prevention), and compliance with legal obligations. Health data is processed on behalf of the treating professional, within the care relationship and their professional duties.

5. Data Retention

  • Your account data is retained while the account is active.
  • When you delete your account, your personal data is irreversibly anonymized (see the Account Deletion Guide).
  • Clinical records, imaging studies included, are retained detached from your identity, because the treating professional has a legal duty to keep the clinical record for the periods set by their local regulations.
  • The record of the age declaration stays attached to the already anonymized row, carrying nothing that could identify you, as evidence that the declaration was made.
  • Backups are rotated and deleted within 30 days.
  • Audit logs are retained for up to 12 months.

6. Health Data

Clinical data is a special category of personal data and receives additional protections:

  • Access is restricted by row-level security policies: each professional reaches only the patients of their clinic, and each patient only their own information.
  • Clinical images and imaging studies are served through time-limited signed links, never public URLs.
  • Imaging studies live in their own private repository, separate from the App's other files. Only the active members of the clinic that keeps that clinical record can reach it; patients do not read them from the App today.
  • It is not used for advertising and is never shared with advertisers, insurers, or data brokers.
  • The professional is responsible for obtaining patient consent to record and process that information.

7. Your Rights

Wherever you live, you can:

  • Access the personal data we hold about you.
  • Correct inaccurate information from within the App.
  • Delete your account from within the App (see the Account Deletion Guide).
  • Export a copy of your data by requesting it via email.
  • Object to or restrict certain processing.
  • Withdraw consent at any time, for example by turning off notifications in your system settings.

To exercise these rights, write to hello@bluepeaksoftwaresolutions.com. We respond within 30 days. If the request involves clinical data entered by a professional, we will forward it to that professional, who is its controller.

8. Children

The App is intended for people 18 and older: you must be at least 18 to create an account. Sign-up requires ticking a box that declares it and will not complete while it stays unticked, whether you sign up with an email address or with Google or Apple. We do not knowingly collect data from minors through their own accounts.

A minor patient may be treated by a professional who records their clinical history in Dentyco. In that case, it is the professional who must hold the consent of the parent or legal guardian, as required by the regulations that apply to them. If you believe a minor created an account, contact us and we will delete it.

9. Security

We apply technical and organizational measures proportionate to the risk:

  • Encryption in transit (TLS) to all of our services.
  • Row-level security policies in the database, so each user only reaches the data that belongs to them.
  • A strong password policy and optional two-factor authentication (TOTP).
  • Time-limited signed links for clinical images.
  • Audit logs of sensitive actions.

No system is completely secure. If we detect a data breach that affects you, we will notify you as required by applicable law.

10. International Transfers

Our providers (Supabase, Google Firebase, Stream) operate servers in the United States and the European Union. By using the App, your data may be processed in those jurisdictions, under the contractual safeguards those providers offer.

11. Changes to This Policy

We may update this Policy. The "Last updated" date reflects the current version. If changes are material, we will notify you in the App or by email before they take effect.

12. Contact

Blue Peak Software Solutions Email: hello@bluepeaksoftwaresolutions.com Website: https://bluepeaksoftwaresolutions.com