DentistDSS Privacy Policy

1. Information we collect

The information we process depends on the features you use and whether you are a patient, dentist, receptionist, or clinic administrator.

• Account and profile details: name, email address, password credentials, account role, email-verification status, last-login information, and, where you provide them, date of birth, phone number, address, emergency contact, and profile image URL. Dentist profiles may also include specialization, licence number, experience, and education.
• Clinic and staff details: clinic name, address, phone number, business email, website, staff role, approval status and review notes, schedules, availability, working-hours notes, and clinic settings.
• Appointments and health-related information: dentist, clinic and service selections, appointment dates and times, reason for visit, symptoms, urgency, additional notes, rescheduling and cancellation details, and appointment status.
• Clinical records and images: where clinical-record features are used, patient names and contact details, health history, complaints, examination findings, diagnoses, treatment and follow-up plans, prescriptions, visit details, clinical or AI-assisted notes, and attachment URLs. Dental images such as X-rays are stored with thumbnails and metadata such as filename, content type, file size, image type, tooth number, description, and tags.
• Chatbot and AI content: the prompts and clinical documentation you enter, chatbot responses, conversation history, the selected assistant type, and technical or account identifiers needed to provide and secure the conversation.
• Messages and notifications: sender and recipient identifiers, subject, message content, delivery or read status, and related timestamps.
• Quiz answers: the dental-hygiene quiz runs in your browser. Your answers and score are held temporarily in the page and are not submitted to the DentistDSS API by the quiz feature. Retaking or leaving the quiz clears them.
• Location and clinic searches: clinic-search terms and, if you allow browser geolocation, latitude, longitude, accuracy, and a timestamp. Your coordinates are kept in session storage for clinic discovery and are used to centre Google Maps; the map feature does not send them to the DentistDSS API.
• Technical and security information: the API gateway records request time, HTTP method and path, resolved client IP address, User-Agent, and response status. Its request-logging filter does not record request bodies. Application and provider infrastructure may also process browser or device information, error details, recipient email addresses, and authentication events. Audit records can include the service or user actor, action, target, user and clinic IDs, timestamps, event context, and a content hash.

2. Google user data and OAuth scopes

If you choose Google Sign-In, Google Identity Services gives DentistDSS a Google ID token. We send that token over HTTPS to our authentication service, which verifies its signature, audience, expiry, and required claims before creating or accessing your DentistDSS account. We use only the basic Google Sign-In scopes described below and do not request additional Google API scopes:

• openid: allows OpenID Connect sign-in. We require the token's subject identifier (sub) and store it as your Google provider ID so we can authenticate you and associate sign-ins with the correct account.
• email: provides your Google email address (email) and verification status (email_verified). We require a verified email address and store it with your account to identify you, link an eligible patient account, and provide account-related communications.
• profile: provides basic profile information. We read only your given name (given_name) and family name (family_name) when present and use them for your DentistDSS first and last name. Although Google can include other basic profile fields, we do not read or store your full name, profile-picture URL (picture), locale, or hosted-domain information in this flow.

A single-use security nonce is also checked to prevent replay. It is held in Redis for up to five minutes and consumed when used; it is not a Google profile field or an additional data-access scope.

We do not request access to your Gmail messages, Google Drive files, Google Calendar, contacts, or other Google APIs, and we do not request offline access or a Google refresh token. Your Google password is not provided to or stored by DentistDSS. Information you enter directly into DentistDSS, such as a phone number, address, symptoms, or clinical notes, is not represented as coming from Google.

The raw Google ID token is used for sign-in verification and is not stored in browser local storage, browser session storage, or the DentistDSS account database. The Google provider ID, verified email address, and supplied given and family names are stored as part of your account. DentistDSS then issues its own session; Google tokens are not used as DentistDSS session tokens.

3. How we use information

• Authentication and accounts: to create and verify accounts, sign you in, restore and end sessions, manage passwords, associate Google Sign-In with your account, and display your profile.
• Appointments and clinic workflows: to find clinics and availability, book, reschedule, cancel, confirm and complete appointments, manage schedules, and allow authorized clinic staff to perform their roles.
• Dental-assistant and clinical functionality: to answer questions, provide triage and reception assistance, summarize documentation, maintain conversation context, display clinical records, and support dental-care workflows.
• Communications and support: to send verification and service-related messages, provide appointment or account notifications, respond to requests, and troubleshoot issues.
• Security and service operation: to authenticate requests, enforce roles and access controls, prevent fraud and abuse, monitor errors, maintain audit records, secure infrastructure, and keep the service available and reliable.

We do not use Google Sign-In information for targeted advertising, data brokerage, or credit decisions. AI-generated information is decision support and is not a substitute for diagnosis or treatment by a qualified dental professional.

4. Storage and retention

DentistDSS's public web application is hosted by Vercel. Account, appointment, clinic, session, and clinical metadata are stored in PostgreSQL on our self-hosted backend. GenAI conversations and interactions and audit documents use MongoDB. Clinical image files and thumbnails use MongoDB GridFS, with related metadata in PostgreSQL. Redis holds short-lived Google nonces and account/session-family security state rather than raw access tokens. Traffic to the backend passes through Cloudflare and our API gateway.

• Account, clinic, appointment, notification, and clinical records: the current service does not automatically expire or periodically delete these records. They are retained while the relevant account or clinic remains active and until deleted through an available feature or following a verified deletion request, subject to records we need for security, dispute handling, or legal obligations.
• Chatbot conversations and AI interaction records: where AI features are enabled, each conversation document retains its latest 50 messages by default, removing older messages from that document as new messages arrive. This message limit is configurable. A separate AI interaction record stores the full prompt, full or partial response, status, identifiers, and usage metadata without the conversation message cap. The application does not define an automatic expiry or deletion schedule for these interaction records. Closing or clearing the browser view does not erase either type of server-side record.
• Google and DentistDSS session credentials: the raw Google ID token is not persisted after sign-in verification. A DentistDSS access token is kept in browser memory and expires after five minutes; raw access tokens are not stored in the session database. Refresh cookies and sessions last up to 30 days unless revoked earlier or you sign out. Only SHA-256 hashes of refresh tokens are stored in PostgreSQL, and the current service does not automatically delete expired or revoked session rows. Revoking Google access does not delete a DentistDSS session or account.
• Email verification codes: codes expire after ten minutes. The authentication service stores a peppered SHA-256 hash rather than the raw code. The code is sent to the recipient through the configured SMTP email service.
• Quiz and other in-memory content: quiz answers, unsubmitted form content, and the current browser-displayed chat state disappear when reset or when the relevant page or browser session ends. This does not affect copies already submitted to the service.
• Browser preferences and location: theme and notification preferences remain in local storage until you clear them or clear site data. A verification-resend timer is removed after successful verification or when its cooldown expires or is next evaluated. Coordinates in session storage are reused for up to five minutes when fresh, are removed when location is cleared or permission is denied, and otherwise remain until the browser session ends or site data is cleared; five minutes is not an automatic deletion timer.
• Downloads: an AI summary you download as a text file remains on your device until you delete it. DentistDSS cannot manage that downloaded copy.
• Operational logs, audit entries, and backups: these may be retained separately from information shown in your account and may not be erased immediately when an interactive record is deleted. The current production configuration does not define a single fixed retention period or automatic deletion schedule for application logs, audit entries, or infrastructure backups. Provider-retained logs are also subject to the relevant provider's settings and terms.

5. Who we share information with

We disclose information to the following recipients and service providers only for the purposes described in this policy. We do not sell personal information, but that statement does not replace the specific disclosures below.

• Vercel (web hosting): hosts and delivers the public web application and processes network and request information when you visit it.
• Vercel Web Analytics and Speed Insights (usage and performance measurement): receive the page address without its query string or fragment, the referring page, browser, operating system, device type and approximate country, and page-speed measurements. They also receive a few events (a clinic search with its number of results, a clinic registration started or submitted, a booking started or requested) that carry no names, contact details, search text or health information. They are used only in aggregate to understand which pages help people and how fast they load.
• Cloudflare (network and security infrastructure): routes traffic to the backend and processes connection, request, and security information.
• Database and backend infrastructure: PostgreSQL, MongoDB, GridFS, and Redis store the account, service, clinical, AI, session-security, and audit information described above. Redis does not store the raw DentistDSS access tokens.
• Google Identity Services (authentication): processes your Google account interaction and provides the ID token used for Google Sign-In. DentistDSS does not forward your Google ID token to advertising providers.
• Google Maps Platform (clinic discovery): receives map requests, clinic addresses that need geocoding, clinic coordinates, and your coordinates when used to centre the map. Directions links may also disclose clinic coordinates or a clinic name to Google Maps or Apple Maps when you choose them.
• Configured self-hosted AI endpoint and OpenAI (conditional AI processing): where the GenAI service is enabled and configured, DentistDSS sends the current prompt, recent conversation messages, and relevant prompt-template context to the configured self-hosted endpoint, which forwards them to OpenAI as an upstream provider to generate a response. The default history is up to 10 recent messages and is configurable. See the AI processing section below.
• SMTP email delivery provider: processes recipient email addresses, sender information, and message content for account verification, appointment, and other service-related email. Do not include sensitive health information in ordinary email requests to us.
• Your clinic and authorized users: dentists, receptionists, clinic administrators, and other authorized clinic personnel can access relevant patient, appointment, and clinical information to provide care and perform clinic operations. Access depends on their role and relationship to the clinic.
• External content and legal recipients: opening a book, clinic, or directions link shares ordinary request information with the destination you choose. We may also disclose information to regulators, courts, law enforcement, or advisers where legally required or necessary to protect users, investigate abuse, or establish or defend legal claims.

6. AI processing and model training

Where the GenAI service is enabled and configured, the DentistDSS backend sends the current prompt, recent conversation messages, and relevant prompt-template context to its configured self-hosted OpenAI-compatible AI endpoint, which forwards them to OpenAI as an upstream provider to generate a response. "OpenAI-compatible" describes the interface; the term alone does not identify the provider or establish that OpenAI operates the endpoint. By default, up to 10 recent messages are included; this history limit is configurable. Built-in prompt context can include a display name derived from the local part of your email address, your primary account role, whether you are authenticated, and role-specific instructions. Built-in prompts do not include your full email address, user ID, clinic ID, or session ID. Custom prompt templates may include clinic and session identifiers. User, clinic, and session identifiers are nevertheless stored with DentistDSS conversation records. The browser sends prompts to our API, not directly to the configured endpoint, and does not contain an AI-provider API key.

Prompts and recent messages can contain dental concerns, symptoms, clinical observations, treatment notes, or other personal information you choose to enter. If the GenAI service is disabled for a deployment, that deployment does not send new prompts to an AI provider; disabling the service does not delete previously stored conversations or interaction records.

DentistDSS does not use your prompts, responses, Google Sign-In information, clinical records, or images to train or fine-tune its own AI models. We do not sell AI content or use it for targeted advertising.

OpenAI's own handling of information is subject to the terms and settings for the configured service and the OpenAI Privacy Policy.

Please do not submit another person's health information or identifying documents unless you are authorized to do so. AI responses can be wrong and should be reviewed by an appropriate professional.

7. Your choices and data rights

• Access and correct: signed-in users can view account information and use available profile, appointment, message, and clinical-record views. The profile page supports changes to first name, last name, date of birth, phone number, and address. Contact us to request access to information that is not available through your account or to correct information you cannot edit.
• Appointments: available controls let you reschedule or cancel an appointment. Cancellation changes the appointment status; it does not erase the appointment or its audit history.
• Export: you can download the latest generated AI summary as a text file. For an export of other account, appointment, chatbot, or clinical information, email a request to the address below. We may need to verify your identity and authority, especially for patient or clinic records.
• Delete: the current interface does not provide self-service deletion for an entire account, server-side chatbot history, or clinical records. To request account or record deletion, email dentistdss@gmail.com from the relevant account address and identify the information you want deleted. We will verify the request and explain any information that must be retained. Browser clear, quiz retake, appointment cancellation, and logout are not server-side account deletion.
• Local data and location: you can deny location permission, clear saved location through available controls, clear downloaded files yourself, or use browser settings to remove cookies and site storage. Blocking essential cookies may prevent sign-in and session restoration.
• Revoke Google access: visit Google Account third-party access settings and remove DentistDSS. This prevents future authorized Google Sign-In access but does not delete your DentistDSS account, end every existing DentistDSS session, or change your Google Account credentials. Contact us separately to delete DentistDSS data, and use your Google Account settings for Google-side security controls.

8. How we protect information

Our measures include verifying Google ID tokens and single-use nonces, five-minute RS256-signed DentistDSS access tokens, BCrypt password hashing, peppered verification-code hashes, refresh-token rotation and reuse revocation, and anti-CSRF double-submit checks. Browser access and anti-CSRF values are kept in memory, bearer credentials are restricted to the configured API origin, and authentication responses use no-store. Role-based access controls, backend network policies, and clinical-image validation and re-encoding provide additional protection. The service worker bypasses API, authentication, OAuth, AI, and authorized requests. Production deployments use HTTPS endpoints and security headers to limit content framing and restrict browser capabilities.

No online service or storage system can be guaranteed completely secure. Protect your account credentials, sign out on shared devices, and contact us if you suspect unauthorized access.

9. Cookies and browser storage

• Essential session and security cookies: in production, __Secure-dentistdss-refresh holds the refresh token with HttpOnly, Secure, and SameSite=None, a path of /api/auth, and a maximum age of 30 days. XSRF-TOKEN supports anti-CSRF validation with Secure and SameSite=None, a path of /, and a maximum age of 30 days; it is readable by the application so it can return the matching header. Signing out expires both cookies. They are not used by DentistDSS for advertising.
• DentistDSS local storage: stores your dark-mode preference, notification preferences, and a temporary verification-resend timer. It is not used to store the current DentistDSS access token or your Google ID token.
• DentistDSS session storage: stores permitted geolocation coordinates and related accuracy and timestamp information for clinic discovery.
• Static-content caching: the progressive-web-app service worker caches same-origin navigation and static assets. It does not intentionally cache API, authentication, OAuth, generative-AI, or authorized responses.
• Usage analytics: Vercel Web Analytics and Speed Insights do not set cookies or use browser storage. Vercel counts visits with a short-lived anonymous hash that is discarded within 24 hours.
• Third-party services: Google Sign-In and Google Maps may set or read their own cookies and use similar technologies under Google's privacy policy. External sites you visit have their own practices.

DentistDSS does not use analytics, advertising, or session-replay cookies. You can control cookies and site data through your browser, but essential authentication features may not work if you block them.

10. International data transfers

DentistDSS uses providers whose infrastructure may operate in multiple countries, including Vercel, Cloudflare, Google, OpenAI, and the email delivery provider. Your information may therefore be processed outside the state or country where you live. Self-hosted databases and an Australian clinic or default map location do not mean that all data is stored exclusively in Australia or any other single region. Provider locations and safeguards depend on the service and configuration used.

11. Changes to this policy

We may update this policy when our features, providers, or data practices change. We will publish the revised policy at this same URL and update its effective date. If a change materially affects how we use Google user data or other personal information, we will provide additional notice through the application or by email where appropriate. Please review the current policy before continuing to use affected features.

12. Contact us

For privacy questions or access, correction, export, or deletion requests, contact Zhifei.org / the DentistDSS team at dentistdss@gmail.com. To help us protect your information, use the email address associated with your account where possible and do not email passwords, Google tokens, or unnecessary health records.