01 — Roles and responsibilitiesRoles and responsibilities
The Client — the dental laboratory or oral-health professional holding the subscription — is the data controller and remains solely responsible for the data it decides to place in the platform, over which it keeps absolute editorial, usage and direction control.
DENTAFLOW LAB SOLUTION acts as a processor and passive technical host (SaaS technology). We provide the cloud storage and the technical infrastructure required to operate the platform, in line with the Client's own configuration instructions.
Technical scope: infrastructure hosting, data storage, system maintenance and provision of application access to the platform.
02 — Data we storeData we store
Categories of people concerned by the storage — all of them registered by the Client alone:
- Patients of the dental practices and laboratories
- Dental practitioners
- Internal staff and authorised subcontractors
Data stored on the platform:
- Clinical identifiers or pseudonyms
- 3D/2D impressions and scans
- Technical datasheets for medical devices
- Clinical prescriptions
- Professional identification data imported by the Client
03 — No active use of your dataNo active use of your data
No active access. DentaFlow refrains from accessing, viewing, modifying, selling, disclosing or using Client data, except where strictly necessary for the technical maintenance of the hosting infrastructure or upon an explicit support request from the Client.
Client autonomy. All day-to-day operations on the data — creation, consultation, modification, deletion, transfer and practical use — are carried out entirely autonomously by the Client and its authorised users, directly from the application interface. DentaFlow only keeps the application running in the background.
Patient records and health data imported by the Client are subject to strict isolation measures and are never used, sold or exploited for commercial purposes.
04 — Hosting and infrastructureHosting and infrastructure
Data and the platform are hosted on Amazon Web Services (AWS) infrastructure in the Frankfurt, Germany region, which holds the regulatory HDS V2 certification for health-data hosting.
Physical infrastructure, server security and technical hosting operations are handled and operated entirely by AWS. As DentaFlow is not itself a physical infrastructure or telecommunications host, interruptions, slowdowns or unavailability caused directly or indirectly by an AWS technical failure or network incident fall outside its control.
05 — Security of accessSecurity of access
Personal accounts. User accounts are strictly nominative, personal and non-transferable. Sharing a single account, or using generic credentials simultaneously for several individuals, is expressly prohibited.
Credential security. The Client and its users are solely responsible for the confidentiality, strength and safekeeping of their passwords. Any operation performed on the platform using the Client's credentials is deemed to have been carried out by the Client.
Security incidents. In the event of loss, theft or suspected compromise of credentials, the Client undertakes to inform DentaFlow immediately so that the required suspension or reset measures can be deployed.
06 — Retention during the subscriptionRetention during the subscription
User account data is retained for the entire duration of the contractual relationship. Data and files relating to cases and orders are retained temporarily, according to the plan subscribed to, in order to optimise the infrastructure and guarantee performance:
- Starter (BASIC) — case data is kept for twenty-one (21) days from creation, then automatically deleted.
- Growth / Scale (ESSENTIAL) — case data is kept for eight (8) weeks (56 days) from creation, then automatically deleted.
The Client is solely responsible for exporting and locally backing up its production files and scans before these retention periods expire.
End of contract, export and deletion
Export window. If the contract is terminated or expires for any reason, the Client has a maximum of thirty (30) calendar days from the end date of the contract to export and retrieve its data using the platform's standard export features.
Permanent deletion. After this strict thirty (30) day period, DentaFlow permanently, fully and irreversibly deletes all of the Client's data, databases and files hosted on AWS servers, with no possibility of restoration.
08 — ConfidentialityConfidentiality
Each party undertakes to keep strictly confidential all commercial and technological data and trade secrets identified as such and disclosed to it during performance of the contract. This undertaking survives for five (5) years after the expiry or termination of the contractual relationship.
09 — Your rightsYour rights
DENTAFLOW LAB SOLUTION processes personal data in accordance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and the French Data Protection Act.
You have the right to access, rectify, erase, restrict, port and object to the processing of your personal data. Where the data was imported into the platform by a laboratory or a practice, that organisation is the controller and requests should be addressed to it first; DentaFlow assists it as processor.
10 — ContactContact
To exercise your rights, report a security incident or ask any question about this policy:
CompanyDENTAFLOW LAB SOLUTION — SAS, SIREN 104 702 907
Registered office30 rue des Jardiniers, 57000 Metz — France
Publisher details and intellectual property terms are set out in our terms of use.