1. Who this policy covers

This Privacy Policy explains how dmdent.com ("dmdent," "we," "us," or "our") collects, uses, stores, and protects personal data through the dmdent website and platform (the "Service"). It applies to:

• Clinics and staff who register for and use the Service, and
• Patients whose information is entered into the Service by a clinic, including through online booking and digital intake.

For patient data, your clinic is the data controller — the party that decides what patient data is collected and why. dmdent acts as a data processor, handling that data only to provide the Service and only on the clinic's instructions. If you are a patient with questions about your own records, please contact your dental clinic directly; they control that data, not dmdent.

2. What data we collect

2.1 Data from clinics and staff

Category	Examples
Account information	Name, email, username, password (stored as a secure hash, never in plain text), role (staff, clinic-admin, super-admin)
Clinic business information	Clinic name, address, logo, business details used for invoicing and branding
Billing information	Subscription plan, payment method details as needed to process payment, billing history
Usage data	Login activity, feature usage, and technical logs used for security and support purposes

2.2 Patient data entered by clinics

Category	Examples
Identity and contact information	Name, contact details, date of birth
Health information	Allergies, blood type, visit history, tooth-by-tooth dental chart records, freehand annotations, clinical notes entered by clinic staff
Consent and intake records	Digital intake form responses, e-signatures, consent confirmations, stored as signed PDF records
Appointment data	Booking dates, times, and preferences submitted through the online booking page
Billing records tied to visits	Itemized invoices, discount classifications (e.g., senior citizen/PWD), payment method and status

Patient data is entered into the Service by clinics or submitted directly by patients through a clinic's booking and intake pages. dmdent does not independently collect patient data outside of what a clinic's use of the Service generates.

3. Why we collect this data

We process personal data only for purposes necessary to provide and support the Service, including:

• Creating and maintaining clinic and staff accounts
• Storing and displaying patient records and dental charts for the clinic's use
• Operating online booking and digital intake features
• Generating invoices, tracking payments, and producing financial reports for the clinic
• Processing your clinic's subscription billing
• Maintaining account security, including login protection and session management
• Providing customer support when you contact us
• Improving the reliability and functionality of the Service

We do not sell personal or patient data, and we do not use patient health data for advertising or marketing purposes.

4. Legal basis for processing

Where the Data Privacy Act of 2012 or similar law applies, we and our clinic customers rely on the following legal bases:

• Contractual necessity — processing needed to provide the Service a clinic has subscribed to.
• Consent — for patient data, obtained by the clinic at the point of intake or booking; clinics are responsible for securing this consent.
• Legal obligation — where processing or retention is required by applicable healthcare or financial recordkeeping laws.
• Legitimate interest — for account security, fraud prevention, and service improvement, balanced against user rights.

5. How we store and protect data

• Data is stored in an encrypted, managed database (Google Cloud SQL for PostgreSQL), encrypted at rest, with automated backups.
• All data in transit is encrypted via HTTPS.
• Each clinic's records are logically isolated — staff at one clinic location cannot access another clinic's data, even within a shared multi-location account.
• Access is role-based: staff, clinic-admin, and cross-clinic super-admin roles see only what their role permits.
• Passwords require a 12-character minimum and are checked against known weak/common passwords; accounts lock for 15 minutes after 5 failed login attempts.
• Staff sessions expire automatically after a period of inactivity.

No system can guarantee absolute security. If we become aware of a data breach affecting your information, we will notify affected clinics without undue delay and, where required by law, notify the National Privacy Commission and affected data subjects.

6. Who we share data with

We do not sell personal data. We share data only with:

• Infrastructure providers — currently Google Cloud (hosting, database, and storage), which processes data on our behalf under its own data processing and security commitments.
• Payment processors — to process subscription billing; we do not store full payment card details ourselves.
• Other staff within your own clinic — according to the role-based permissions your clinic sets.
• Authorities — where required by law, court order, or valid legal process.

We do not share patient data across unrelated clinics, and we do not share patient data with third parties for their own marketing purposes.

7. International data transfer

Our infrastructure provider (Google Cloud) may process or store data in data centers located outside the Philippines. Where this involves a cross-border transfer of personal data, we take reasonable steps to ensure the receiving party maintains a comparable standard of data protection, consistent with the requirements of the Data Privacy Act of 2012. [Data center region is us-central1, located in Iowa, United States.]

8. Data retention

• We retain clinic and patient data for as long as the clinic's subscription is active.
• After a subscription ends, data remains available for export for [30] days, after which it may be deleted from our active systems, except where longer retention is required by applicable healthcare recordkeeping or tax/financial laws.
• Backup copies may persist for a limited additional period as part of standard backup rotation before being permanently deleted.

9. Your rights

Subject to applicable law, including the Data Privacy Act of 2012, you may have the right to:

• Be informed that your personal data is being processed
• Access the personal data we (or your clinic) hold about you
• Request correction of inaccurate data
• Object to certain processing, or withdraw consent where processing is based on consent
• Request erasure or blocking of data, subject to legal recordkeeping requirements
• Request a copy of your data in a portable format
• File a complaint with the National Privacy Commission

If you are a patient, requests about your health records should generally go to your dental clinic first, since they control that data. If you are a clinic or staff user, contact us directly using the details below.

10. Cookies and website analytics

Our website may use cookies or similar technologies for basic functionality and, if enabled, analytics to understand website usage.

11. Children's data

The Service is intended for use by dental clinics and their staff, not directly by children. Patient records may include minors' health information entered by a clinic on behalf of a parent or guardian; clinics are responsible for ensuring appropriate parental/guardian consent is obtained in accordance with applicable law before entering a minor's data.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be communicated by email or in-app notice at least [14] days before taking effect.