1. Introduction
Pulse Dent (“Pulse Dent”, “we”, “us”) operates a multi-tenant dental practice management platform. This policy explains what personal data we process, why, and the rights available to data subjects under applicable laws including the EU General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018.
2. Data we collect
- Account data: name, email, password hash, role, organization membership.
- Clinical data (on behalf of clinics): patient records, appointments, dental charts, treatment notes, invoices.
- Usage data: log-in events, IP address, user agent, feature interactions.
- Billing data: subscription plan, invoices, payment status (card data is handled directly by our payment processor and never touches our servers).
- Support correspondence: ticket messages, attachments.
3. Lawful basis
- Contract (Art. 6(1)(b) GDPR): to provide the service you subscribed to.
- Legitimate interests (Art. 6(1)(f)): security monitoring, fraud prevention, product improvement.
- Legal obligation (Art. 6(1)(c)): tax, accounting, regulatory record-keeping.
- Consent (Art. 6(1)(a)): optional marketing communications and non-essential cookies.
- Special-category data (Art. 9(2)(h)): processing of patient health data on behalf of healthcare providers under a Data Processing Agreement.
4. Retention
We retain account and clinical data for the duration of the subscription plus a grace period of 30 days, after which data is permanently deleted unless the clinic requests an extended export. Billing records are retained for 7 years for tax compliance. Audit logs are retained for 12 months.
5. Sub-processors
We rely on the following sub-processors to deliver the service. Each is bound by a data processing agreement and equivalent security commitments:
- Supabase - managed Postgres, authentication primitives.
- Vercel - web application hosting and CDN.
- Railway - API and worker hosting.
- Postmark - transactional email delivery.
- OpenAI - optional AI assistant features (data is not used for model training).
- Sentry - error and performance monitoring.
- LemonSqueezy - subscription billing and merchant of record.
6. Your rights
Under GDPR and equivalent regimes you may request access, rectification, erasure, restriction, portability, and objection. Where processing is based on consent, you may withdraw consent at any time. To exercise any right, contact privacy@pulsedent.example.
7. International transfers
Where data is transferred outside the EEA, we rely on the European Commission’s Standard Contractual Clauses and conduct transfer impact assessments per Schrems II.
8. Contact
Data controller: Pulse Dent Ltd. Email: privacy@pulsedent.example. You also have the right to lodge a complaint with your supervisory authority.