Privacy Notice

DentalFlowCy (trading as DentalFlow), Cyprus, is the data controller for the personal data described in this notice — that is, we decide why and how it is processed. You can contact us at info@lysandroudental.com.

Where a dental clinic uses DentalFlow to manage its own patients, the clinic is the controller of that patient data and we act as its processor, handling the data only on the clinic's instructions.

• Account data (name, work email, clinic name, role, login credentials) — to create and secure your account and provide the Service. Legal basis: performance of our contract with you.
• Subscription and billing records (plan, seats, billing status, invoices issued by our reseller) — to manage your subscription and meet accounting obligations. Legal basis: contract and legal obligation.
• Support and communications (messages, attachments you send us) — to answer your questions. Legal basis: contract and our legitimate interest in supporting customers.
• Usage and technical data (log entries, feature usage, device type, browser, IP address, timestamps) — to keep the Service secure, diagnose faults and improve the product. Legal basis: legitimate interests in security and product improvement.
• Marketing preferences (if you opt in) — to send product updates. Legal basis: consent, withdrawable at any time.

Clinical and patient information entered by a clinic into DentalFlow is processed on that clinic's behalf under our agreement with them and is not used by us for our own purposes.

• Service providers / subprocessors — cloud hosting, database and storage, email delivery, error monitoring and support tooling, acting on our instructions under contract.
• Viva Wallet, our payment processor, for subscription and patient card payments. Viva Wallet handles card details directly on its own hosted checkout; we do not receive or store your full card data.
• Professional advisers — legal, accounting and audit advisers where necessary.
• Authorities — where we are required to disclose by law or to defend legal claims.

Our providers may process data outside the EEA. Where that happens we rely on an adequacy decision or on Standard Contractual Clauses together with appropriate technical measures.

We keep account data for as long as your subscription is active and for up to 12 months afterwards to allow reactivation and to resolve disputes. Billing and tax records are kept for the period required by Cypriot law (normally 6 years). Technical logs are typically kept for up to 12 months. When data is no longer needed it is deleted or anonymised.

Under the GDPR you may request access to your personal data, correction of inaccurate data, erasure, restriction of processing, portability, and you may object to processing based on legitimate interests. Where processing is based on consent you may withdraw it at any time.

Email info@lysandroudental.com to exercise a right; we respond within one month. You may also complain to the Office of the Commissioner for Personal Data Protection in Cyprus or your local supervisory authority.

We apply appropriate technical and organisational measures, including encryption in transit and at rest, role-based access controls, row-level database security, PIN or biometric gating for sensitive sections, audit logging and least-privilege access for our staff.

We use strictly necessary cookies and similar local storage to keep you signed in and to remember interface preferences; these are required for the Service to function. If we add analytics or marketing cookies we will ask for your consent first and you will be able to change your preferences at any time. You can also block or delete cookies in your browser, though the Service may not work correctly without the essential ones.

We may update this notice; the date at the top shows the latest version. Questions: info@lysandroudental.com.