Privacy Notice

DentalFlowCy (trading as DentalFlow), Cyprus, is the data controller for the personal data described in this notice — that is, we decide why and how it is processed. You can contact us at info@dentalflowcy.com.

Where a dental clinic uses DentalFlow to manage its own patients, the clinic is the controller of that patient data and we act as its processor, handling the data only on the clinic's instructions.

• Account data (name, work email, clinic name, role, login credentials) — to create and secure your account and provide the Service. Legal basis: performance of our contract with you.
• Subscription and billing records (plan, seats, billing status, invoices issued by our reseller) — to manage your subscription and meet accounting obligations. Legal basis: contract and legal obligation.
• Support and communications (messages, attachments you send us) — to answer your questions. Legal basis: contract and our legitimate interest in supporting customers.
• Usage and technical data (log entries, feature usage, device type, browser, IP address, timestamps) — to keep the Service secure, diagnose faults and improve the product. Legal basis: legitimate interests in security and product improvement.
• Marketing preferences (if you opt in) — to send product updates. Legal basis: consent, withdrawable at any time.

Clinical and patient information entered by a clinic into DentalFlow is processed on that clinic's behalf under our agreement with them and is not used by us for our own purposes.

• Service providers / subprocessors — cloud hosting, database and storage, email delivery, error monitoring and support tooling, acting on our instructions under contract.
• Stripe, our payment processor for DentalFlowCy software subscriptions. Stripe handles card details directly on its own secure checkout and billing portal; we do not receive or store your full card data.
• Viva Wallet, used only when a clinic chooses to take card payments from its own patients. Viva Wallet handles those card details directly on its own hosted checkout.
• Professional advisers — legal, accounting and audit advisers where necessary.
• Authorities — where we are required to disclose by law or to defend legal claims.

Our providers may process data outside the EEA. Where that happens we rely on an adequacy decision or on Standard Contractual Clauses together with appropriate technical measures.

We keep account data for as long as your subscription is active and for up to 12 months afterwards to allow reactivation and to resolve disputes. Billing and tax records are kept for the period required by Cypriot law (normally 6 years). Technical logs are typically kept for up to 12 months. When data is no longer needed it is deleted or anonymised.

Under the GDPR you may request access to your personal data, correction of inaccurate data, erasure, restriction of processing, portability, and you may object to processing based on legitimate interests. Where processing is based on consent you may withdraw it at any time.

Email info@dentalflowcy.com to exercise a right; we respond within one month. You may also complain to the Office of the Commissioner for Personal Data Protection in Cyprus or your local supervisory authority.

DentalFlowCy staff may access a clinic's Settings (its configuration, not patient records) without prior approval in order to provide support, maintenance and security. This is technically restricted so that patient records, appointments, receipts, payments, documents and finance remain blocked.

Access to patient or other personal data happens only with the clinic's explicit approval for each session (a one-time code shown on the clinic's own screen), except where we are required by law or must protect the security of the Service. In that case we act as the clinic's processor under Article 28 GDPR and only on its instructions. Our lawful bases are performance of our contract (Article 6(1)(b) GDPR) and our legitimate interest in supporting and securing the Service (Article 6(1)(f) GDPR).

Every support visit is logged with the person, the clinic, the time and the screens opened. While support is inside a clinic, the clinic sees a notice on its own screen listing what is being viewed and can end the session at any time.

We apply appropriate technical and organisational measures, including encryption in transit and at rest, role-based access controls, row-level database security, PIN or biometric gating for sensitive sections, audit logging and least-privilege access for our staff.

We use strictly necessary cookies and similar local storage to keep you signed in and to remember interface preferences; these are required for the Service to function. If we add analytics or marketing cookies we will ask for your consent first and you will be able to change your preferences at any time. You can also block or delete cookies in your browser, though the Service may not work correctly without the essential ones.

We may update this notice; the date at the top shows the latest version. Questions: info@dentalflowcy.com.