Privacy Policy - Dental Flow LLC

Last Updated: December 3, 2025

1. Information We Collect

Protected Health Information (PHI)

• Patient identifiers (names, dates of birth, insurance member IDs)
• Dental insurance coverage and benefits information
• Treatment and procedure codes
• Insurance claim data

Practice Information

• Dental practice details (name, address, NPI numbers)
• Staff user accounts and access credentials
• Practice management system integration data

Technical Data

• IP addresses, browser type, device information
• Usage logs and analytics
• API call records for troubleshooting

2. How We Use Your Information

To Provide Our Services

• Verify dental insurance eligibility
• Submit and track insurance claims
• Generate patient cost estimates
• Provide practice management tools

For Legal & Compliance

• HIPAA compliance and auditing
• Business Associate Agreement obligations
• Legal requirements and regulatory compliance

3. Data Protection & Security

Technical Safeguards

• 256-bit SSL encryption for all data transmission
• Encrypted data storage at rest
• Regular security audits and penetration testing
• Secure API authentication

Administrative Safeguards

• HIPAA-trained personnel
• Strict access controls and role-based permissions
• Regular security awareness training
• Business Associate Agreements with all vendors

4. Third-Party Services

API Dental

We use API Dental for insurance eligibility verification and claims processing. They are HIPAA-compliant and operate under a Business Associate Agreement.

Render.com

Our application is hosted on Render.com, which provides HIPAA-compliant infrastructure with encrypted data storage.

5. Your Rights

Practice Administrator Rights

• Access to all practice data
• Ability to export practice data
• User management and access controls
• Request data deletion (subject to legal holds)

Patient Rights

We act as a Business Associate to your practice. Patient data rights are managed through your practice's Privacy Policy and HIPAA procedures.

6. Data Retention

• Active practice data: Retained while account is active
• Account termination: Data deleted after 30-day grace period
• Legal requirements: Data retained as required by law

7. Contact Information

8. Changes to This Policy

We will notify practices of material changes 30 days in advance via email and in-app notifications.