Privacy Policy

1. Who we are and how to contact us

Diagnosit LLC is a private limited-liability company registered at Shams Business Center, Sharjah Media City Free Zone, United Arab Emirates.

• Privacy questions and requests to exercise your rights: care@diagnosit.com
• Account and data deletion requests: Data Deletion

2. Our role: when we are a controller and when we are a processor

Two different kinds of personal data pass through Diagnosit, and our legal responsibility is different for each.

Clinic staff data. For the personal data of the clinic staff who hold Diagnosit accounts, we act as a data controller. We determine why and how that data is processed.

Website visitors and enquiries. For the personal data of people who visit our website, send us an enquiry, ask for a demo or download one of our free tools, we act as a data controller.

Patient information. For the patient information a clinic enters into the platform, the clinic is the data controller and Diagnosit is a data processor. The clinic decides which patients to record, what clinical information to enter, and how long to keep it. We process that information only on the clinic’s documented instructions and for no independent purpose of our own.

It follows that the clinic — not Diagnosit — is responsible for establishing a lawful basis for processing each patient’s information, for giving patients a privacy notice, and for obtaining any consent required by the law applicable to that clinic. A patient wishing to exercise their rights should contact the clinic that treated them in the first instance; we will assist that clinic promptly.

We apply the same protections to every patient record regardless of the patient’s nationality or country of residence. Our clinic customers treat patients from many countries, and we do not vary our standard according to where a patient comes from.

We process personal data in accordance with:

• Regulation (EU) 2016/679 (the GDPR) and the UK GDPR, where they apply;
• Turkish Law No. 6698 on the Protection of Personal Data (KVKK), under which our clinic customers act as veri sorumlusu (data controller) and Diagnosit acts as veri işleyen (data processor); and
• UAE Federal Decree-Law No. 45 of 2021 Regarding the Protection of Personal Data (PDPL), the law of our place of establishment.

3. Personal data we process

(a) Clinic staff accounts. When a clinic administrator creates an account for a member of staff, and when that person uses the platform, we process:

• Name, work email address, telephone number and profile picture;
• A cryptographically hashed password — we never store or have access to the password itself;
• Role, permissions, clinic membership and professional details such as position and specialisation;
• Session and interface credentials, and device identifiers used to deliver push notifications;
• Technical records of use of the service, including IP address, device and browser information, pages and features accessed, and timestamps.

(b) Patient information entered by the clinic. Clinic staff record patient information in order to prepare and discuss treatment. This may include:

• Name, age, gender, nationality and the clinic’s own patient reference;
• Presenting complaint, stated expectations, current medication and free-text clinical notes;
• Proposed and recorded treatments, treatment plans, visits and pricing;
• Clinical media uploaded by the clinic, including X-rays, intraoral photographs, videos, documents and before-and-after images;
• Voice notes dictated by a clinician, and the text transcribed from them;
• Messages exchanged between clinic staff within a patient record.

(c) Website visitors and enquiries. When you visit our website or contact us through it, we process:

• What you give us in a form: your name, your role, the name of your clinic, its country, its website or social media link, its size and how it works today, your work email address and your WhatsApp number;
• Your answers to a form you started and did not finish. These are stored without your name, email address or telephone number;
• The time of a call you book with us;
• Your WhatsApp number, to send the code that confirms it before we release a demo login;
• How the website is used: the pages and sections viewed and the buttons pressed, linked to a random identifier that lasts only as long as your browser tab stays open;
• The country you are visiting from, which our hosting provider derives from your IP address. We do not store the IP address itself;
• The advertisement, link or website that brought you to us, including campaign tags and the click identifiers that advertising platforms add to a link.

What we do not collect. The platform has no field for a patient’s email address, telephone number, postal address, date of birth, national identity or passport number, insurance details or payment card details. We do not collect any of these, and we do not collect location data from any device.

4. Health data

Patient information of the kind described above is data concerning health. It is a special category of personal data under Article 9 of the GDPR and a special category of personal data under Article 6 of the KVKK, and it receives a correspondingly higher standard of protection. We process it solely as a processor, on the instructions of the treating clinic and for that clinic’s own treatment purposes. We do not use patient information to develop or improve our products, we do not use it for any form of profiling or automated decision-making about a patient, and we do not sell, rent or otherwise make personal data available to anyone for their own purposes.

5. Why we process data, and on what basis

Where we act as a controller in respect of clinic staff data, we rely on the following legal bases:

• Performance of a contract — to create and administer accounts, provide the platform, and deliver support;
• Legitimate interests — to keep the service secure and available, to prevent and investigate misuse, to maintain audit records, and to communicate about the service;
• Legal obligation — to keep accounting and tax records and to respond to lawful requests from authorities.

Where we act as a controller in respect of website visitors and enquiries, we rely on:

• Steps taken at your request before entering into a contract, to answer your enquiry, to arrange a call and to give you access to a demo;
• Legitimate interests, to decide which enquiries we answer first, to measure how our website and our advertising perform, and to keep the website secure;
• Consent, where the law requires it, for example before we use any non-essential cookie or send you marketing messages. You can withdraw consent at any time.

Where we act as a processor in respect of patient information, the lawful basis is determined by the clinic as controller, and we process only on its instructions.

6. Artificial intelligence features

Diagnosit offers optional assistance features that use third-party artificial intelligence services. A clinic can enable or disable these features. Where they are used:

• A clinician’s dictated voice note is sent to a third-party AI transcription service and converted to text.
• That text, or text typed by the clinician, is sent together with the clinic’s own catalogue of treatments to a third-party AI service, which returns a draft treatment plan.

Two points are worth stating plainly, because they materially limit what leaves the platform:

• No X-ray, intraoral photograph, video or any other patient image is ever sent to an AI service. Image analysis is not part of these features.
• The information sent contains no patient name, age, gender, nationality or record identifier. The request is constructed so that it carries the clinical description and the treatment catalogue only. We should note honestly that a clinician dictating freely may speak a patient’s name aloud, in which case it would appear in the transcribed text.

Any output produced by these features is a draft for a qualified clinician to review, amend or reject. It is not a diagnosis and it is not medical or dental advice. All clinical decisions remain the sole responsibility of the treating practitioner.

7. Who we share data with

We do not sell or rent personal data, and we do not share it for advertising. We use a limited number of specialist service providers to operate the platform. They act as our sub-processors, may use the data only to provide their service to us, and are bound by written contracts imposing confidentiality and security obligations. The categories are:

• Cloud infrastructure, hosting and file storage providers;
• Content delivery providers, used to serve media securely;
• AI services, for transcription and treatment-plan drafting;
• Push notification delivery providers;
• Email delivery providers;
• Real-time messaging infrastructure;
• Customer relationship management providers, where we record enquiries and our contact with you;
• Calendar and scheduling providers, to arrange calls;
• Messaging providers, to send verification codes and to reply to you on WhatsApp;
• Payment processing and banking providers, for subscription and deposit payments. Card details are handled by the payment provider and are never stored on our systems.

A current list of our sub-processors, naming each provider, is available to clinic customers on request. Request it from care@diagnosit.com. We will give clinics advance notice of any new sub-processor and an opportunity to object, as set out in the data protection terms in section 11 of our Terms & Conditions.

We may also disclose personal data where we are required to do so by law, to establish or defend legal claims, or in connection with a merger, acquisition or sale of assets, in which case we will notify affected clinics.

8. Access by Diagnosit personnel

A small number of authorised Diagnosit support and engineering personnel may access a clinic’s workspace where this is necessary to investigate a fault or to provide requested assistance. Access is limited to those who need it, is subject to confidentiality obligations, and is recorded. A clinic can disable this access in its settings at any time.

9. Data retention — how long we keep personal data

We do not keep personal data indefinitely. Because a clinic controls the patient information it enters, that clinic may delete any patient record at any time, and we delete the underlying data on the timetable below. When a clinic’s contract with us ends, we delete its data according to the same schedule.

Where we are required by law to retain particular records for longer — for example accounting records — we retain only those records, for no longer than the law requires, and we restrict access to them.

10. How we protect personal data

We maintain technical and organisational measures appropriate to the sensitivity of the data, including:

• Encryption of all data in transit using industry-standard TLS;
• Industry-standard one-way hashing of passwords, so that they cannot be recovered or read by us;
• Session credentials that expire automatically and can be revoked;
• Granular role-based access control, so staff see only what their role requires;
• Strict logical separation between clinic workspaces, so that no clinic can access another clinic’s data;
• Short-lived signed links for access to clinical media, which expire automatically;
• Rate limiting and monitoring to detect and limit abuse;
• Audit records of significant changes, identifying who made them and when.

11. International transfers

Diagnosit is established in the United Arab Emirates and serves clinics whose patients come from many countries. Personal data may therefore be processed in a country other than the one in which it was collected. Where personal data originating in the European Economic Area, the United Kingdom or Türkiye is transferred to a country that has not been recognised as providing an adequate level of protection, we rely on appropriate safeguards, including standard contractual clauses and equivalent undertakings from our sub-processors, together with the technical measures described in section 10. Details of the safeguards applying to a particular transfer are available to clinic customers on request.

12. Your rights

Subject to the law that applies to you, you have the right to request access to your personal data; to have inaccurate data corrected; to have your data erased; to restrict or object to processing; to receive your data in a portable format; and, where processing is based on consent, to withdraw that consent at any time.

• Clinic staff may exercise these rights by contacting their clinic administrator or by writing to us at care@diagnosit.com.
• Patients should contact the clinic that treated them, as that clinic is the controller of their information. If you are unable to reach the clinic, write to us and we will do what we can to help identify and contact the relevant controller.
• Clinics may request export or deletion of their workspace at any time — see our data deletion page.
• Website visitors and people who have sent us an enquiry may exercise these rights by writing to us at care@diagnosit.com. Where we contact you on the basis of our legitimate interests, you may object at any time and we will stop.

We respond to requests without undue delay and in any event within 30 days.

You also have the right to complain to a supervisory authority. In Türkiye, you should first make your request to the data controller; if it is refused, ignored, or you are not satisfied with the reply, you may lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of learning of the response, and in any event within 60 days of your original request. In the EEA or the UK, you may complain to your local data protection authority at any time.

13. Personal data breaches

We maintain procedures to detect, investigate and respond to security incidents. If a personal data breach affects information a clinic has entrusted to us, we will notify that clinic without undue delay after becoming aware of it, and provide the information the clinic needs to meet its own notification obligations — which, under the GDPR, means notifying its supervisory authority within 72 hours. We will co-operate fully with the clinic in investigating and remedying any incident.

14. Children

Diagnosit accounts are held only by adult dental professionals, and the platform is not directed at children. A clinic may record information about a patient who is a minor; where it does, that information is handled under the same terms and protections as any other patient information, and the clinic remains responsible for any parental or guardian consent required by the law applicable to it.

15. Cookies

Our website and web application use cookies and equivalent local storage to operate the service: to keep you signed in, to maintain your session, and to remember interface preferences such as your chosen language and theme.

Our public website also measures its own use. It records the pages and sections viewed and the buttons pressed against a random identifier that is kept in your browser only until you close the tab. This measurement sets no cookie, is not shared with any third party and is not used to build an advertising profile.

If you arrive from an advertisement, the link may carry campaign tags or a click identifier added by the advertising platform. We keep these with your visit, and with your enquiry if you send one, so that we know which campaigns work.

We do not use advertising cookies or third-party tracking. If we introduce third-party analytics, session recording or advertising pixels in future, we will update this policy and ask for your consent beforehand where the law requires it.

16. Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last revised. Where a change materially affects how we handle personal data, we will notify clinic administrators by email or through the platform before it takes effect.

17. Contact

For any question about this policy or about how we handle personal data, write to care@diagnosit.com or to Diagnosit LLC, Shams Business Center, Sharjah Media City Free Zone, United Arab Emirates.