Privacy & security
Privacy by default — and honest about what's not done yet.
This app is not HIPAA compliant and makes no compliance claim. HIPAA applicability analysis and Business Associate Agreements with every vendor (hosting, database, storage, email/SMS, payments) are required before any real patient information is collected. Use synthetic demo data only.
What we do by design
- Minimal data: only what a dentist needs to decide whether to offer an appointment.
- No public provider directory and no public medical records.
- Dentists see limited details (category, urgency, area, distance) until they open a secure detail view, which is audit-logged. Contact info is shared only after you book with them.
- Server-side authorization with row-level security; strict separation between practices and organizations.
- Photos and X-rays live in private storage, viewable only through short-lived signed links. Phone hand-off links expire after 15 minutes.
- Notifications never include health details.
- Encryption in transit (TLS) and at rest (managed database/storage).
- Audit logs for dispatch, case views, payments, refunds and role changes.
Retention & deletion (draft)
Proposed: unbooked requests and their files deleted after 30 days; booked case records retained per legal/contract requirements; users may request deletion of their account. To be finalized during legal review.
Draft commercial terms — pending healthcare legal review. Not a compliance claim.