Data Processing Agreement

Version 2026-10-12 · Effective October 12, 2026

This agreement is between Odentri Inc. (“Odentri”, “we”) and the dental practice, group or agency that holds a Odentri account (the “Practice”). It forms part of our Terms of Service and applies whenever we handle Practice Data. The Practice accepts it when creating or confirming its account. If this agreement and the Terms conflict about personal information, this agreement prevails. A countersigned copy is available on request at info@odentri.com.

1. Definitions

• Practice Data: personal information, including personal health information, that the Practice, its team or its patients and website visitors submit through the service: photos and illustrations, contact details, treatment interests, consent records, chairside cases and notes.
• Privacy Laws: the Personal Information Protection and Electronic Documents Act (PIPEDA), Ontario’s Personal Health Information Protection Act, 2004 (PHIPA) and its regulations, and any other Canadian privacy or health information law that applies to the Practice.
• Breach: theft or loss of Practice Data, or access, use, disclosure, copying, modification or disposal of it that this agreement does not permit.
• Subprocessor: a service provider we engage that may receive Practice Data to help run the service.

2. Roles

The Practice controls Practice Data and is accountable for it. For a Practice that is a health information custodian under PHIPA, Odentri supplies services that let the Practice collect, use, modify, disclose, retain or dispose of personal health information electronically, and acts as an electronic service provider under section 10(4) of PHIPA and section 6 of Ontario Regulation 329/04. Where a law or regulator treats Odentri as the Practice’s agent, we act only within the authority the Practice gives us in this agreement. Under PIPEDA, transfers to Odentri are for processing on the Practice’s behalf.

3. How we may use Practice Data

• We use Practice Data only as necessary to provide, secure and support the service under the Terms, the settings the Practice chooses, and the Practice’s other documented instructions.
• We do not disclose Practice Data except to our Subprocessors under section 6, to destinations the Practice connects (such as its CRM or webhook), or where the law requires it. If the law requires a disclosure, we will tell the Practice first unless the law forbids it.
• We never sell Practice Data, use it for advertising, combine it with other customers’ data, or use patient photos or illustrations to train AI models.
• We may use aggregated service measurements that identify no person or practice, such as timing and error counts, to operate and improve the service.

4. People with access

Only Odentri personnel who need access to provide support, security or maintenance may access Practice Data, and only after agreeing in writing to follow this agreement. Support access to a practice’s lead records is recorded in an audit log. We will not let anyone access Practice Data on our behalf unless they have agreed to these restrictions.

5. Security safeguards

We maintain administrative, technical and physical safeguards suited to the sensitivity of health information, including:

• encrypted connections (HTTPS) for all traffic, and encryption at rest by our hosting and database providers;
• photos and illustrations kept in private storage, opened only through authorized requests or links that expire within minutes;
• separation of each practice’s data, enforced by server-side authorization and database access policies;
• role-based access for practice team members, controlled by the Practice’s owners and administrators;
• encryption of CRM and webhook connection secrets with AES-256-GCM;
• an audit log of who opened or exported lead records, and who created, viewed or deleted chairside cases, plus setting and team changes;
• bot protection, rate limits and abuse controls on public forms; and
• application logs that exclude names, contact details and photos.

Our current safeguards are summarized on our Security page. We will not materially reduce them during the Practice’s subscription.

6. Subprocessors and cross-border processing

• The Practice authorizes the Subprocessors listed at odentri.com/subprocessors. Each is bound by written terms that require protection of Practice Data comparable to this agreement, and we remain responsible for their performance.
• We will give at least 30 days’ notice by email before a new Subprocessor receives Practice Data. If the Practice objects on reasonable privacy grounds and we cannot address the objection, the Practice may cancel and receive a pro-rated refund of any prepaid, unused period.
• Our database is hosted in Canada. Some Subprocessors, including our AI image provider, process Practice Data in the United States, where it may be accessible to courts, law enforcement and national security authorities under local law. Odentri tells website visitors this when they submit a photo; the Practice should tell chairside patients, for example with our consent form.

7. Breach notification

• We will notify the Practice at the first reasonable opportunity, and no later than 72 hours after we become aware of a Breach affecting its Practice Data, by email to its account owners and administrators. We will also notify the Practice if we access, use, disclose or dispose of Practice Data other than as this agreement allows.
• The notice will describe what happened and when, the information and people affected as far as known, what we have done to contain it, and a contact person. We will update the Practice as we learn more.
• The Practice decides on and gives any notice its law requires to affected individuals, the Information and Privacy Commissioner of Ontario or the Office of the Privacy Commissioner of Canada. We will provide the information it reasonably needs. We will not notify the Practice’s patients or regulators about its Practice Data without its agreement unless the law requires us to.
• We keep a record of every Breach for at least 24 months and share the entries about the Practice’s data on request.

8. Patient requests

Requests to access, correct or delete information go to the Practice. Its team can view a lead’s details and images, export leads (CSV), update a lead’s status, and delete a lead or chairside case, which removes its photos and illustrations. If the Practice needs more help, we will assist within 10 business days. If a patient contacts us directly, we will refer them to the Practice and tell the Practice within 5 business days.

9. Retention, return and deletion

• Photos and illustrations are deleted automatically after the Practice’s image retention setting (at most 30 days), and contact records after its contact retention setting (at most 180 days). Copies sent to our AI image provider are requested for deletion as soon as each illustration is returned and set to expire within one hour.
• Odentri is not a records management system. If the Practice considers a photo or illustration part of a patient’s dental record, it must save a copy in its own records, which professional rules may require it to keep for years.
• When the account ends, Practice Data continues to be deleted under those settings. The Practice may export its leads first and may ask us to delete all remaining Practice Data sooner; we will do so within 30 days and confirm in writing. Copies in provider backups expire on the provider’s schedule. We keep billing records and the audit log, which contains identifiers and actions but not patient details, as long as the law or our accountability obligations require.

10. Assurance

On request, and once a year without request, we will give the Practice the information it reasonably needs to show compliance with its Privacy Laws: our security summary, Subprocessor list, privacy impact assessment summary, answers to a reasonable security questionnaire, and an extract of the audit log for its records. A regulator’s review of the Practice may also include a review of how we handle its Practice Data, and we will cooperate.

11. The Practice’s responsibilities

• Have the authority and any consent required to collect Practice Data and to use Odentri, including written consent for chairside photos. Website visitors must be 18 or older. A chairside photo of a patient under 18 needs a parent or guardian’s consent.
• Control which team members can access the account, and remove access promptly when someone leaves.
• Tell us promptly at info@odentri.com about any suspected unauthorized access to its account.
• Not use Odentri for patients or practices in Quebec until we confirm it is offered there.

12. Term and changes

This agreement lasts as long as we hold Practice Data. We may update it to reflect changes in law or the service with at least 30 days’ notice, as described in the Terms; updates will not reduce the protection of Practice Data. Questions: info@odentri.com (Privacy Officer, Odentri Inc.).