1. Who we are
Dental Copilot ("we", "us", "our") is an AI-powered clinical documentation tool for dental professionals. Our website is trydentalcopilot.com.
2. What data we collect
We collect the following information when you use Dental Copilot:
- Account data: email address and hashed password (managed by Supabase Auth).
- Clinical input: the shorthand notes, drug queries, and procedure descriptions you type into the tool. These are sent to our server for AI processing and are not stored after the response is generated, unless you explicitly save a note.
- Saved content: drafts, completed notes, templates, and tasks you choose to save.
- Usage metadata: standard server logs (IP address, timestamps, request paths) for security and debugging.
- Subscription data: if you subscribe to a paid plan, we store your subscription status, plan type, and Stripe customer ID. Your payment details (card number, billing address) are held by Stripe and never stored on our servers.
3. Patient data and PII
Dental Copilot is designed as a documentation aid, not a patient record system. You should avoid entering identifiable patient information. As a safeguard, our server automatically strips common PII patterns (NHS numbers, dates of birth, postcodes, phone numbers, email addresses, and patient names) from AI-generated output before it is returned to you.
We do not store patient-identifiable health data. If identifiable data is inadvertently included in your input, it is processed in memory only and is not persisted.
4. How we use your data
- To authenticate you and provide access to the service.
- To process your clinical input through the Anthropic Claude API and return AI-generated documentation.
- To save drafts, notes, and templates at your request.
- To improve the reliability and security of the service.
5. Third-party processors
We use the following third-party services to operate Dental Copilot:
- Anthropic (Claude API): processes clinical input to generate notes. Anthropic's data retention and usage policies apply. Anthropic does not use API inputs to train models.
- Supabase: authentication and database hosting (EU/US regions).
- Vercel: frontend hosting and CDN.
- Render: backend API hosting.
- Stripe: payment processing and subscription management. When you subscribe to a paid plan, Stripe collects and processes your payment information (card details, billing address). We do not store your full card number — Stripe handles this securely. Stripe's privacy policy applies to payment data.
- Deepgram: voice-to-text transcription for dictation features.
6. Data retention
- Transient input: clinical input sent for AI generation is not stored after the response is delivered.
- Saved notes and drafts: retained until you delete them or delete your account.
- Account data: retained while your account is active. You may request deletion at any time.
- Server logs: retained for up to 30 days for security monitoring.
7. Your rights (UK GDPR / Data Protection Act 2018)
You have the right to:
- Access the personal data we hold about you.
- Request correction of inaccurate data.
- Request deletion of your account and associated data.
- Object to processing or request restriction of processing.
- Data portability — receive your saved notes in a machine-readable format.
- Lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data rights have been breached.
8. Security
We protect your data with:
- HTTPS encryption in transit (TLS 1.2+).
- Supabase Row-Level Security — users can only access their own data.
- Bearer token authentication on all API endpoints.
- Rate limiting to prevent abuse.
- Server-side PII stripping on all AI-generated output.
- Security headers including Content Security Policy, HSTS, and X-Frame-Options.
9. Cookies
Dental Copilot uses browser local storage to maintain your authentication session. We do not use tracking cookies, analytics cookies, or any third-party advertising cookies.
10. Changes to this policy
We may update this policy from time to time. Material changes will be communicated via the application. The "last updated" date at the top reflects the most recent revision.