1. Who we are
Dental Copilot ("we", "us", "our") is an AI-powered clinical documentation tool for dental professionals. Our website is trydentalcopilot.com.
2. What data we collect
We collect the following information when you use Dental Copilot:
- Account data: email address and hashed password (managed by Supabase Auth).
- Clinical input: the shorthand notes, drug queries, and procedure descriptions you type into the tool. These are sent to our server for AI processing and are not stored after the response is generated, unless you explicitly save a note.
- Saved content: drafts, completed notes, templates, and tasks you choose to save.
- Documents sent to patients: if you use remote e-consent or email a document to a patient, the patient’s name and email address, the document, and — once they sign — their typed name and drawn signature. See section 3 for how long these are kept.
- Usage metadata: standard server logs (IP address, timestamps, request paths) for security and debugging.
- Subscription data: if you subscribe to a paid plan, we store your subscription status, plan type, and Stripe customer ID. Your payment details (card number, billing address) are held by Stripe and never stored on our servers.
3. Patient data and PII
Dental Copilot is designed as a documentation aid, not a patient record system. You should avoid entering identifiable patient information. As a safeguard, our server automatically strips common PII patterns (NHS numbers, dates of birth, postcodes, phone numbers, email addresses, and patient names) from AI-generated output before it is returned to you.
What we keep, and for how long. Input you send for AI generation is processed and not stored unless you save the result. Notes you save are stored against the patient reference you choose — use a practice reference rather than a patient’s name — until you delete them.
Remote e-consent and documents sent to patients necessarily identify the patient: we store their name and email address so we can send them the link, and the document itself. We keep the email address only until the request ends — when the patient signs, or you cancel it. A signed form is deleted 30 days after signing; anything never signed is deleted when its 30-day link expires. Dental Copilot is not your patient record: download signed forms and file them in your practice software.
For patient information, your practice is the data controller and Dental Copilot processes it on your behalf, only to provide the service.
4. How we use your data
- To authenticate you and provide access to the service.
- To process your clinical input through the Anthropic Claude API and return AI-generated documentation.
- To save drafts, notes, and templates at your request.
- To improve the reliability and security of the service.
5. Third-party processors
We use the following third-party services to operate Dental Copilot:
- Anthropic (Claude API): processes clinical input to generate notes. Anthropic's data retention and usage policies apply. Anthropic does not use API inputs to train models.
- Supabase: authentication and database hosting (EU/US regions).
- Vercel: frontend hosting and CDN.
- Render: backend API hosting.
- Stripe: payment processing and subscription management. When you subscribe to a paid plan, Stripe collects and processes your payment information (card details, billing address). We do not store your full card number — Stripe handles this securely. Stripe's privacy policy applies to payment data.
- Deepgram: voice-to-text transcription for dictation features.
- Resend: sending emails, including documents and consent forms you send to patients.
6. Data retention
- Transient input: clinical input sent for AI generation is not stored after the response is delivered.
- Saved notes and drafts: retained until you delete them or delete your account.
- Patient email addresses on documents sent to patients: deleted when the patient signs or the request is cancelled, and in any case when the 30-day link expires.
- Signed consent forms: deleted 30 days after signing. Unsigned and view-only documents are deleted when their 30-day link expires.
- Account data: retained while your account is active. You may request deletion at any time.
- Server logs: retained for up to 30 days for security monitoring.
7. Your rights (UK GDPR / Data Protection Act 2018)
You have the right to:
- Access the personal data we hold about you.
- Request correction of inaccurate data.
- Request deletion of your account and associated data.
- Object to processing or request restriction of processing.
- Data portability — receive your saved notes in a machine-readable format.
- Lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data rights have been breached.
8. Security
We protect your data with:
- HTTPS encryption in transit (TLS 1.2+).
- Supabase Row-Level Security — users can only access their own data.
- Bearer token authentication on all API endpoints.
- Rate limiting to prevent abuse.
- Server-side PII stripping on all AI-generated output.
- Security headers including Content Security Policy, HSTS, and X-Frame-Options.
9. Cookies
Dental Copilot uses browser local storage to maintain your authentication session. We do not use tracking cookies, analytics cookies, or any third-party advertising cookies.
10. Changes to this policy
We may update this policy from time to time. Material changes will be communicated via the application. The "last updated" date at the top reflects the most recent revision.