This Privacy Policy explains how Dentframe processes personal data when you visit dentframe.com, create an account on app.dentframe.com, or use the Dentframe marketplace for digital dental design.
1. Who is responsible
The data controller for personal data processed under this policy is Dentframe AB (Swedish company reg. no. 559189-3291), Stenöregatan 60, 218 31 Bunkeflostrand, Sweden. Contact: info@dentframe.com.
When clinics, laboratories or designers upload case files that contain patient data, the uploading customer is the controller of that patient data and Dentframe processes it on the customer's behalf as a processor under a data processing agreement (see sections 4 and 9).
2. Personal data we process
- Account data: name, company/clinic name, email address, phone number, country, role (clinic, lab or designer) and login credentials (stored hashed).
- Transaction data: orders, credits, subscriptions, invoices and payout details. Card data is handled by our payment provider; we do not store full card numbers.
- Content and case data: design files (e.g. STL/DICOM), case notes and messages exchanged on the platform, which may include patient health data.
- Communication data: emails and support requests you send us.
- Technical data: IP address, browser, device and log data needed to operate and secure the service.
3. Purposes and legal basis
- Providing the platform, matching orders with designers and delivering designs — performance of contract (GDPR art. 6(1)(b)).
- Payments, invoicing and bookkeeping — contract and legal obligation (art. 6(1)(b) and (c)); Swedish accounting law requires retention of accounting records.
- Security, fraud and abuse prevention (including bot protection on forms) — legitimate interest (art. 6(1)(f)).
- Service emails (order status, receipts, password reset) — contract (art. 6(1)(b)).
- Marketing emails and newsletters — consent or legitimate interest towards existing customers, with opt-out at any time.
- Patient health data in case files is processed only on the customer's instructions; the customer is responsible for having a legal basis under art. 6 and art. 9 GDPR.
4. Recipients and sub-processors
We share personal data only as needed to run the service, with designers or clinics involved in your order and with the service providers below:
- Vercel Inc. — hosting of the public website dentframe.com.
- Cloud infrastructure providers — hosting, databases and file storage for the platform.
- Stripe — card payments, saved cards and payouts to designers and manufacturers (Stripe Connect).
- Banks — incoming bank transfers and SEPA payments.
- Twilio SendGrid — transactional email.
- Google reCAPTCHA — bot protection on forms in the platform.
- H3D — AI-based automated dental design via API; case files are sent only when an AI design is requested.
- Relu — AI-based dental segmentation and design via API; case files are sent only when this feature is used.
An up-to-date list of sub-processors is available on request from info@dentframe.com. We may also disclose data where required by law.
5. Transfers outside the EU/EEA
Some providers (e.g. Stripe, SendGrid, Google and Vercel) are based in the United States. Where data is transferred outside the EU/EEA we rely on the EU–US Data Privacy Framework where the recipient is certified, or on the European Commission's Standard Contractual Clauses with supplementary measures.
Information about where a specific provider processes data, and the safeguard used, is available on request.
6. How long we keep data
- Account data: for as long as the account is active, and thereafter deleted or anonymised once no longer needed for the purpose or to meet legal obligations.
- Accounting records: seven years after the end of the financial year, as required by the Swedish Accounting Act.
- Case and design files: as long as necessary to deliver the order and support the customer, and in line with the customer's instructions and the data processing agreement.
- Logs: as long as necessary for security and troubleshooting.
7. Your rights
Under the GDPR you have the right to access, rectify and erase your data, to restrict or object to processing, to data portability, and to withdraw consent at any time. Requests are sent to info@dentframe.com and answered within one month.
If patient data was uploaded by your clinic or lab, please contact them first; we will assist them in responding.
You may lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se, or with the supervisory authority in your country of residence.
8. Security
We use appropriate technical and organisational measures, including access controls, encrypted connections (TLS) and hashed passwords, and we review them regularly.
9. US customers and HIPAA
When a US covered entity (such as a dental clinic) uploads protected health information (PHI) to Dentframe, Dentframe acts as a business associate under the Health Insurance Portability and Accountability Act (HIPAA) for that information.
A Business Associate Agreement (BAA) is available on request from info@dentframe.com. Customers that are covered entities should not upload PHI before a BAA is in place.
Safeguards: we apply administrative, physical and technical safeguards intended to protect PHI, including access controls and encryption in transit.
Incident reporting: we will notify affected customers of a breach of unsecured PHI without unreasonable delay, as required by HIPAA and the applicable BAA.
We do not claim any HIPAA certification (HIPAA has no official certification programme). Customers should contact us before uploading PHI so that the appropriate agreements can be put in place.
We recommend that customers de-identify case files (remove names and other identifiers from files and file names) whenever the patient identity is not needed for the design.
10. US state privacy rights
Dentframe primarily serves businesses. Where the California Consumer Privacy Act (CCPA/CPRA) or similar US state laws apply, California residents may request to know, correct or delete their personal information and to opt out of sale or sharing. Dentframe does not sell personal information and does not share it for cross-context behavioural advertising. Requests: info@dentframe.com. We will not discriminate against you for exercising these rights.
12. Changes and contact
We may update this policy; the date above shows the latest version. Material changes are notified by email or in the platform.
Questions: info@dentframe.com · Dentframe AB (Swedish company reg. no. 559189-3291), Stenöregatan 60, 218 31 Bunkeflostrand, Sweden.