DentalSource

DentalSource, Inc. ("DentalSource," "we," "us," or "our") is committed to protecting the privacy of dental professionals and dental students aged 18+ who use our research platform. This Privacy Policy explains how we collect, use, store, and protect information when you use dentalsource.ai and the research service. By using DentalSource, you agree to the collection and use of information as described in this Privacy Policy.

1. Information We Collect

We collect the following categories of information when you use DentalSource:

Information you provide directly:

• Email address and account credentials — when you create an account. Passwords are stored as password hashes rather than in plaintext.
• Optional onboarding information — if you choose to provide it, such as years in practice, specialty, practice type, and signup goal. Students may skip practice-related fields.
• Free-answer and subscription information — “Try one question free—no signup or credit card. Then $20/month to continue.” The completed anonymous answer is saved in a server-backed session and remains available on return in the same browser through a first-party cookie. A failed generation does not use the allowance. Additional questions, continuations, follow-ups, and regenerations require signup or login and the $20/month recurring subscription. Existing unpaid accounts retain any unused free allowance, and existing paid subscribers continue to have access. Stripe processes payment and subscription details. DentalSource receives subscription status and identifiers needed to provide access; we do not receive or store full payment card numbers. You can cancel through Stripe's customer portal; scheduled cancellation keeps access through the current billing period, and access ends when the entitlement becomes inactive.

Information collected automatically:

• Research requests and results — the question you submit, the generated answer, source and citation metadata, timing, route, and error information are stored in research-session records. This supports answer continuity, follow-up research, sharing, citation auditing, and operation of the service.
• Voluntary quality feedback — if an authenticated user chooses a thumbs-up/down rating, comment, or quality flag for a research session, the feedback is stored with the session and account so it can be reviewed and used for internal service and model-quality evaluation. This is an explicit user action, not advertising profiling.
• Security and operational information — the service may process request identifiers, account ownership information, and limited network information needed for authentication, rate limiting, abuse prevention, billing access, and first-party operational metrics.
• First-party operational metrics — selected page visits are recorded on our server with a page label/path, truncated user-agent string, IP address, and timestamp. Research searches also create internal query/tool/specialty telemetry (with PHI redaction in the legacy search log). These are internal service metrics, not a third-party analytics product.
• Anonymous-first offer measurement — a separate first-party database event store records one anonymous-answer completion, signup completion, Checkout creation, and verified payment using only an allowlisted action name, timestamp, environment tag, optional opaque account identifier, and an opaque request identifier. An anonymous completion is initially recorded with no account identifier and a strict opaque UUID request key. It does not store the question, answer, email, URL, IP address, browser fingerprint, user agent, or payment-card data. If the same anonymous session is later securely linked to an account, its completion measurement is attached to that account so test and internal accounts remain excluded. Truly anonymous completions are included in aggregate reports; unknown or deleted-account events of other types remain excluded. Account-level details are not returned in those reports.
• Local browser storage — the research interface may keep account-scoped display history in your browser's local storage. This is separate from the server-side research-session records.

Prohibited information and payment-card handling:

• Submitting Protected Health Information (PHI) as defined under the Health Insurance Portability and Accountability Act (HIPAA) is prohibited. The server scans submitted content for apparent PHI and may reject or flag it, so do not submit it.
• We do not intentionally retain patient names, dates of birth, Social Security numbers, insurance identifiers, or other patient-identifying information. Do not submit them.
• We do not receive or store full payment card information; Stripe handles payment-card processing.

2. How We Use Your Information

We use the information we collect for the following purposes:

• To provide and operate research access — processing your queries, generating and saving cited research summaries, enforcing the anonymous or account free-answer allowance and reasonable rate limits, maintaining follow-up context, and delivering account and subscription functionality. After signup, the anonymous answer and used allowance persist with the linked account, so signup does not provide another free answer.
• To maintain safety and quality — checking citations, preventing abuse, troubleshooting failures, and improving the reliability of the research service. Authorized administrators may run restricted model/retrieval evaluations using the service's stored research and citation records; these controls are not available as ordinary customer features. We do not use research questions, answers, uploads, or patient information for advertising.
• To communicate with you — responding to inquiries and sending service-related messages. Account creation permits the one eligible free answer; continued research requires paid access.
• For security and fraud prevention — monitoring for suspicious activity, protecting the integrity of the Services, and preventing unauthorized access or misuse.
• To comply with legal obligations — responding to lawful requests from government authorities, complying with applicable laws and regulations, and enforcing our Terms of Service.

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

3. Cookies and Tracking Technologies

DentalSource uses first-party cookies for a server-backed anonymous session, same-browser return to a completed free answer, and, after signup, a signed secure session that keeps you logged in and protects account state. A legacy email-gate flow may set a first-party ds_email cookie when you use that flow. The site does not currently include a third-party analytics provider, advertising pixel, Meta Pixel, Conversions API, or cross-site behavioral advertising cookies. It does record the limited first-party database telemetry described above for internal operations and aggregate offer measurement; no analytics SDK is added for this purpose.

Research questions, answers, uploads, and patient information are not sent to advertising platforms. You can clear cookies and local browser storage at any time, although doing so may sign you out or prevent same-browser recovery of an unlinked anonymous answer. Once securely linked, the answer and used allowance persist with the account.

Anonymous use is subject to reasonable concurrency and rate limits and a configurable total anonymous-generation spending cap; anonymous generation may be paused when that cap or protective limits are reached. We do not use browser fingerprinting. Cookie-based anonymous limits can be evaded, and we do not claim perfect one-per-person enforcement.

4. PHI Policy — Protected Health Information

DentalSource is not a HIPAA-covered service, and submitting Protected Health Information (PHI) is prohibited. Our platform is designed for general clinical decision support based on publicly available dental literature — not for queries involving identifiable patient data.

The server receives submitted content and uses built-in safeguards to detect apparent PHI (such as patient names, dates of birth, or other identifiers). If such content is detected, the query may be rejected or flagged; this screening does not make it permissible to submit PHI.

By using DentalSource, you agree not to submit any patient-identifying information, patient records, or PHI through the Services. If you inadvertently submit PHI, please contact us immediately at peter@dentalsource.ai so that we can take appropriate steps to address the situation.

DentalSource is not a Business Associate under HIPAA and does not execute Business Associate Agreements (BAAs). Do not use DentalSource in any manner that requires a BAA.

5. Data Security

The application uses HTTPS/TLS for transmission, signed secure session cookies, password hashing, and access controls intended to limit unauthorized access to account and service data.

No method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security. In the event of a data breach that affects your rights or freedoms, we will notify affected users as required by applicable law.

6. Third-Party Services

DentalSource uses the following third-party services in the operation of our platform. Each of these services has its own privacy policy governing how they handle data:

• Replit AI Integrations — depending on the deployment configuration, the default research path sends research prompts and retrieved research context through Replit's AI Integrations Anthropic proxy. The proxy processes that request to connect the service to the configured model provider.
• Anthropic (Claude AI) — Anthropic processes research prompts and retrieved research context when the configured path uses Anthropic to generate an answer. Authorized administrator-only model evaluations may use a permitted Anthropic model directly. Do not include patient-identifying information. Review Anthropic's privacy terms at anthropic.com/privacy.
• Stripe — Stripe processes subscription checkout, payment details, invoices, and the customer portal for the $20/month recurring subscription. Review Stripe's privacy policy at stripe.com/privacy.
• Hosting and database infrastructure — providers supporting the application, database, and secure operation process information on our behalf.

We do not share your personal information with third parties except as described in this Privacy Policy, as required by law, or with your explicit consent.

7. Data Retention

Research-session records, account records, and subscription records are retained for the service, security, billing, follow-up, and legal purposes described above. The current application does not define a fixed automatic deletion schedule. You may request deletion of personal information by contacting us; we will assess the request against legal, security, billing, and record-integrity requirements.

8. Children's Privacy

DentalSource is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from anyone under 18 years of age. If we become aware that we have collected personal information from a minor without verification of parental consent, we will take steps to delete that information. If you believe we may have collected information from a minor, please contact us at peter@dentalsource.ai.

9. Your Rights and Choices

Depending on your jurisdiction, you may have certain rights with respect to your personal information, including:

• Access — the right to request a copy of the personal information we hold about you.
• Correction — the right to request that we correct inaccurate or incomplete personal information.
• Deletion — the right to request that we delete your personal information, subject to certain legal exceptions.
• Opt-out of marketing communications — you may unsubscribe from marketing emails at any time using the unsubscribe link included in every marketing email, or by contacting us directly.

To exercise any of these rights, please contact us at peter@dentalsource.ai. We will respond to your request within a reasonable timeframe and in accordance with applicable law.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or applicable law. When we make material changes, we will update the "Last Updated" date at the top of this page. We encourage you to review this Privacy Policy periodically. Your continued use of the Services after any changes become effective constitutes your acceptance of the revised Privacy Policy.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

DentalSource, Inc.
Email: peter@dentalsource.ai

We are committed to working with you to resolve any concerns about your privacy in a fair and transparent manner.