Privacy Policy

Overview

DentNote is operated by DMA Academy ("we", "us", "our"). This policy explains what data we collect, how we use it, and your rights under UK GDPR and the Data Protection Act 2018.

Important: Do Not Enter Patient-Identifiable Information

DentNote is designed for generating clinical note templates from anonymised key points. You must NOT enter patient names, NHS numbers, dates of birth, addresses, or any other patient-identifiable information into the app.

The key points you enter should contain only clinical observations (e.g. "composite UR6, MOD cavity, caries removed") without any information that could identify a specific patient.

If you record an appointment, the transcript will contain what was said, which may include patient details. Check it and take out anything that identifies the patient before you use it. DentNote warns you if it spots possible patient details.

What Data We Collect

We collect the following data when you use DentNote:

• Account information: Name, email address, practice name, hashed password
• Clinical input: Key points, procedure type, tooth notation, BPE scores entered for note generation
• Recording transcripts: If you record or upload an appointment and choose "Use in note", the transcript is sent for note generation. It is not saved
• Recording audio, paired phone only: Sent encrypted from your phone to your own computer through DentNote's server, which can't read it and deletes it as soon as your computer collects it. It is not stored
• Generated notes: The AI-generated clinical notes produced by the app
• Settings: Your saved preferences (clinician name, materials, LA defaults)
• Templates: Any note templates you create
• Usage logs: Procedure type, generation timestamp, and mode (for service improvement)

How We Use Your Data

• To generate clinical notes based on your input
• To save your settings, templates, and note history for your convenience
• To improve the quality and accuracy of generated notes
• To manage your account and authentication
• To process payments (if paid features are introduced in future)

Recording and Transcription

If you record an appointment or upload a recording, it is transcribed on a device you hold, and the audio is deleted as soon as the transcript is ready. The only download involved is the speech model itself, which your browser fetches once and keeps in its cache.

Clinicians confirm once, when they first record, that they tell patients before an appointment is recorded.

If you record on a phone paired with your computer, and the patient's note is open on that computer, the audio is sent only to your own paired computer. It is encrypted so only your two devices can read it. DentNote's server can't listen to it, and deletes each piece as soon as your computer collects it. A piece your computer never collects is deleted after five minutes. Your computer transcribes it, using a larger speech model, and then discards the audio. Recordings can be up to 90 minutes long. Nothing is stored. If your computer isn't ready, the phone transcribes the recording itself and only the text you check is sent, encrypted, as before. The phone shows which of the two it is doing.

An uploaded recording is always transcribed on the device you upload it on.

You check and edit the transcript before it is used. It stays on your device unless you tap "Use in note" and then generate a note, when it is sent for AI processing as described below. The transcript is not saved in your History.

Dictating your key points works the same way: it is transcribed on the device you are using, and the audio is not sent anywhere.

AI Processing

When you generate a note, the procedure, tooth, your saved settings and any template you use are sent with your key points so the note can be drafted.

Your key points, and any transcript you choose to use, are sent over an encrypted connection to OpenRouter, which passes them to an AI provider to draft your note. OpenRouter states that it does not store the content of requests or use it to train models. AI providers may keep requests for a limited period under their own terms, typically up to 30 days for safety and abuse monitoring, and longer if a request is flagged. Requests may be processed outside the UK, including in the United States. We are moving this processing to the European Union under a signed agreement with zero data retention, and will update this notice when that is done.

This is why it is critical that you do not include patient-identifiable information in your key points or transcript.

Data Storage

Your account data, settings, templates, and generated notes are stored in a secure PostgreSQL database hosted by Supabase. Data is encrypted at rest and in transit. Passwords are hashed using bcrypt and are never stored in plain text.

Each note saved in your History holds the procedure, tooth, the key points you typed and the generated note, which may include details taken from a transcript. Recordings and transcripts themselves are not stored. When a paired phone sends audio to your computer, each encrypted piece, about 25 seconds of audio, passes through DentNote's server only until your computer collects it. That is usually within seconds and never more than five minutes for any piece, however long the recording.

Payment Processing

DentNote is currently a free service. No payment information is collected. If paid features are introduced in future, payments will be processed by Stripe in accordance with PCI DSS standards.

Data Sharing

We do not sell, rent, or share your personal data with third parties, except:

• AI processing providers (as described above, for note generation only)
• Payment processors (if paid features are introduced in future)
• Where required by law or regulation

Data Retention

Your data is retained for as long as your account is active. If you delete your account, all associated data (settings, notes, templates) will be permanently deleted within 30 days.

Your Rights

Under UK GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing of your data
• Port your data to another service
• Object to processing of your data

To exercise any of these rights, contact us at the email below.

Contact

For any privacy-related queries or data requests, contact:
team@dma.academy