Privacy Policy

1Who controls your data

Your clinic

For personal data about Patients that a clinic collects through its booking site, the clinic is the data controller and we act as a processor on the clinic’s behalf.

Hello World Technologies LLC

For account, subscription and general platform data, we are the controller.

This policy describes our platform practices; a clinic’s own privacy notice may also apply.

2Information we collect

• Account data — name, email, phone, hashed password, role, and the clinic you belong to.
• Clinic data — clinic name, address, phone, email, logo, services, reviews, opening hours and staff details.
• Patient booking data — name and contact details, the dentist chosen, the tooth or teeth and issue selected, optional photos of the tooth, appointment times, and treatment or prescription records added by the clinic. Some of this relates to your health and is treated as sensitive information.
• Payment data — handled by Stripe. We receive limited billing metadata (amount, currency, status, invoice), not your full card number.
• Usage and device data — via privacy-friendly, cookieless analytics (Umami, which does not use tracking cookies or build personal profiles and which you can opt out of), plus standard server logs kept for security (e.g. IP address, browser, pages viewed).
• Cookies — see our Cookie Policy.

3How we use information

We use personal data to: provide and operate the Service; create and secure accounts; process subscriptions and payments; enable bookings between Patients and clinics; send transactional messages such as confirmations, receipts and reschedule notices; prevent fraud and abuse; improve the Service; and comply with legal obligations.

4Legal bases

Where the GDPR or UK GDPR applies, we rely on: performance of a contract; our legitimate interests in running and improving the Service; consent (where required, for example for any non-essential cookies or marketing); and compliance with legal obligations.

5How we share information

We share personal data with: the clinic you book with; service providers acting under contract on our behalf, including Stripe (payments), Supabase (hosting and database), email delivery and analytics providers; and authorities or others where required by law or to protect rights and safety.

6International transfers

Your data may be processed in countries other than your own (for example, on our providers’ infrastructure). Where required, we put appropriate safeguards in place for such transfers.

7Retention

We keep personal data for as long as your account or subscription is active and as needed to provide the Service, then for any further period required for legal, tax, accounting or dispute-resolution purposes, after which we delete or anonymise it.

8Security

We use measures including encryption in transit, database row-level access controls, and access limited to authorised personnel and processors. Tooth photos are held in a private storage bucket and served through short-lived signed links. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9Your rights

Subject to applicable law, you may have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent.

For Patient data held by a clinic, please contact that clinic directly; we will assist as its processor. To exercise your rights or ask a question, email support.dentist@helloworldtech.com — we respond within 2 business days. You may also complain to your local data-protection authority.

10Children

The Service is not directed to children. Where a minor’s appointment is booked, the clinic is responsible for obtaining appropriate parental or guardian consent.

11Changes and contact

We may update this policy; we will post the new version here and, for material changes, take reasonable steps to notify you.