Privacy Policy

Effective date: October 6, 2026

This Privacy Policy explains how Dental SmarterBiz, a clinic management service operated by SmarterBiz (“we”, “us”), collects, uses, stores and protects personal information when dental clinics, their staff and their patients use the service at dental.smarterbiz.tech. We process personal information in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission.

1. Our role

For patient and appointment information that a clinic enters or receives through Dental SmarterBiz, the clinic is the personal information controller and SmarterBiz acts as its personal information processor, handling that data only on the clinic's instructions to provide the service. For clinic staff account information and the operation of the service itself, SmarterBiz is the personal information controller.

2. Information we collect

• Clinic staff accounts: the name and email address from the staff member's Google sign-in, their clinic membership, role and permissions, and an audit trail of actions taken in the clinic workspace.
• Clinic information: clinic name, contact details, services, dentist and staff schedules, booking settings and preferences.
• Patient and appointment data entered by clinics: patient names, contact details, appointment dates and times, treatments, dental chart entries, clinical notes and other records the clinic chooses to keep. This may include health information, which is sensitive personal information under RA 10173.
• Online booking form data: when a patient uses a clinic's public booking page, the details they submit (such as name, mobile number, email address, chosen treatment, dentist, date and time, and any note) are delivered to that clinic.
• Technical data: a session cookie that keeps a signed-in staff member logged in, and limited server logs and IP addresses used for security and rate limiting. We do not use advertising or third-party analytics cookies.
• Google Calendar connection (optional): see section 7.

3. How we use information

• To provide the service: let authorized clinic staff manage patients, charts, appointments, schedules and online booking requests.
• To authenticate staff and enforce each clinic's roles, permissions and tenant isolation.
• To keep the service secure and reliable, including backups, abuse prevention and troubleshooting.
• To communicate with clinics about their account and the service.

We do not sell personal information, we do not use patient data for advertising, and we do not use clinic or patient data to train artificial-intelligence models.

4. Sharing

Each clinic's data is visible only to that clinic's authorized members. We share personal information only with service providers that host and operate the service on our behalf (for example, cloud hosting), under obligations of confidentiality and security; with Google, when a clinic chooses to connect Google Calendar (section 7); or when required by law or a lawful order of a competent authority.

Hosting and cross-border transfer

Dental SmarterBiz is hosted with Railway, a cloud hosting provider, on servers located in the United States (US East). This means clinic, staff and patient information, including encrypted backups, is stored and processed outside the Philippines. As required by RA 10173, SmarterBiz remains responsible for personal information transferred to its service providers, including those abroad, and protects it with safeguards comparable to Philippine law: data is encrypted in transit (HTTPS), backups and Google refresh tokens are encrypted at rest, access is limited to authorized personnel and enforced per clinic, and the hosting provider handles the data only to run the service under its contractual confidentiality and security obligations.

5. Security

We use reasonable organizational, physical and technical measures, including HTTPS encryption in transit, per-clinic access control enforced on the server, encrypted backups, and encryption of stored Google refresh tokens. No system is perfectly secure; we will notify affected clinics and the National Privacy Commission of personal data breaches as required by law.

6. Retention

Clinic records are kept for as long as the clinic's account is active, so the clinic can meet its own record-keeping obligations. Encrypted backups are kept on a rolling basis (currently the most recent 28 snapshots, roughly one week) and then overwritten. When a clinic closes its account, we can provide an export and will delete or anonymize its data within 90 days of a written request, except where the law requires us to keep it longer. Google Calendar tokens are deleted when the clinic disconnects Google Calendar.

7. Google API services

Google sign-in. Staff sign in with Google using the basic openid, email and profile scopes to confirm who they are. We do not store Google passwords or Google sign-in tokens.

Google Calendar sync (optional). A clinic Administrator may connect a Google account so the clinic's appointments appear in Google Calendar. This connection requests the https://www.googleapis.com/auth/calendar.app.created scope, together with basic openid and email so Settings can show which Google account is connected. We use this access only to:

• create one dedicated calendar named “Dental SmarterBiz — {Clinic}” in the connected account; and
• create, update and delete the clinic's appointment events in that calendar.

Dental SmarterBiz does not read, list or modify any other calendar or event in the connected Google account. Event content is kept minimal: the appointment time, treatment and dentist, a booking reference, and, only if the clinic chooses that setting, the patient's initials or first name and last initial. Clinical notes and dental chart data are never sent to Google. Sync is one-way; changes made in Google Calendar are not copied back into Dental SmarterBiz.

The Google refresh token is stored encrypted on our server (AES-256-GCM) and is never shown to anyone, including clinic staff; short-lived access tokens are kept in memory only. We do not sell Google user data, use it for advertising, or transfer it to others except as needed to provide this feature, for security, or to comply with law, and we do not allow humans to read it except with the clinic's consent, for security purposes, or as required by law.

A clinic can disconnect at any time from Settings → Google Calendar sync in Dental SmarterBiz; we then revoke the token with Google and delete it. You can also revoke access at any time at myaccount.google.com/permissions. The dedicated calendar remains in your Google account until you delete it.

Dental SmarterBiz's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. Facebook Messenger inbox (optional)

A clinic Administrator may connect the clinic’s own Facebook Page so that messages people send to that Page on Messenger appear in the clinic’s Messages inbox in Dental SmarterBiz and can be answered from there. The connection uses Meta’s Facebook Login and requests only the permissions needed for a Page inbox: pages_show_list (to let the Administrator choose the Page), pages_messaging (to receive and send the Page’s messages) and pages_manage_metadata (to subscribe the Page to message notifications).

• What we store: for each conversation, the Page-scoped ID Meta assigns to the person, their name as provided by Meta, the text of messages exchanged with the Page, the type of any attachment (for example “image”; the files themselves are not downloaded or kept), timestamps, which staff member sent each reply, an unread count, and, if staff choose to, a link to that person’s patient record. We also store the Page’s ID and name, and the Page access token, which is stored encrypted (AES-256-GCM) and never shown to anyone.
• How it is used: only to show the clinic its Page conversations and to send the clinic’s replies. Replies are sent only within Meta’s 24-hour standard messaging window after the person’s last message; we do not send marketing, broadcasts or tagged messages, and we do not read the Page’s posts, comments or other data.
• Who can see it: members of that clinic whose access includes appointments, and Platform Owner support access when the clinic asks for help. The clinic is the personal information controller of these conversations; SmarterBiz processes them on the clinic’s behalf.
• Retention and deletion: conversations are kept while the Page is connected. A clinic Administrator can delete any single conversation at any time, and disconnecting the Page (Messages → Disconnect) unsubscribes the Page from Dental SmarterBiz, deletes the stored token and deletes every stored conversation and message for that clinic. Deleted data leaves our rolling encrypted backups within about one week. People who messaged a clinic’s Page can ask for their data to be deleted as described on our Data deletion page. Deleting data in Dental SmarterBiz does not delete the copy Meta keeps in the Page’s own Messenger inbox.
• Sharing: message content is exchanged with Meta Platforms, Inc. only to deliver the clinic’s replies; we do not sell it or use it for advertising.

9. Your rights as a data subject

Under RA 10173 you have the right to be informed, to access, to object, to erasure or blocking, to rectification, to data portability, to damages, and to file a complaint with the National Privacy Commission. Patients should first contact their clinic, which controls their records; we will assist the clinic in responding. Staff and others may contact us directly at rprtgrgg@gmail.com. We may need to verify your identity before acting on a request.

10. Children

The service is used by clinics, not by children directly. Patient records of minors are entered and controlled by the clinic, with consent from a parent or guardian as the clinic requires.

11. Changes

We may update this policy. We will post the new version here with a new effective date and, for material changes, notify clinic administrators.

12. Contact

SmarterBiz — Dental SmarterBiz
Email: rprtgrgg@gmail.com
For privacy concerns, including requests to our Data Protection Officer, write to the same address with “Privacy” in the subject.