OrthoRecords

Privacy Policy

Effective Date: October 5, 2026

OrthoRecords is operated by Pattani Dental PC ("we," "our," or "us"). This Privacy Policy explains how we collect, use, disclose, and protect information when you visit our public website or use our dental practice management platform. Protected health information that a practice stores in the platform is governed first by HIPAA and by that practice's Business Associate Agreement with us; where this Policy and a Business Associate Agreement differ, the Business Associate Agreement controls.

Information We Collect

We collect information you provide directly, including practice and organization details (name, address, contact information), user account credentials (name, email, professional role), patient records and protected health information (PHI) entered by authorized users, clinical photographs, radiographic images, and documents, treatment planning, scheduling, billing, and insurance data, and subscription information. Payment card details are collected and stored by our payment processor (Stripe), not by us.

We also collect certain information automatically when you use the platform, including log data (IP address, browser type, pages visited, timestamps), device information, and audit records of actions taken in the platform.

Public Website Analytics and Advertising

On our public marketing and sign-up pages only — never inside the authenticated clinical application — we use the following:

  • A first-party page-view beacon that records the page visited, the referring site, any campaign parameters in the link you followed (such as UTM tags or a Google click identifier), your browser type, your country, and a random visitor identifier kept in your browser's local storage. It does not store your IP address and does not set cookies.
  • Google Ads conversion tracking, which sets Google cookies on our public pages and reports to Google when a practice signs up so we can measure our advertising. When you create a practice account, the email address you sign up with is hashed in your browser and sent to Google to improve conversion matching (Google's "enhanced conversions"). This is the practice owner's business email; no patient information is ever shared with Google.
  • If you arrived from an advertisement or campaign link, we keep the campaign parameters that brought you to us with your practice account so we know which channels lead to sign-ups.

Patient information and activity inside the clinical application are never shared with advertising or analytics providers.

Emails We Send You

Emails we send to practice owners about their account and free trial, such as setup tips after you sign up, may contain a small image and links that let us see whether the message was opened and which links were followed. We use this only to learn whether these emails are useful and to follow up with you personally. It is measured by us directly, is not shared with advertising or analytics providers, and never involves patient information. Every one of these emails has a link to stop them.

How We Use Your Information

We use collected information to provide, operate, secure, and improve our platform, process transactions and send related communications, respond to support requests, and comply with legal obligations. Patient health information is used solely to provide the services to the dental practice that entered it, as directed by that practice and as permitted by our Business Associate Agreement. We do not use your practice's data, patient records, or images to train artificial intelligence models, and our AI providers are contractually prohibited from doing so.

HIPAA and Protected Health Information

OrthoRecords operates as a Business Associate under the Health Insurance Portability and Accountability Act (HIPAA). We handle PHI on behalf of dental practices (Covered Entities) pursuant to a Business Associate Agreement (BAA). The practice owner reviews and executes the BAA electronically inside the platform at onboarding, and the executed copy is available at any time from Settings. We do not use or disclose PHI except as permitted by the BAA and applicable law. Questions about the BAA: privacy@orthorecords.com.

AI-Assisted Features

The platform's optional AI features send clinical data to our AI model providers to generate decision support for the treating clinician. Structured prompts never include the patient's name, date of birth, contact details, or record identifiers; they reference age and sex instead. Clinical images and documents (for example a cephalometric radiograph or an insurance explanation of benefits) are sent only for image- or document-based features, or when a user explicitly includes them in a run, and are handled as PHI when they are. Every AI run is recorded with the user, feature, patient record, and time. Inputs and outputs are not used to train models.

Data Security

We implement administrative, physical, and technical safeguards to protect your information, including encryption of data at rest (AES-256) and in transit (TLS 1.2+), practice-level data isolation enforced in the data layer, role-based access controls, two-factor authentication, automatic session timeout, audit logging, encrypted backups, and ongoing security review. Our platform is hosted on Amazon Web Services (AWS) in the United States. Our HIPAA Notice and our Security page describe these safeguards in more detail.

Data Retention

  • Active accounts: we retain practice, user, and patient data for as long as your subscription or trial account is active, including any read-only or locked period.
  • After cancellation or termination: your data remains available for export for 90 days. During that window you may export your records or ask us for an export, and you may direct us under the BAA to return or destroy your practice's PHI. After 90 days we may permanently delete the account's data; we will attempt to notify the account owner's email address on file before doing so.
  • Backups: deleted data may persist in encrypted backups for up to 35 days, and in monthly archival backups for up to 12 months, after which it is purged automatically. Backups are used only for disaster recovery and remain protected under the BAA until they expire.
  • Records we keep longer: audit logs, executed Business Associate Agreements, and other HIPAA compliance documentation are retained for at least six years as HIPAA requires; billing and tax records are retained as required by law.
  • Your practice's records: your practice remains responsible for retaining patient records for the period required by your state's dental records laws, and OrthoRecords is not a substitute for that obligation after your subscription ends. Export your records before the 90-day window closes; on request we will provide an export of your practice's records in a commonly used, machine-readable format within 30 days.

Disclosure of Information

We do not sell, trade, or rent personal information or patient data. We share information only with service providers that process it on our behalf and under our instructions: cloud hosting, storage, and email delivery (Amazon Web Services), payment processing (Stripe), AI model providers for the optional AI features, and, if your practice enables them, insurance clearinghouse services. Each is bound by confidentiality obligations and, where it handles PHI, by a business associate agreement. We may also disclose information as required by law, or to protect the rights, property, or safety of our users, the public, or ourselves.

Your Rights

Users may access or update their account information in Settings, or contact us to request deletion of a user account. Practice data is controlled by the practice owner. Patients wishing to exercise rights under HIPAA — including access, amendment, or an accounting of disclosures — should contact their dental practice directly, which is responsible for responding; we assist the practice as required by our BAA.

Children's Privacy

Our website and sign-up are directed to dental practices, not to children. Patient records for minors are entered by, and remain the responsibility of, the treating practice.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date, and we will tell practice owners about material changes by email. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.

Contact Us

Pattani Dental PC privacy@orthorecords.com OrthoRecords.com