01Who we are
OrthoPlaniX Treatment Planning (“OrthoPlaniX”, “we”, “us”) provides digital clear-aligner treatment planning services exclusively to dental professionals, clinics, laboratories and aligner companies. We do not provide services to patients or consumers.
Registered address: [Registered address — EDIT HERE]. Privacy contact: hello@orthoplanix.com.
For website visitors and account holders we act as a data controller. For patient case data uploaded by a dental professional, the treating practice is the controller and OrthoPlaniX acts as a processor / service provider on its documented instructions.
02Data we collect
- Account data: name, professional email, clinic or lab name, country, password hash or Google sign-in identifier, role.
- Case data (as processor): de-identified patient reference, clinical notes, intraoral scans (STL), photographs, radiographs, treatment plans, messages and revision requests.
- Billing data: invoice amounts, currency, payment status and payment-provider order/transaction identifiers. Card details are handled by Razorpay or PayPal and never touch our servers.
- Enquiry data: name, email, organisation and message when you contact us.
- Technical data: IP address, browser/device information, pages visited and — only with your consent — analytics and session diagnostics (see our Cookie Policy).
03Why we use it and our legal bases (GDPR / UK GDPR)
- To create and secure your account and deliver treatment planning services — performance of a contract.
- To send service emails: case received, status changes, plan ready, messages, invoices, reminders — performance of a contract / legitimate interests.
- To invoice and collect payment, keep accounting records and prevent fraud — contract and legal obligation.
- To protect the platform (login lockouts, access logs, abuse prevention) — legitimate interests.
- To measure and improve the website using analytics — consent (you can withdraw at any time via Cookie settings).
- To respond to enquiries — legitimate interests / steps prior to a contract.
We do not use case data to train algorithms, for advertising, or for any purpose other than delivering the service to the submitting professional.
04Who we share data with
We use a small number of service providers (sub-processors) bound by contract to process data only on our instructions:
- Cloud hosting and object storage for the application and uploaded case files.
- Transactional email delivery (Resend) for account and case notifications.
- Payment processing (Razorpay, PayPal) for invoices you choose to pay online.
- Analytics (PostHog) — only when you have accepted analytics cookies.
- Google (Google Sign-In) — only if you choose to sign in with Google.
We may disclose data where required by law, to protect our rights, or as part of a merger or acquisition under equivalent protections. We do not sell personal information and we do not share it for cross-context behavioural advertising.
05International transfers
Our planning team and service providers operate in several countries. Where personal data leaves the EU/EEA, the UK or your home jurisdiction, we rely on appropriate safeguards such as Standard Contractual Clauses, the UK International Data Transfer Addendum or an adequacy decision, together with encryption in transit and access controls.
06Retention
- Account data: for the life of your account and up to 24 months after closure, unless a longer period is required by law.
- Case data: available to your account for ongoing treatment reference; deleted on written request, subject to legal or accounting retention duties.
- Billing records: as required by applicable tax and accounting law (typically 7 years).
- Enquiries: up to 24 months.
- Analytics data: up to 12 months from collection.
07Your rights
Depending on where you live you may have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to processing, to withdraw consent, and to lodge a complaint with a supervisory authority.
- EU / EEA & UK (GDPR / UK GDPR): all the rights above; complaints may be made to your local data protection authority or the UK ICO.
- California (CCPA / CPRA): the right to know, delete, correct, and to opt out of sale or sharing. We do not sell or share personal information; a “Do Not Sell or Share” control is provided in the footer and we honour Global Privacy Control signals. We will not discriminate against you for exercising your rights.
- Canada (PIPEDA and provincial laws): access and correction rights, and the right to withdraw consent.
- Australia (Privacy Act 1988 / APPs): access and correction rights and the right to complain to the OAIC.
- UAE (PDPL), Saudi Arabia (PDPL) and other jurisdictions: access, correction, deletion and objection rights as provided by local law.
To exercise any right, email hello@orthoplanix.com. We will verify your identity and respond within the period required by law (usually 30 days). If you are a patient, please contact your treating dental practice first — they control your clinical record and we will support their response.
08Security
All traffic is encrypted in transit (TLS). Case files are stored in access-controlled cloud storage and served only through authenticated links. Role-based access separates doctors, planners and administrators, and login is protected against brute force. See our Security & Privacy page for details.
09Children
Our website and portal are for licensed dental professionals and are not directed at children. Any minor patient data is uploaded by the treating practice as controller, under the consents it has obtained.
10Changes and contact
We may update this policy from time to time; material changes will be announced on this page with a new “last updated” date. Questions or requests: hello@orthoplanix.com.