Privacy Policy

1Introduction and Scope

This Privacy Policy explains how [LEGAL COMPANY NAME], Inc., a [TO BE DETERMINED] corporation doing business as Behery Dental (“Behery Dental,” “Company,” “we,” “us,” or “our”), collects, uses, stores, discloses, transfers and protects personal information when individuals and organizations access or use our websites, applications, platform and related services (collectively, the “Services”).

Behery Dental operates a workflow management platform for dental restoration case design and production. Dental clinics sign up as an organization, give their own team members role-based access, and use the platform to submit patient cases — including case files and treatment requirements — for treatment planning and production carried out by Behery Dental's own clinical and technical team, and to track those cases through case-status tracking, treatment-plan review and approval, secure case file storage, and case-scoped messaging between the clinic and Behery Dental.

Our Services may be offered to users located in:

• The Middle East and North Africa (“MENA”)
• The United States
• Canada
• The European Economic Area (“EEA”) and United Kingdom
• Latin America
• Asia-Pacific
• Other jurisdictions in which the Services are lawfully made available

Different privacy and health-information laws may apply depending on the country where an individual is located, where a healthcare service is provided, where data originates, where it is stored, and the role performed by Behery Dental.

Availability of the Services in a country does not necessarily mean that every feature, hosting location, file type or cross-border workflow is available in that country.

2Who We Are

Legal entity: [LEGAL COMPANY NAME], Inc.
Doing business as: Behery Dental
Jurisdiction of incorporation: [TO BE DETERMINED]
Registered office: [INSERT REGISTERED OFFICE]
Principal business address: [INSERT BUSINESS ADDRESS]
Privacy email: [email protected]
Data Protection Officer / Privacy Lead: [INSERT NAME/ROLE & CONTACT]

Where required by applicable law, details of our EEA, UK, MENA or other local representatives will be made available in this Privacy Policy or through a jurisdiction-specific privacy notice.

This Privacy Policy must not be published with incomplete contact or legal-entity information.

3Our Data-Protection Roles

3.1 Account, Website, Billing and Business Data

Behery Dental generally acts as a data controller or equivalent responsible party when it determines why and how personal information is processed for purposes such as:

• Creating and administering user accounts
• Operating the website
• Providing customer support
• Managing subscriptions and payments
• Maintaining security and audit records
• Communicating with users
• Complying with legal obligations
• Improving the Services using non-patient operational data

3.2 Customer Case Data

When a clinic or clinician uploads or submits patient-related data and determines the purpose of the case, that customer will generally act as the controller, responsible party or regulated healthcare entity.

Behery Dental will generally act as a processor, service provider, contractor or equivalent party and will process Customer Case Data:

• On the customer's documented instructions
• To provide the requested Services, including using the submitted case data to prepare the treatment plan and production files the customer has requested
• Subject to the applicable agreement or Data Processing Addendum
• As otherwise required or permitted by law

Behery Dental performs case design and production itself, as part of the Services, using the case data the clinic submits — it does not transmit a case to a separate, independent laboratory or production-partner business. Behery Dental may act as an independent controller for limited processing involving platform security, fraud prevention, billing, legal compliance, and the establishment, exercise or defense of legal claims.

3.3 Customer Responsibilities

Customers who submit Customer Case Data are responsible for:

• Establishing an appropriate legal basis for collecting, using, disclosing and transferring the data
• Providing all required notices to patients
• Obtaining valid patient or legal-guardian consent where required
• Ensuring that disclosure to Behery Dental is legally permitted
• Uploading only data necessary for the relevant case
• Selecting which of the clinic's own team members may access a case within the platform
• Complying with professional confidentiality and medical-record requirements
• Determining applicable clinical-retention requirements
• Avoiding the inclusion of unnecessary identifiers

Consent is not necessarily the only lawful basis for processing patient data. Customers must determine the correct basis under the laws governing their professional practice and the relevant patient.

4Information We Collect

4.1 Account and Profile Information

• Name, business email address, telephone number
• Country, region and preferred language
• Account username and hashed authentication credentials
• Business name, professional role and registration/credentials
• Profile photograph, account settings and security information

4.2 Business and Professional Information

• Services requested; intraoral scanner and CAD/CAM software used at the clinic
• Areas of clinical/professional expertise and estimated monthly case volumes
• Pricing or subscription-plan information; professional certifications
• Business addresses; contract and subscription details

4.3 Customer Case Data and Sensitive Information

Customer Case Data means the case-related information a clinic submits to the platform, together with the treatment plans and production files Behery Dental's own clinical and technical team adds to the case in the course of providing the Services. This includes: the case record itself (a clinic-assigned patient reference, case type, notes, status history, requested deadline); case files uploaded by the clinic (which may include, depending on what the clinic chooses to upload, STL, PLY or DCM scan files, treatment-plan exports, clinical photographs, or other case-related documentation); the treatment plans, treatment-plan review notes and production files Behery Dental provides back on the case; and messages exchanged on the case's internal thread between the clinic and Behery Dental.

The platform's own case record is deliberately limited: the "patient reference" field is a clinic-assigned identifier (for example, initials plus a case number), not the patient's full legal name or another means of directly identifying them, by design — clinics that need to maintain a complete patient record should keep it in their own practice-management or electronic-health-record system, and link out to it as needed. Uploaded case files, however, may still contain clinical or identifying content depending on what a clinic chooses to attach to a case, and depending on the jurisdiction and file content, Customer Case Data may constitute health data, medical information, biometric data, sensitive personal data, special-category data, protected health information, or data relating to a child.

Customers should continue to use a coded case identifier rather than the patient's full name in the case record and in messages, and must not upload genetic information, government identification documents, financial information or unrelated medical information unless strictly necessary, legally permitted and expressly supported by the Services.

4.4 Billing and Subscription Information

Behery Dental's billing is manual and does not involve a stored-card payment processor: Behery Dental does not collect or store payment-card numbers, bank account numbers, or other payment-instrument details. Each clinic's monthly subscription plan is agreed directly between the clinic and Behery Dental and is activated by Behery Dental staff — plans are not self-service. What we hold, for a clinic's subscription, is: billing name and address, the clinic's subscription plan and included monthly case volume, invoice history (description, amount, currency, due date, status), the secure payment link used to collect payment on an invoice, and, once an invoice is paid, the fact that it was paid and by whom on staff it was marked paid — recorded by Behery Dental staff based on payment confirmed outside the platform. Case volume beyond a plan's included monthly allowance is billed at a standard per-case overage rate, also invoiced manually.

4.5 Usage, Device and Security Information

IP address, browser and device type, operating system, device identifiers, login times, session information, pages or features accessed, case-access records, upload/download events, authentication events, audit logs, error and diagnostic logs, approximate location derived from IP address, and security alerts or suspected misuse.

4.6 Communications

Messages exchanged through the platform, support requests and tickets, emails and other communications with Behery Dental, meeting records (where notice and consent have been provided), feedback, survey responses, and complaints or privacy requests.

4.7 Cookies and Similar Technologies

Information collected through cookies, pixels, local storage, SDKs and similar technologies, as described in Section 16.

4.8 Information Received from Third Parties

We may receive information from a user's employer or clinic organization; another authorized team member within the same clinic organization; identity or authentication providers; referral partners; integration providers; public professional registries; and other sources authorized by the individual or permitted by law.

5Legal Bases for Processing

Where applicable law requires a legal basis, Behery Dental may process personal information based on:

5.1 Contract

Processing necessary to provide the Services, administer an account, perform a contract, or take requested steps before entering into a contract.

5.2 Consent

Processing based on freely given, specific, informed and unambiguous consent, including explicit or written consent where required for sensitive data, marketing, cookies or cross-border transfers. Consent may be withdrawn at any time, without affecting processing lawfully performed before withdrawal.

5.3 Legitimate Interests

Processing necessary for legitimate business interests, where permitted and not overridden by individual rights, including platform administration, service improvement, network and information security, fraud prevention, customer support, internal reporting, and protection of legal rights.

5.4 Legal Obligations

Processing necessary to comply with laws, regulations, court orders, tax requirements, professional obligations, sanctions or lawful government requests.

5.5 Vital Interests and Other Legal Grounds

Processing necessary to protect a person's life or physical safety, establish or defend legal claims, or satisfy another lawful ground recognized in the applicable jurisdiction.

For Customer Case Data, the customer is responsible for determining and documenting the applicable legal basis unless Behery Dental is independently responsible for the relevant processing.

6How We Use Information

6.1 Provide the Services

Register and authenticate users; create and administer clinic organization and team-member accounts; receive case files and case data submitted by a clinic and use them to design and produce the requested treatment plan and production files; enable secure case file exchange between the clinic and Behery Dental; provide case-status updates and treatment-plan review/approval workflows; generate and track subscription and case-overage invoices; and provide customer support.

6.2 Operate and Improve the Platform

Maintain functionality and reliability; diagnose errors; monitor performance; develop new features; conduct quality assurance; understand non-patient usage patterns; maintain audit trails; and improve accessibility and user experience.

6.3 Communicate with Users

Send account and security notices; provide case notifications; respond to support requests; send operational messages; communicate policy or contractual changes; and send marketing communications where permitted.

Users may unsubscribe from marketing communications, but they may continue to receive essential service, account, security or case-related messages.

6.4 Protect the Platform

Verify identity and professional credentials; detect and prevent fraud; investigate misuse; enforce agreements; prevent unauthorized access; maintain business continuity; protect patients, users and third parties; and comply with legal obligations.

7Artificial Intelligence and Product Development

7.1 AI-Assisted Features

The Services may include AI-assisted or automated features used to support workflow organization, file review, quality checks, case routing, communication or other requested functions. Where an AI-assisted feature processes Customer Case Data solely to provide the requested service, such processing will be performed under the applicable customer agreement and documented instructions.

7.2 No General Training on Identifiable Patient Data

Behery Dental does not use identifiable patient information or identifiable Customer Case Data to train general-purpose, shared or publicly available artificial-intelligence models.

We will not permit a third-party AI provider to use identifiable Customer Case Data for its independent model training unless: the customer has separately and expressly authorized the use; all required patient authorizations have been obtained; the use is lawful in every relevant jurisdiction; appropriate contractual protections are in place; and the use is clearly described before it occurs.

7.3 Anonymized, Aggregated and Synthetic Data

We may use aggregated, synthetic or irreversibly anonymized information for analytics, security, research, product development and service improvement where individuals cannot reasonably be reidentified, applicable anonymization requirements have been met, the information is not subject to customer restrictions prohibiting such use, and the use is otherwise lawful.

Pseudonymized or coded information will continue to be treated as personal information where reidentification remains reasonably possible.

8How We Disclose Information

8.1 Authorized Case Participants

Customer Case Data is made available to: (a) authorized team members within the submitting clinic's own organization, according to their account role and case assignments; and (b) Behery Dental's own clinical and technical staff (including treatment planners, designers and production personnel), who use the case data to design and produce the requested treatment plan and production files as part of the Services. Access is limited according to account permissions, case assignments and applicable contractual terms. Behery Dental does not share Customer Case Data with any separate, independent laboratory or production-partner business — case design and production is performed by Behery Dental itself.

8.2 Service Providers and Subprocessors

We may engage providers for database hosting, object and file storage, authentication, cloud infrastructure, transactional email, customer support, security monitoring, error reporting, and analytics. We do not engage a payment-processing subprocessor, because no payment processor is used anywhere in the platform — see Section 4.4.

Our providers currently include Supabase (database, authentication, and case-file storage) and Resend (transactional email — case status changes, new messages, team invites, and invoices are sent through Resend), and other providers listed in our then-current Subprocessor List. Where required, providers will be subject to written agreements requiring confidentiality, appropriate security, limited processing purposes, deletion or return obligations, and assistance with privacy requests and security incidents.

The use of a provider does not transfer Behery Dental's legal responsibilities to that provider.

8.3 Corporate Transactions

Information may be disclosed in connection with a merger, financing, acquisition, reorganization, due-diligence process, sale of assets or similar transaction, subject to confidentiality and applicable law. Customer Case Data will not be transferred to a new owner for unrelated purposes without an appropriate legal basis.

8.4 Legal and Safety Disclosures

We may disclose information when reasonably necessary to comply with applicable law; respond to a valid court order, subpoena or lawful government request; protect a person's health or safety; investigate fraud, abuse or security threats; enforce our agreements; or establish, exercise or defend legal claims. Where legally permitted, we will notify the affected customer before disclosing Customer Case Data in response to a government request.

8.5 No Sale of Patient Data

We do not sell Customer Case Data or patient information, and we do not sell personal information in exchange for money. Certain analytics or advertising technologies could be considered "sharing," "targeted advertising" or a similar activity under some U.S. state laws. Where applicable, we will provide the required notice and opt-out mechanism.

9Data Processing Agreements

Customers submitting Customer Case Data may be required to enter into a Data Processing Addendum or other appropriate agreement. Depending on the jurisdiction and service, this may include:

• GDPR Article 28 processor terms
• Standard Contractual Clauses
• A UK international-transfer addendum or agreement
• A Business Associate Agreement under HIPAA
• Saudi PDPL processor and transfer terms
• UAE health-data requirements
• Local transfer clauses, confidentiality requirements and security schedules
• Instructions governing deletion, return, retention and subprocessors

10International Data Transfers

10.1 General Transfer Mechanisms

Because Behery Dental may serve users in multiple countries, information may be accessed, hosted or processed in a country different from the one in which it was collected. Before making a restricted international transfer, we may use one or more of the following, where legally available: an adequacy decision or recognized adequate jurisdiction; European Commission Standard Contractual Clauses; the UK International Data Transfer Agreement or UK Addendum; contractual transfer safeguards recognized by the relevant regulator; binding corporate rules, where applicable; a data-transfer impact or risk assessment; explicit consent where consent is a valid and appropriate transfer mechanism; local hosting; regulatory notification, registration, license, permit or approval; or another legally recognized exception or safeguard.

We may restrict access to particular Services or require a jurisdiction-specific hosting environment where international transfer requirements cannot be satisfied.

10.2 Middle East and North Africa

Depending on where an individual resides, where a healthcare service is provided, and where data originates, Behery Dental may be subject to laws including:

10.3 EEA and United Kingdom

For restricted transfers from the EEA or UK, Behery Dental may rely on adequacy decisions; Standard Contractual Clauses; the UK Addendum; the UK International Data Transfer Agreement; and supplementary technical and organizational measures. Where required, we will conduct transfer assessments and appoint an EEA or UK representative.

10.4 Canada

Personal information relating to Canadian individuals may be processed under the Personal Information Protection and Electronic Documents Act and applicable provincial laws, including Quebec privacy requirements where applicable.

10.5 Latin America

Depending on the country, processing may be subject to laws including Brazil's Lei Geral de Proteção de Dados; Colombia's Law 1581 of 2012 and related regulations; Mexico's Federal Law on Protection of Personal Data Held by Private Parties; Argentina's Personal Data Protection Law No. 25,326; and other applicable national privacy laws.

10.6 United States

Depending on the individual and context, U.S. federal or state privacy laws may apply, including state consumer-privacy laws and healthcare confidentiality requirements. The handling of information subject to HIPAA will only be permitted through a designated, approved HIPAA-enabled environment and after all required Business Associate Agreements are executed. Users must not upload HIPAA-regulated Protected Health Information into a workspace that has not been approved by Behery Dental for that purpose.

11Data Storage and Security

11.1 Hosting Infrastructure

Behery Dental may use Supabase for PostgreSQL database services, authentication, APIs, real-time functionality and object storage. Each production environment will be assigned a primary hosting region; the applicable region or jurisdiction-specific environment should be identified in the customer agreement, Data Processing Addendum, Subprocessor List or service documentation.

Where local health-data or data-residency laws apply, Behery Dental may use a separate provider, self-hosted environment, local infrastructure or other approved solution. A service provider's security certification does not, by itself, make Behery Dental or a customer compliant with any privacy or healthcare law.

11.2 Security Measures

Depending on the service and deployment, our safeguards are designed to include: encryption in transit; encryption at rest where supported and configured; role-based access controls; Row-Level Security policies; least-privilege access; multi-factor authentication for privileged accounts; secure password handling; logging and audit trails; network restrictions; secure backup procedures; access reviews; vulnerability management; incident-response procedures; secure development practices; employee and contractor confidentiality obligations; and vendor security assessments.

No internet-based system can be guaranteed to be completely secure. Users must protect their credentials, use strong passwords, enable available security features, and immediately report suspected unauthorized access.

12Data Retention

We retain personal information only for as long as reasonably necessary to provide the Services, fulfill the purposes described in this Privacy Policy, follow customer instructions, maintain security and audit records, satisfy legal, tax, accounting and regulatory obligations, comply with medical-record or professional requirements, resolve disputes, and establish, exercise or defend legal claims.

Retention periods may differ according to the category of information and applicable jurisdiction. Customer Case Data will generally be retained for the period selected or agreed by the customer, for the duration of the relevant contract, until deletion or return is requested by the customer, or for a longer period where legally required.

Deletion requests may be refused or delayed where information must be retained for legal, regulatory, clinical-record, fraud-prevention, backup, security or legal-claims purposes. Deleted information may remain in encrypted backups until the applicable backup cycle expires, after which it will be deleted or rendered inaccessible according to our retention procedures.

Behery Dental will maintain a separate internal retention schedule identifying retention periods for account data, case data, audit records, support communications, payment records, marketing data and backups.

13Individual Privacy Rights

Depending on the jurisdiction and subject to legal exceptions, individuals may have the right to receive information about processing; access personal information; obtain a copy of it; correct inaccurate or incomplete information; request deletion or destruction; withdraw consent; restrict or suspend processing; object to processing, including direct marketing; receive portable data or request transfer to another controller where technically feasible; object to certain automated decisions; limit certain uses of sensitive information; opt out of sale, sharing or targeted advertising; appeal the denial of a request; be informed of certain security incidents; and file a complaint with a competent data-protection authority.

13.1 Requests Relating to Patient Case Data

When Behery Dental processes patient information solely on behalf of a clinic or clinician, the patient should ordinarily submit the request directly to that customer. Behery Dental will assist the customer in responding where required by contract or law, and will not independently alter or delete a clinical record contrary to the lawful instructions of the responsible healthcare provider.

13.2 Submitting a Request

Requests may be submitted to [email protected]. We may request information necessary to verify identity, confirm authority to act for another person, locate relevant information, prevent fraudulent requests, and determine the applicable jurisdiction. We will respond within the period required by applicable law.

13.3 Complaints

Individuals may contact Behery Dental first so that we can attempt to resolve a concern. Individuals may also complain directly to the competent supervisory or data-protection authority in their country.

14U.S. State Privacy Rights

Residents of California and other U.S. states with applicable consumer-privacy laws may have rights to know the categories and specific pieces of personal information collected; access personal information; correct inaccuracies; request deletion; obtain portable data; opt out of sale, sharing, targeted advertising or qualifying profiling; limit certain uses of sensitive personal information; use an authorized agent; and receive equal service without unlawful discrimination.

Behery Dental does not sell Customer Case Data or patient information. Where our use of analytics or marketing technology constitutes "sharing," targeted advertising or another regulated activity, an applicable opt-out link or preference mechanism will be made available.

15Children and Pediatric Patient Data

15.1 Platform Users

The Services are intended for adult professionals and authorized business representatives who are at least 18 years old. We do not knowingly permit children to create independent user accounts.

15.2 Pediatric Patient Data

The platform may process case information relating to a patient who is under 18 when the information is submitted by an authorized clinician, clinic, parent, guardian or other legally authorized party. The submitting customer must have a valid legal basis; obtain consent from a parent or legal guardian where required; comply with pediatric medical-record requirements; limit the information to what is necessary; apply appropriate confidentiality protections; and avoid using a child's data for marketing, profiling or unrelated purposes.

Behery Dental will treat pediatric case data as sensitive information.

16Cookies and Tracking Technologies

16.1 Cookie Categories

Necessary Cookies — used for authentication, security, session management, fraud prevention, cookie preferences and essential platform functionality. These generally cannot be disabled through the platform.

Functional Cookies — used to remember language, interface, accessibility, sidebar, display and workflow preferences.

Analytics Cookies — used to understand website and platform use, diagnose problems and measure performance.

Marketing Cookies — used, where implemented and legally permitted, to measure campaigns, manage forms or provide relevant marketing content.

16.2 Consent

Where required by law, non-essential cookies will not be activated until the user has provided valid consent. Users may change cookie preferences through the Cookie Settings link or consent tool. Withdrawing consent will not affect cookies previously used lawfully but will prevent future use where technically possible.

16.3 Browser and Device Controls

Users may also block or delete cookies through browser settings. Disabling necessary or functional cookies may affect platform operation. Where legally required and technically supported, we will recognize applicable opt-out preference signals, such as Global Privacy Control. We do not make a blanket representation that all "Do Not Track" browser signals are recognized, because there is no universally accepted technical standard for those signals.

16.4 Third-Party Tools

If tools such as HubSpot, analytics services, support widgets or embedded content are used, their cookies and processing will be identified in the cookie banner or Cookie Notice before deployment.

17Data Breaches and Security Incidents

Behery Dental maintains procedures designed to identify, investigate, contain, document and remediate personal-data incidents.

Where Behery Dental acts as a processor, we will notify the responsible customer without undue delay after confirming a qualifying incident, as required by the applicable agreement and law. Where Behery Dental acts as a controller, we will notify affected individuals, customers, data-protection authorities, healthcare regulators and other competent authorities within the time and under the conditions required by applicable law.

Incident notices may include the nature of the incident; categories of information affected; approximate number of affected individuals or records; likely consequences; containment and remediation measures; steps individuals should take; and contact information for further assistance.

18Third-Party Services and Links

The Services may contain links to, or integrations with, third-party websites and services. This Privacy Policy does not govern processing performed independently by those third parties. Users should review the third party's privacy notice before providing information. Where a third party acts as our processor, its processing will remain subject to the applicable contractual and legal requirements.

19Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to the Services; new legal requirements; changes to service providers; new hosting regions; security developments; or changes to our data practices.

We will publish the updated version with a revised "Last Updated" date. For material changes, we will provide additional notice through the platform, by email, or through another appropriate channel.

Where a change requires consent, the change will not apply to the relevant processing until valid consent has been obtained. Continued use of the Services does not replace consent where applicable law requires consent.

20Contact Us

Privacy questions, complaints or requests may be submitted to:

[LEGAL COMPANY NAME], Inc.
Doing business as Behery Dental
[REGISTERED OR BUSINESS ADDRESS]
Privacy email: [email protected]

Requests concerning Customer Case Data may be referred to the clinic or clinician responsible for the relevant patient relationship.