Alveodont

Last updated: 26/03/2026

Privacy Policy

This Privacy Policy describes how Alveodont collects, processes, and protects your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Czech Act No. 110/2019 Coll., on personal data processing.

1. Data Controller

The data controller is:

Alveodont
Contact email: info@alveodont.com

2. What Data We Collect

In the course of providing dental practice management services, we process the following categories of personal data:

Identification and Contact Data

• First name and surname
• Email address
• Phone number
• Date of birth
• Birth number (national identifier — rodné číslo)
• Health insurance number

Health Data (Special Category of Personal Data)

• Medical history — allergies, dental anxiety level, dental trauma, orthodontic history, hygiene notes
• Treatment records
• Appointment and visit history
• Dental chart (dental diagram)
• Uploaded files — X-rays (periapical, OPG), photographic documentation

Technical Data

• IP address
• Device and browser information (user-agent)
• Session data

3. Purpose of Processing

We process your personal data for the following purposes:

• Providing dental practice management services — maintaining patient records, treatment cards, and dental charts
• Appointment scheduling — calendar management, reminders, visit records
• Treatment tracking — recording procedures performed, their scope, and costs
• Communication — sending confirmations, reminders, and care-related information
• In-app notifications — delivering alerts for appointments, reminders, recalls, and other events directly within the application
• Billing and subscriptions — managing clinic subscriptions, processing payments, and issuing invoices
• Legal compliance — maintaining medical records as required by Czech Act No. 372/2011 Coll., on Health Services
• Application security — account protection, prevention of unauthorised access, session management

4. Legal Basis for Processing

We process personal data on the following legal bases under Articles 6 and 9 of the GDPR:

• Art. 6(1)(b) GDPR — performance of a contract — processing is necessary to provide the services you have requested (account management, appointment scheduling, treatment documentation)
• Art. 6(1)(c) GDPR — legal obligation — maintaining medical records in compliance with Czech Act No. 372/2011 Coll., on Health Services
• Art. 6(1)(a) GDPR — consent — for optional features where separate consent is obtained (e.g. marketing communications)
• Art. 9(2)(h) GDPR — processing of health data — processing is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care, or treatment

5. Data Retention Period

• Medical records — 10 years after the last treatment in accordance with Czech Act No. 372/2011 Coll. and Decree No. 98/2012 Coll. This period is configurable by the clinic operator in the application settings.
• User accounts — for the duration of the account, or until a deletion request is received
• Session data — automatically deleted upon expiry (60 minutes for standard sessions, 30 days for "remember me" sessions)
• Uploaded files — for the duration of the medical records retention period, unless configured otherwise

After the retention period expires, personal data is anonymised. Anonymisation replaces identifying information (name, email, phone, date of birth) while preserving clinical data for statistical and research purposes, as required by law.

6. Your Rights

Under the GDPR, you have the following rights:

• Right of access (Art. 15 GDPR) — you have the right to obtain confirmation as to whether your personal data is being processed and, if so, to access it
• Right to rectification (Art. 16 GDPR) — you have the right to have inaccurate personal data concerning you corrected
• Right to erasure (Art. 17 GDPR) — you have the right to erasure of personal data ("right to be forgotten"). In Alveodont, this right is implemented through anonymisation, which removes identifying data while preserving medical records for the legally required retention period.
• Right to restriction of processing (Art. 18 GDPR) — you have the right to request restriction of processing of your data
• Right to data portability (Art. 20 GDPR) — you have the right to receive your personal data in a structured, commonly used, and machine-readable format
• Right to object (Art. 21 GDPR) — you have the right to object to the processing of your personal data
• Right to withdraw consent (Art. 7(3) GDPR) — where processing is based on consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal

To exercise your rights, please contact us at info@alveodont.com.

7. Data Protection Officer (DPO)

For questions regarding personal data processing, you may contact our Data Protection Officer:

Email: info@alveodont.com

8. Right to Lodge a Complaint

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority:

Office for Personal Data Protection (ÚOOÚ)
Pplk. Sochora 27
170 00 Prague 7
Czech Republic
Web: www.uoou.cz

9. Data Security

We have implemented technical and organisational measures to ensure the security of your personal data:

• Encrypted transmission — all communication is carried out over the HTTPS protocol (TLS)
• Password hashing — passwords are stored using the bcrypt algorithm and are never stored in plain text
• CSRF protection — a double-submit cookie pattern protects against Cross-Site Request Forgery attacks
• XSS prevention — server-side and client-side input sanitisation prevents the injection of malicious scripts
• Session management — secure JWT tokens with limited validity, with the ability to remotely sign out from all devices
• Security HTTP headers — HSTS, Content-Security-Policy, X-Frame-Options, and others
• Access control — a role-based system (admin, dentist, receptionist, employee, patient) ensures that only authorised individuals can access data

10. Cookies and Tracking

Alveodont uses only technically necessary cookies and local storage (localStorage). We do not use any third-party tracking tools.

• JWT session token — an HttpOnly cookie for user authentication. Valid for 60 minutes (or 30 days with the "remember me" feature).
• CSRF token — a cookie for protection against Cross-Site Request Forgery attacks
• Theme and language preferences — stored in browser localStorage (theme, language). This data is not transmitted to the server.
• Stripe — during payment processing, Stripe may set technically necessary cookies for fraud prevention. These cookies are managed by Stripe and are subject to their privacy policy.

No analytics or advertising cookies are set. No third-party analytics or advertising services are integrated.

11. Sub-processors

To operate the Service, we use the following sub-processors (data processors within the meaning of Art. 28 GDPR):

• Google LLC — authentication via Google OAuth (processes name, email, and profile picture). Privacy policy: policies.google.com/privacy
• Resend Inc. — email delivery service (processes recipient email addresses). Privacy policy: resend.com/legal/privacy-policy
• Stripe Inc. — payment processing and subscription management (processes payment details). Privacy policy: stripe.com/privacy
• Railway Corp. — hosting infrastructure (stores and processes all application data; servers located in the USA). Data transfer is covered by Standard Contractual Clauses (SCCs) under Art. 46 GDPR. Privacy policy: railway.com/legal/privacy

All sub-processors are contractually obligated to process personal data solely in accordance with our instructions and in compliance with the GDPR. Data is stored within the European Union or in third countries using appropriate safeguards under Art. 46 GDPR (Standard Contractual Clauses).