DentalSlip Privacy Notice Version 2026-10-13 This notice describes how the DentalSlip website and product handle information. It is not a HIPAA notice of privacy practices for a dental office. Each practice remains responsible for its own patient notice. Marketing site. We collect what you type into the contact form: your email, a subject, and a message. Do not include patient information. We store that message so we can reply. We do not run advertising pixels on referral forms. Accounts. We store the owner’s name, work email, password hash, office profile, and security log. Passwords are hashed with Argon2id. Authenticator secrets are encrypted. Recovery codes are stored only as hashes. Referrals. A referring office submits patient and clinical details into the receiving office’s account. That information is used to show the inbox, print a PDF, and tell verified staff that a referral arrived. Notification email does not include patient names, reasons, or files. Web addresses do not include patient details. Payments. Card numbers are collected by the payment processor on its hosted page. We store a customer id and subscription status. We do not send referral contents to the processor. Cookies. The signed-in product uses a secure session cookie and a matching token to prevent cross-site requests. Public referral forms do not require an account cookie. Retention. Clinical records are not deleted automatically when a subscription lapses. A documented retention schedule must be approved before production. Security audit records are kept separately from clinical notes. Contact. Use the contact page for privacy questions. Do not send patient records by email.