Nature of the relationship (the clinic is controller, DentaFlow is processor)

The Clinic is the controller of the personal data of its Patients. It is the Clinic that decides which data is collected, for what purpose, and for how long. DentaFlow acts as the processor: it processes the Patient Data on the Clinic behalf and under its instructions, for the sole purpose of providing the clinic management service.

This agreement sets out the obligations that Law No. 7593/2025 on the Protection of Personal Data imposes when a third party processes personal data on behalf of another. It is governed by that law and, where applicable, by Law No. 125/91 (retention of tax documents) and Law No. 5653/2016 (protection of children on the internet).

The processor is SONG BAI INVERSIÓN E.A.S. Tax ID (RUC): 80163224-2. Address: 14 de Mayo c/ Fortín Arce, 111423 San Lorenzo, Paraguay. Contact: [email protected].

You, the Clinic, are the party responsible before your Patients and before the supervisory authority. Patients exercise their rights before the Clinic, not before DentaFlow. DentaFlow assists you, but it does not decide over the data and does not respond directly to Patients.

Subject matter, duration, and nature of the processing

Subject matter. DentaFlow hosts and processes the Patient Data on the Clinic behalf for the sole purpose of providing the clinic management service, which includes, among other functions:

The Patient record and clinical history.
The odontogram and the anamnesis questionnaire.
The record of treatments and sessions.
The appointment calendar.
Budgets, payments, and electronic invoicing.

Nature. The processing consists of operations of collection, recording, organization, storage, consultation, modification, and deletion of the Patient Data, carried out on computer systems, for the purposes above.

Duration. DentaFlow processes the Patient Data for as long as the service contract with the Clinic is in force. On termination, the section Return and deletion of data on termination applies.

Categories of data and data subjects

Categories of data subjects

The Clinic Patients, including minors.
The persons listed as billing recipients when they are not the Patient.

Categories of Patient Data

Category	Data the platform processes
Identification and contact	National ID number, first and last name, date of birth, gender, phone, email, and address.
Sensitive health data	Medical history, allergies, anamnesis questionnaire, odontogram (state of each tooth and notes), clinical notes on treatments and sessions, materials used, clinical records, and appointment reasons and notes.
Images	Patient photograph, intraoral photographs, radiographs, laboratory PDFs, and scanned consent forms.
Clinical documents	Study orders, laboratory orders, and prescriptions.
Financial data	Budgets, payments, electronic tax documents, and the billing recipient data (document type and number, name, email, and address).
Audit data	Which user created or modified each record, when, and the previous and new values.

This data includes sensitive health data and data on minors, which require the highest level of protection. It is the Clinic that decides to enter it into the platform; DentaFlow neither requests nor defines it.

Minors

Some Patients may be minors. The Clinic is responsible for obtaining valid consent to process their data.

Under Law No. 7593/2025: for minors under 16 (sixteen), the prior, express, and informed consent of the holder of parental authority, custody, or guardianship is required; between 16 (sixteen) and the age of majority, and where sensitive data is involved, the express consent of the adolescent plus the authorization of their legal representative is required.

DentaFlow does not verify the Patient age or the existence of consent: that burden falls on the Clinic. When the Clinic uses patient self-registration, the platform records the data and ID number of the guardian, which consents were given, who gave them, the version of the text accepted, and the date. Outside that flow, verifying the Patient age and representation remains the responsibility of the Clinic.

Controller's instructions

DentaFlow does not use the Patient Data for its own purposes. It does not sell it, does not disclose it to third parties, does not use it for advertising, and does not use it to train artificial intelligence models. It only processes it to provide the service to the Clinic.

DentaFlow processes the Patient Data solely in accordance with the documented instructions of the Clinic. Those instructions are these Terms, this agreement, and the use the Clinic makes of the platform.

If a legal obligation required DentaFlow to process the data otherwise, it will inform the Clinic before doing so, unless the law itself prohibits it.

Confidentiality and professional secrecy

DentaFlow personnel with access to the Patient Data are bound by a duty of confidentiality that survives the end of their relationship with DentaFlow. Sensitive health data is also covered by the professional secrecy owed by the Clinic.

DentaFlow does not share the Patient Data with external personnel or contractors: access is limited to its own team. The Subprocessors that provide infrastructure are governed by the data processing agreements described in this document.

Access by the DentaFlow team to the Patient Data is limited to what is strictly necessary for support and maintenance of the service, and is recorded in the platform systems.

Technical and organizational security measures

DentaFlow applies the following technical and organizational measures to protect the Patient Data. This list describes the state of the platform as of the date of this document.

Strict per-clinic isolation: every database query filters by the clinic identifier, so one clinic cannot read another clinic data.
Role-based access control, with granular per-module permissions configurable by the Clinic.
Passwords stored with bcrypt. Refresh tokens hashed, rotated on each use, and revoked on password change. Short-lived access token.
Clinical files (radiographs, photos, PDFs) stored in a private prefix of the object storage, with no public URL, served through signed links that expire in one hour.
Electronic invoicing secrets encrypted with AES-256-GCM.
TLS encryption of data in transit.
Rate limiting on authentication and HTTP security headers.
Audit log of the modifications made to the Patient record.

As of today, the platform does not encrypt the database at rest, audits only data modifications and not reads, and holds no ISO 27001 or SOC 2 certifications and no external penetration testing. DentaFlow commits to adding read auditing and external penetration testing, and will periodically review the rest of its security protocols as the service grows.

Subprocessors

DentaFlow relies on the Subprocessors listed below, each bound by protection obligations equivalent to those of this agreement. The current list is kept on the subprocessors page.

Subprocessor	Function
Contabo GmbH	Server and object storage where the Patient Data resides. Data centre in the United States.
Cloudflare, Inc.	Reverse proxy and TLS encryption of traffic.

The public DentaFlow marketing site does not process Patient Data. The Patient Data resides on the Contabo infrastructure.

SIFEN / DNIT is not a Subprocessor, but the legal recipient of the electronic tax documents. When issuing an invoice, DentaFlow transmits to SIFEN the recipient data of the document (name and ID of the Patient or of whoever pays).

DentaFlow will notify the Clinic by email at least 30 (thirty) days before adding or replacing a Subprocessor, and the Clinic may object to the addition within that period. If the objection cannot be reasonably resolved, the Clinic may terminate the contract without penalty.

International transfers

The servers of the Subprocessor Contabo are located in the United States, and Cloudflare operates a global network outside Paraguay, so the processing involves an international transfer of the Patient Data.

Law No. 7593/2025 requires adequate safeguards when the destination country does not have an adequacy decision from the supervisory authority. The authority (ANPDP) has not yet published the list of countries with an adequate level of protection.

As a safeguard for these transfers, DentaFlow relies on the data processing agreements these providers offer their customers, which incorporate European Union standard contractual clauses.

Assisting the controller with data subject rights

Patients exercise their rights of access, rectification, erasure, objection, and portability before the Clinic, which is their controller. DentaFlow does not handle Patient requests directly.

DentaFlow makes the platform functions available to the Clinic to handle those requests and assists the Clinic, to the extent possible, when those functions are not enough.

The Clinic must respond to the Patient within the legal deadline of 30 (thirty) calendar days from the request.

As of today, the platform does not yet offer export of the Patient record (portability) or deletion of a Patient; both functions are under development. In the meantime, the Clinic may request either by writing to [email protected], and DentaFlow handles the request manually.

Security incident notification

DentaFlow will notify the Clinic without undue delay after becoming aware of a security breach affecting the Patient Data.

The notification will include the information available to DentaFlow so that the Clinic can meet its own duty to notify the supervisory authority within 72 (seventy-two) hours, in particular:

The nature of the breach.
The categories and approximate number of Patients and records affected.
The likely consequences of the breach.
The measures taken or proposed to remedy it and mitigate its effects.

The notification is sent to the Clinic by email, within a maximum of 72 (seventy-two) hours after DentaFlow becomes aware of the incident.

Impact assessments and prior consultations

DentaFlow assists the Clinic, with the information available to it, in the data protection impact assessments and prior consultations with the supervisory authority that the Clinic must carry out regarding the processing performed through the platform.

Audit and inspection

The Clinic may request from DentaFlow the information necessary to demonstrate compliance with the obligations of this agreement.

The audit is carried out through written questionnaires and the documentation DentaFlow provides, up to 1 (one) time per calendar year, coordinated with reasonable advance notice and without interfering with the operation of the service.

Return and deletion of data on termination

On termination of the service contract, DentaFlow will make the Patient Data available to the Clinic for export for 90 (ninety) days and, once that period has elapsed, will delete it from its systems.

Data that DentaFlow must retain by legal obligation is excepted. In particular, issued electronic tax documents (the signed XML file and its KUDE graphical representation) are retained for 5 (five) years, in accordance with Law No. 125/91.

The clinical history is subject to a health retention period. Paraguayan regulations do not currently set a specific period, so, provisionally and by analogy with regional practice, the Clinic and DentaFlow adopt a retention period of 10 (ten) years counted from the last recorded care. This period is provisional and remains subject to whatever Paraguayan health regulations or the Clinic legal counsel establish.

The platform does not yet offer full export of the Patient record from the application itself. While that function is under development, the export is requested by email at [email protected] and DentaFlow delivers the data in a commonly used electronic format.

Liability

The liability regime and limits of the parties are governed by the Terms and Conditions of the service.

Accordingly, DentaFlow’s total liability under this agreement is subject to the same limit set out in the Terms and Conditions: the amount paid for the Subscription during the 12 (twelve) months preceding the event giving rise to the claim.

Data protection contact

For any matter relating to this agreement or to the processing of the Patient Data, the Clinic may contact DentaFlow at [email protected].