Privacy Policy

The controller of the data described in this Policy is SONG BAI INVERSIÓN E.A.S., a company incorporated in Paraguay, with its registered office in San Lorenzo.

Tax ID (RUC): 80163224-2. Registered office: 14 de Mayo c/ Fortín Arce, 111423 San Lorenzo, Paraguay.

We process your data in accordance with Paraguay Law No. 7593/2025 on the Protection of Personal Data, with which we are in the process of aligning (its full entry into force is expected around November 2027).

For any privacy matter you may write to [email protected] or call +595 985 218175.

This Policy covers the personal data of two groups: (1) users of the DentaFlow application, that is, the clinic staff who hold an account; and (2) visitors to the dentaflow.com.py website. With respect to this data, SONG BAI INVERSIÓN E.A.S. is the controller.

Data on application users

• Account data: email address, first and last name, password (stored as a bcrypt hash, never in plain text), profile photo (optional), professional license number (optional), and preferred language.
• Session data: IP address and browser user-agent, together with the session start date.
• Clinic membership, role, and permissions within each clinic.
• Subscription: status, expiry date, and whether you claimed the free month.
• Activity: a record of the actions you perform on patient records (audit log), linked to your user identifier.

Data on site visitors

When you browse dentaflow.com.py, the public site uses measurement tools to understand how it is used, detailed in the Cookies and measurement technologies section. The site has no data-capture forms: every button takes you to the application or to WhatsApp.

We process your data for the following purposes, each on the legal basis indicated:

The public site dentaflow.com.py uses measurement tools to understand how the product is used and to improve it, and the same rules govern the application app.dentaflow.com.py whenever measurement runs there. That is why the site shows a cookie notice, and you can refuse at any time.

The tools we use are: Microsoft Clarity (session recordings and heatmaps, to spot where the interface confuses people), PostHog (aggregated usage metrics: which features get used and at what step a flow gets abandoned), and Google Analytics with Google Tag Manager, on the public site only, to find out where visitors come from.

What we do NOT send to these tools: none of your patients' data. No names, no ID numbers, no phone numbers, no diagnoses, no treatments, no clinical images.

Inside the application, measurement is subject to an additional rule: whenever it runs, session recordings must be captured with all text masked, only the fixed interface elements (menus, buttons and headings) may appear unmasked, and your identity must travel only as an internal identifier, never as your name or email address.

The application also uses a single strictly necessary cookie, with the HttpOnly attribute, to keep you signed in (refresh token). Without that cookie the service cannot be used. Being technically necessary, it does not require your consent.

If you refuse measurement cookies, the tools listed above stop collecting usage data, and if you had already refused before arriving at the site, they do not load at all. You can change your decision at any time from the "Measurement cookies" button at the foot of this page.

We do not sell your data or share it for advertising purposes. We rely on the following providers to operate the service:

SIFEN / DNIT is not a subprocessor: it is a recipient that receives data under a legal electronic-invoicing obligation.

The full, up-to-date list of subprocessors lives in the Subprocessors document (/subprocessors).

Contabo's servers are located in the United States, Cloudflare operates a global network outside Paraguay, and Microsoft, PostHog, and Google are also United States companies, so your data is transferred to other countries.

We keep each category of data for the period indicated below. In the interest of honesty, we note that we do not yet have automatic purging for all of this data:

• Account data: while the account is active and for up to 90 days after closure.
• Session data: up to 30 days after the session expires.
• Electronic tax documents (signed XML and KUDE): 5 years, under a tax obligation (Law No. 125/91).
• Audit logs: 24 months from when they are generated.

We apply technical and organizational measures to protect your data:

• Passwords stored with bcrypt.
• Refresh tokens hashed and rotated on each use.
• Short expiry of the access token.
• Strict isolation of data by clinic.
• Granular per-user permissions.
• Clinical files kept in private storage, with short-lived signed links.
• Invoicing secrets encrypted with AES-256-GCM.
• TLS encryption of data in transit.
• Attempt limits on authentication.
• HTTP security headers.

We do not claim to have database encryption at rest, ISO 27001 or SOC 2 certifications, or external security audits.

In the event of a breach affecting your data, we notify the supervisory authority within 72 hours of becoming aware of it, and the affected individuals when the level of risk requires it.

You have the following rights over your personal data:

• Access: to know what data of yours we process.
• Rectification: to correct inaccurate or incomplete data.
• Erasure: to request that we delete your data.
• Objection: to object to processing based on legitimate interest.
• Portability: to receive your data in a commonly used format.
• Withdrawal of consent, where the processing is based on your consent.

Exercising these rights is free of charge.

To exercise any of these rights, write to [email protected]. We may ask you to verify your identity before responding.

We will respond within 30 calendar days.

We do not make automated decisions that produce legal effects on you, and we do not carry out profiling.

The application is intended for professionals. We do not create accounts for minors.

Data on underage patients is handled in the Patient Data Processing document (/data-processing), not in this Policy.

If you believe the processing of your data breaches the applicable rules, you may file a complaint with the supervisory authority: the National Personal Data Protection Agency (ANPDP), part of the Ministry of Information and Communication Technologies (MITIC).

The ANPDP is not yet operational and has not published its contact channels. Once its contact details become available, we will update this Policy to include them.

We may update this Policy. When we do, we will change the last-updated date and the version shown at the top. If the change is material, we will inform you through the usual service channels.

For any question about this Policy or about the processing of your data, write to [email protected] or call +595 985 218175.

Controller: SONG BAI INVERSIÓN E.A.S., San Lorenzo, Paraguay. Tax ID (RUC): 80163224-2. Registered office: 14 de Mayo c/ Fortín Arce, 111423 San Lorenzo, Paraguay.