Privacy Policy

Version 1.0 Effective date: [to be completed] Language: An Arabic translation of this Policy is available at [to be completed]. If the two versions differ, the English text applies, except where the law requires the Arabic text to apply.

The short version

• PerioSync is run by an individual in Egypt trading as "PerioSync". For the data about you as an Account holder, we are the controller. For the Patient Data you record, you (the clinician or clinic) are the controller and we are your processor. Our Data Processing Addendum at /dpa governs that part.
• We collect what we need to run the Service: your name, mobile number and password (our authentication provider stores it only in hashed form, and we do not store or log it). We also collect device, session and IP address data used for secure sign-in, your Credit and payment records, your support messages and security logs.
• Patient Data is health data. You are responsible for having a lawful basis to record it and for telling your Patients. We use it only to provide the Service to you.
• Voice dictation uses your browser's own speech recognition. Your browser maker (for example Google, Microsoft or Apple) receives the audio under its own terms. We never receive or store audio. If the AI fallback is enabled, the text of a phrase our software could not read may be sent to Groq, Inc. (USA) to be interpreted.
• Our database is hosted by Supabase ([to be completed]) and our website and servers by Vercel (USA). Transfers outside your country use the safeguards listed in section 8.
• We do not sell personal data. We do not show advertising. We use no analytics or advertising cookies.
• You can ask us to access, correct, export or delete your data by email at munyashraf99@gmail.com, on WhatsApp or through the in-app support form. We check that a request comes from you before we act on it. We delete an Account, Patient or chart within 30 days of a verified request. Some records are kept longer for security, tax and accounting (see section 9).
• Patients should contact their dentist. We help the dentist respond.
• This summary is for convenience only. The full Policy below is what applies.

1. Who we are and what this Policy covers

1.1 This Privacy Policy (the "Policy") explains how personal data is handled when you use PerioSync. PerioSync is a web application for dental professionals, available at https://periosync.com and as an installable web app (the "Service").

1.2 The Service is operated by [to be completed], an individual trading as "PerioSync", of [to be completed]. Commercial registration / tax number: [to be completed]. In this Policy, "PerioSync", "we", "us" and "our" mean the operator. "You" means the person who holds a PerioSync account (your "Account").

This Policy also covers people who visit our website, start but do not finish signing up, contact us or send us a payment, and people whose mobile number is typed into our sign-in form. For the data we hold about them, "you" in sections 2, 3, 9, 11 and 17 includes them. Patients are covered in section 12.

1.3 We act in two different roles.

(a) Controller for Account data. We decide how and why we process personal data about you as an Account holder. This includes your name, mobile number, payments, support messages and how you use the Service. This Policy is our notice to you about that data.

(b) Processor for Patient Data. You may record information in the Service about the people you treat ("Patients"). We call this "Patient Data". You, or the clinic you work for, decide why and how Patient Data is processed. You are its controller and we are your processor. We process Patient Data only on your instructions, as set out in our Data Processing Addendum at /dpa (the "DPA"). The DPA forms part of the Terms. Sections 4, 5 and 12 of this Policy describe how Patient Data is handled. The DPA sets out our legal obligations to you as processor and prevails over this Policy on those obligations.

Whether you record Patient Data for yourself or for a clinic, we take instructions about the Patient Data in your Account only from you, the Account holder, unless a court or competent authority orders otherwise. If you record Patient Data on behalf of a clinic, you confirm that you have the clinic's authority to do so, and any arrangement about that data is between you and the clinic. If anyone else claims to control Patient Data in your Account, we will refer them to you.

1.4 "Terms" means our Terms of Service at /terms. Other words with capital letters, such as "Credits" (the units used to start charts) and "Content", have the meaning given in the Terms.

1.5 Representatives. We are not established in the European Union or the United Kingdom. Our representatives there are listed below. You may contact them instead of us about any data protection matter.

• Representative in the European Union: [to be completed]
• Representative in the United Kingdom: [to be completed]

1.6 Data protection officers and Egyptian licence.

• Data protection officer under Egyptian law: [to be completed]
• Licence or permit from the Personal Data Protection Centre: [to be completed]
• Data protection officer under the EU and UK GDPR: [to be completed]

1.7 What this Policy does not cover. Some services you use alongside PerioSync are not controlled by us. Their own terms and privacy policies apply to them. They are:

• your web browser and its speech services (for example Google, Microsoft or Apple);
• WhatsApp (Meta), when you message us there or we reply to you there;
• your bank, InstaPay, Telda or mobile wallet, when you pay us by transfer; and
• the payment providers' hosted payment pages, when online payment is offered.

Section 7 explains what each of them receives when you use the Service.

2. The personal data we collect

We collect only the data listed in this section.

2.1 Data you give us

(a) Sign-up. Your full name, your mobile number and a password. You may also give a referral code. Your mobile number is your login, and you can use a number from any country. When you sign up, sign in or change your password, the password passes over an encrypted connection through our server to our authentication provider (Supabase). We do not store or log it, and Supabase stores it only in hashed form. The exception is a temporary password that an administrator sets at your request, which that administrator sees (section 4.3(d)). Internally, your Account is identified by an address made from your phone number (for example 01xxxxxxxxx@phone.periosync.app). That address is not a mailbox we use or read. [to be completed] Your name, phone number and device identifier (section 2.2(a)) are also stored with your login record.

(b) Acceptance records. The versions of the Terms, this Policy, the DPA, the Cookie Policy and the Refund Policy that were shown to you when you accepted, the version of the acceptance text, your separate consent to transfers outside Egypt (section 8.3), the date and time, and your IP address at that moment. We also record when you acknowledged the notice shown before your first dictation (section 5.4), and which version of it you saw.

(c) Credit requests. When you ask to buy Credits by bank or app transfer, we record the number of Credits asked for, the price, the request reference (for example R-7KQ2MX), the status and the time. We also record any note you add (up to 500 characters), the number of Credits granted, which administrator decided the request and when, and any note they add. We also record that you ticked the purchase confirmation described in our Refund Policy (section 5), the version of its text and of the Refund Policy, and the date and time, IP address and session used.

(d) Online payments (only when offered). We record the number of Credits, the amount, the payment reference and the status. We also record the payment provider's invoice identifiers, an email address if you choose to give one, and your purchase confirmation as described in section 2.1(c). We pass your name, mobile number and that email address to the payment provider so that it can send you a receipt, where that provider does so. We do not send emails ourselves. If you do not give an email address, we pass the internal address described in section 2.1(a). That address is not a mailbox we read, but a payment provider may still try to send a receipt to it. You enter card or wallet details on the provider's own hosted page. Those details never reach our servers.

(e) Support messages. When you use the in-app support form, we store the topic you choose and your message (up to 2,000 characters). We reply to support-form messages by WhatsApp, to your registered mobile number. If you do not use WhatsApp, or you prefer another channel, say so in your message.

(f) WhatsApp messages and transfers. You may contact us on WhatsApp, for example to send proof of payment, recover your password or get help. If you do, we receive your WhatsApp name and number and whatever you send. Messages that the app prepares for you are pre-filled with your name, mobile number, Credit package, price and request reference. You can change them before sending. When you open one of these links, the pre-filled text is passed to WhatsApp in the link address, even if you then decide not to send it. A payment screenshot may show your name, account or wallet number, the amount and the transaction reference. When you pay by transfer, the record of the payment in our own InstaPay, Telda or mobile-wallet account also shows your name, your account, handle or wallet number, the amount and the time.

(g) Requests to us. When you ask us to exercise a data protection right, delete or export data, or reset your password, we keep the request, our reply and any information we use to confirm your identity.

(h) Records from the earlier version of the Service. If you used PerioSync before Credits were sold by request, we may hold the activation codes you redeemed, when you redeemed them and the mobile number that redeemed them, and your former subscription plan and its expiry date.

Please do not include Patient names or other Patient details in support messages, request notes or WhatsApp messages. If we need to look at a Patient's record to help you, give us only your own reference for that Patient. Our replies do not repeat Patient details. WhatsApp is a channel you choose, and you can ask us to reply another way (section 2.1(e)). If you send Patient Data by WhatsApp, WhatsApp (Meta) processes it under its own terms because of your decision as controller, not as our sub-processor. Once Patient Data reaches us by any route, we handle it as your processor under the DPA, and we delete it from our WhatsApp and email accounts within [to be completed] days after the matter is resolved, or within 7 days if you ask us to delete it sooner (DPA, section 9.10).

2.2 Data collected automatically when you use the Service

(a) Device identifier. Your browser generates a random identifier, stores it in your browser and sends it to us when you sign up or sign in. At sign-up, if we are offering a free trial, we also place it in a cookie that lasts 365 days and remains after you sign out. We use it to recognise your devices in your list of signed-in devices and to stop the free trial being claimed more than once. It does not contain your name or phone number.

(b) IP address and browser information. Every request your browser makes to the Service carries your IP address and a browser "user agent" string. The user agent describes your browser and operating system. We use your IP address as described in this Policy. From the user agent we create a short device label, such as "Chrome on Android". We do not store the full user agent string in our database.

(c) Session records. For each device you sign in on, we record the device identifier, the device label, the IP address, and when the session started, was last used and ended.

(d) Attempt log. We record each of these actions: signing in, signing up, changing a password, starting an online checkout, sending or cancelling a credit request, sending a support message and each request for AI voice interpretation (section 5). For each, we record:

• the type of action;
• an identifier: for sign-in, the mobile number typed; for actions taken while signed in, your Account's mobile number; for sign-up and some sign-in records, your IP address;
• your IP address;
• whether it succeeded; and
• the time.

This includes failed sign-in attempts. If someone types a phone number that has no Account, that number is recorded too. We use this log to apply rate limits and to detect abuse.

(e) Voice usage totals. For each month, we record how many AI interpretation requests your Account made and how much processing they used, measured in "tokens". We use this to apply the monthly voice allowance. We do not store audio or the text of what was said.

(f) Free-trial records. When we grant a free trial, we record:

• a keyed hash of your mobile number;
• a keyed hash of your device identifier;
• the network range of your IP address in readable form (the first three of the four numbers of an IPv4 address, or the first 48 bits of an IPv6 address); and
• the date and time.

The hashes are made with HMAC-SHA256 and a secret key held on our servers. This makes them hard to reverse, but they are still personal data. We use these records to detect a second trial claimed by the same phone number, device or network. Section 9 explains how long we keep them.

If a sign-up matches an earlier trial, or several trials were recently granted on the same network, we do not refuse the sign-up. We open a request for the free charts (reference starting T-) with the reason written on it, for an administrator to review. That request is kept like other credit requests (section 9).

(g) Administrator audit log. When an administrator acts on your Account, we record who acted, what they did, the subject (which may be your phone number), details of the action and the time. Examples are approving or declining a credit request, setting a temporary password, resetting your devices, changing a setting and opening one of your charts.

(h) Hosting and error logs. Our hosting providers, Vercel and Supabase, automatically keep technical logs of requests and errors. These logs may include your IP address, the address of the page requested, the time and browser information. Supabase's logs also record the database requests our server makes, which can include your mobile number, device identifier and record identifiers. Supabase's authentication service keeps a log of sign-in events that identifies your Account by the address made from your phone number (section 2.1(a)). Our own error records keep, for each error, a short technical message, the page address without its query string, the time and, if you were signed in, your Account. We remove the query string because a share link carries chart data there. A technical message may occasionally repeat your name, mobile number or email address, where a payment provider's error message includes them. A share link carries chart data inside its address (section 4.6), so opening a share link can place that data in these logs.

2.3 Data we receive from others

(a) Referrals. If you sign up with another user's referral code, we link your Account to theirs. If someone signs up with your code, we record that. We also record whether and when they first bought Credits, and the Credits you received as a reward.

(b) Payment providers. When online payment is offered, the payment provider tells us whether your payment succeeded and gives us its invoice identifiers.

(c) Other users. Another user may send you a share link to a chart. If you import it, the chart data in the link becomes part of your Account.

2.4 Patient Data that we process for you

Patient Data consists of:

• Patient records: your own reference for the Patient (required), and optionally the Patient's full name, date of birth and a note (up to 500 characters);
• Charts: periodontal measurements and findings (such as probing depth, gingival margin, bleeding, plaque, suppuration, calculus, mobility, furcation, implants and missing teeth), optional indices, tooth notes (up to 500 characters each), the diagnosis section (status, stage, grade, extent and a note of up to 300 characters), the recorded date, the clinician's name where one is recorded, and summary values calculated by the Service; and
• Voice phrases: phrases sent for interpretation, as explained in section 5.

Patient Data is health data. It is a "special category" of personal data under the EU and UK GDPR and "sensitive personal data" under Egyptian law. The Service does not let you upload files.

2.5 What we do not collect

We do not receive or store audio recordings. We do not collect your precise location or your contacts. We do not use analytics or advertising tools that track you. We do not receive your card details.

2.6 What happens if you do not give us data

We need your name, mobile number and a password to create your Account, and your IP address to apply security limits. If your browser blocks storage, you can still sign in without a device identifier. To sell you Credits, we need a record of your order and proof of payment. Without these we cannot provide the Service. Everything else is optional, such as a referral code, notes and a receipt email address.

3. How and why we use your data

3.1 The table below lists each purpose for which we use data about you as an Account holder, and the legal basis under the EU GDPR and UK GDPR. Patient Data is covered in section 4.

3.2 Legitimate interests. Where we rely on legitimate interests, we have weighed our interests against your rights. We use only the data needed for the purpose. You may object at any time (section 11). You can ask us for more detail about this balancing.

3.3 Egyptian law. Under Article 6 of the Egyptian Personal Data Protection Law No. 151 of 2020, we rely on these conditions:

• where the table says "performance of our contract", the processing is necessary to perform a contract with you;
• where it says "legal obligation", the processing is needed to meet a legal obligation or an order of a competent authority or court; and
• where it says "legitimate interest", the processing is necessary for us to exercise our legitimate rights, and it does not conflict with your fundamental rights and freedoms.

Where we keep records or disclose data to meet Egyptian law, or an order of an Egyptian court or authority, we rely on the legal obligation condition under Egyptian law, even where the table names legitimate interest as the basis under the GDPR.

We ask for your explicit consent, separately from the Terms, to the transfers of your personal data outside Egypt (section 8.3). If we ever need your explicit consent for another purpose, we will also ask for it separately. You can withdraw a consent at any time.

3.4 What we do not do.

• We do not sell personal data.
• We do not use personal data for advertising.
• We do not send you marketing messages unless you have agreed to receive them, where the law requires that agreement.
• We do not use Patient Data for our own purposes, to train artificial intelligence models, or for advertising. The only exception is what is needed to provide the Service, such as counting your charts and Patient records to apply usage limits.

4. Patient Data and health data

4.1 Your responsibilities as controller

As the controller of Patient Data, you are responsible for:

(a) having a lawful basis to record and use Patient Data. Under the EU and UK GDPR this usually includes a condition in Article 9 for health data, such as the provision of health care by a professional bound by confidentiality;

(b) telling your Patients how their data is handled, including that it is stored in the Service, that dictation may be processed by your browser maker and, if enabled, by Groq (section 5), and that charts can be shared as links (section 4.6);

(c) obtaining any consent your law requires. Egyptian law, for example, requires explicit written consent for sensitive personal data, and the consent of a parent or guardian for children's data;

(d) answering your Patients' requests to exercise their rights (section 12);

(e) confirming that the law that applies to you allows Patient Data to be stored and processed in the places listed in sections 7 and 8. Some countries restrict health data from leaving the country, including some Gulf states; and

(f) if you are subject to the US Health Insurance Portability and Accountability Act (HIPAA): we do not sign Business Associate Agreements. You must not use the Service for protected health information unless we have signed a Business Associate Agreement with you.

4.2 What we do as processor

We process Patient Data only to provide the Service to you and on your documented instructions, as set out in the DPA. We keep it confidential. We use the sub-processors listed in section 7.1. We help you respond to your Patients' requests and meet your security and breach obligations.

When our contract ends, you can ask us for an export of your Patient Data (section 11.3(c)). If you close your Account yourself, ask for the export before or together with your request to close it, because we delete the data within 30 days after we verify that request. If we close your Account, or the Service ends, you can ask for an export within 30 days after that date. We then delete the Patient Data as set out in section 13 of the DPA and section 25 of the Terms, unless you ask us to delete it sooner. If we suspend your Account, for example after a payment reversal, we keep your Patient Data during the suspension and you can still ask us for an export. You are responsible for keeping any copies of clinical records that the law requires you to keep. Deleted data cannot be recovered.

4.3 Who can access Patient Data

(a) Patient Data in your Account can be seen through the Service only by people signed in to your Account. This includes anyone who signs in with a temporary password (section 4.3(d)).

(b) Our administrators can open a chart in your Account through the Service's administration screens, read only, and only to give support you ask for, to investigate a problem you report or a technical fault, or to comply with the law. They cannot change Patient Data through those screens. Every time an administrator opens a chart, who opened it, which chart and when are recorded in the administrator audit log (section 2.2(g)). The screens also show support messages and credit-request notes, so any Patient details you write there will be seen (section 2.1). Section 4.3(d) explains how a temporary password could give an administrator access to your Account.

(c) The operator, and a small number of people who work on the Service for the operator, have technical access to the database, the hosting accounts, the code that runs the Service or our support channels, and so could access Patient Data. They include the person who builds and maintains the software and the people who answer our WhatsApp numbers. Each of them must commit in writing to keep personal data confidential and to use it only on our instructions. They access Patient Data only when that is necessary:

• at your request, for example to give support, export data or delete data;
• to keep the Service running and secure; or
• where the law requires it.

[to be completed]

(d) Temporary passwords. If you cannot sign in, you can ask us to reset your password (section 11.3(e) explains how we check the request). An administrator then creates a temporary password and sends it to you, usually on WhatsApp. The administrator sees that temporary password. Until you change it, anyone who has it could sign in to your Account and see the Patient Data in it. A temporary password does not expire on its own, and setting one does not sign out devices that are already signed in to your Account. Our administrators must not use a temporary password to sign in to your Account. Every reset is recorded in the administrator audit log (section 2.2(g)). When you sign in with a temporary password, change it in the app straight away. Changing your password signs out all your other devices.

4.4 How Patient Data is stored

Patient Data is stored in a database hosted by Supabase. The hosting provider encrypts its disks at rest. We do not add a further layer of encryption to Patient Data inside our application, so the systems that run the Service can read it. On every request, our server checks that the data belongs to your Account before it reads or changes it. The database also has row-level security rules that block access to other Accounts' rows through the database's public interface. Our server uses a privileged key that these rules do not apply to, so in normal use of the Service it is the server checks that keep Accounts apart.

4.5 Printing and exports

Prints, PDF files and PNG images of charts are created in your browser and saved on your device. We do not receive a copy. You are responsible for the copies you make and for where you send them.

4.6 Share links

(a) When you share a chart as a link, the link itself contains the chart readings and the diagnosis, including the diagnosis note. It does not contain the Patient's name, reference, date of birth or tooth notes.

(b) The chart data is encoded in the link, not encrypted. Anyone who has the link can read the data in it. Any signed-in PerioSync user who has the link can import the chart into their own Account.

(c) We do not store share links in our database. When a share link is opened, it passes through our hosting provider and may be recorded in its logs (section 2.2(h)).

(d) Share links cannot be withdrawn and do not expire.

(e) A chart without a name can sometimes still be linked to a person, especially if the diagnosis note contains identifying details. Share links only with people entitled to see the data, and only through a channel you trust.

(f) When another user imports a shared chart, it becomes a separate chart in their Account. They are its controller, and we process it for them. Deleting your chart, Patient or Account does not delete copies that others have imported, and we cannot tell you who has imported one.

5. Voice dictation

5.1 Speech recognition happens in your browser. Voice dictation uses the speech recognition built into your web browser. We do not choose or control where your browser sends audio. As examples: Chrome sends the audio to Google, Edge sends it to Microsoft and Safari may send it to Apple. Each does so under its own terms and privacy policy, which govern the relationship between you and that company. We have no contract with your browser maker about this processing, and it does not act for us. We never receive or store audio.

Dictation runs only while you have switched it on. When you switch it on, you choose to have your browser's speech service process what the microphone picks up, including anything said about Patients. If the law that applies to you does not allow Patient health data to be processed this way, do not use dictation. You can enter every reading by hand.

5.2 What we receive. Your browser turns speech into text and gives the text to the Service on your device. Our software reads the text in your browser and fills in the chart.

5.3 AI interpretation (may be enabled). Our software may be unable to read a phrase of up to 16 words that contains a number. If the AI voice interpretation is enabled, the text of that phrase is then sent through our server to Groq, Inc. in the USA to be interpreted. This includes the phrase (up to 500 characters) and up to five alternative readings from your browser (each up to 500 characters), together with the tooth, side and measurement currently being charted.

• We do not send Groq the Patient's identity, the chart's identity or your Account details.
• Groq does receive the words that were spoken. If a name or other personal detail was spoken, it will be in the text.
• Our server does not store the text. We record the attempt in the attempt log (section 2.2(d)) and add the processing used to your voice usage totals (section 2.2(e)).
• Groq interprets the text with a language model that does not call outside tools or services, such as web search. [to be completed]

We send phrase text to Groq only as your processor, on the instruction you give by using dictation, and under the DPA.

5.4 Who the microphone hears. The microphone can pick up anyone in the room, including Patients. Tell Patients when you dictate, and avoid saying names or other details that are not needed for the chart. Before your first dictation, the Service shows a notice explaining this.

5.5 Spoken tooth numbers. If you switch on "Say teeth", the Service uses your browser's speech synthesis to read tooth numbers aloud. Depending on the voice your browser uses, the browser maker may process the words spoken.

5.6 Dictation window. Dictation is available while a chart is new and for one hour after it is first saved as finished. After that, the chart can still be edited by hand.

5.7 Microphone permission. You can withdraw microphone permission at any time in your browser's settings.

6. Cookies and browser storage

6.1 We use only the cookies and browser storage needed to sign you in, keep the Service secure, prevent abuse of the free trial and remember a few settings on your device:

Each of these items is strictly necessary to provide the Service you ask for, or to remember a choice you have made in it, so we do not ask for your consent to them.

6.2 We use no analytics, advertising, social media or other third-party cookies. We load no third-party scripts, and our fonts are hosted by us. Our Cookie Policy at /cookies gives full details, including how long each item lasts.

7. Who receives your data

7.1 Service providers (sub-processors). We use the following providers to run the Service. Where they act for us as processors, they may use the data only to provide their service to us.

[to be completed]

7.2 Services you choose to use. These companies receive data because you choose to use their services, or because you contact us or we reply to you through them. Each processes it under its own terms, not as our processor.

7.3 Other users.

• If you refer someone, they see your name.
• If someone you referred signs up, you see their name, their mobile number with the middle digits hidden (the first four and last four characters are shown), when they joined, whether they have bought Credits, and how many Credits you earned from their first purchase. That figure shows roughly how many Credits they bought.
• Anyone you send a share link to can read the chart data in it (section 4.6).

7.4 Within PerioSync. The operator, the administrators the operator authorises, and the people who answer our WhatsApp numbers for us can see the following through the administration screens or our support channels:

• your name, mobile number and Credit balance;
• the number of your charts, Patient records and signed-in sessions;
• your voice usage and your sign-up date; and
• your credit requests (with their notes) and your support messages.

Those screens can open a chart only read only, for the purposes in section 4.3(b), and every opening is logged. They also show support messages and credit-request notes, so if you write Patient Data in one, administrators will see it. Section 4.3(d) explains temporary passwords.

7.5 Authorities and legal matters. We may disclose personal data about you where the law, a court order or a competent authority requires it, or where it is necessary to establish, exercise or defend legal claims. We check that a request is lawful and disclose only what is required. Where the law allows, we tell you first.

Patient Data is treated differently. We disclose it only as your processor and as the DPA allows. We tell you before we disclose it unless the law forbids us to, and we challenge requests we consider unlawful. We disclose Patient Data of people in the EEA or the UK to a court or authority outside the EEA or the UK only where an international agreement or another ground in the GDPR or UK GDPR allows it (Article 48).

7.6 Professional advisers. We may share personal data, under confidentiality, with our lawyers, accountants and auditors where they need it to advise us.

7.7 Change of operator. If the Service is transferred to another operator, for example on the sale of the business, your data may be transferred to the new operator. The new operator must continue to protect it in line with this Policy and the DPA. We will tell you at least 30 days before the transfer, and you can ask for an export and close your Account before it takes place.

7.8 If the operator can no longer run the Service. If the operator dies, becomes unable to run the Service, or decides to stop it, [to be completed] will either transfer the Service under section 7.7, or end the Service as the Terms describe. If the Service ends, all users will be told at least 30 days before it ends and can ask for an export until 30 days after it ends. All personal data will then be deleted, except records the law requires us to keep.

8. International transfers

8.1 We operate the Service from Egypt, and our providers are located as shown in section 7. Your data may therefore be processed in countries other than your own, including Egypt, the USA and [to be completed]. These countries may have different data protection laws.

8.2 From the EEA and the UK. The European Commission has not issued an adequacy decision for Egypt. When we collect your data directly from you, that collection is not itself a transfer under Chapter V of the EU GDPR or UK GDPR. When we send personal data on to providers outside the EEA or the UK, and when a dentist or clinic in the EEA or the UK sends Patient Data to us, those are transfers. For each transfer we use the safeguard shown below.

You can ask us for a copy of the safeguards that apply to a transfer. We may remove commercial terms from the copy.

8.3 From Egypt. Where Egyptian data protection law applies, we transfer personal data outside Egypt only as that law allows. Licence or permit from the Personal Data Protection Centre covering these transfers: see section 1.6. When you create your Account, we also ask for your explicit consent to the transfers described in this section, with a separate checkbox, apart from your acceptance of the Terms. If you created your Account before we asked for this consent, we ask for it the next time you open the app. These transfers are needed to perform our contract with you (Article 15 of Law No. 151 of 2020). You may withdraw your consent at any time by contacting us. Withdrawing it does not affect transfers made before you withdrew it. The Service cannot be provided without these transfers, so if you withdraw your consent we will close your Account under the Terms. Before we do, we will give you 30 days to ask for an export (section 4.2). For Patient Data, obtaining any consent your Patients must give to these transfers is your responsibility (section 4.1).

8.4 Patient Data. If you are in the EEA or the UK, sending Patient Data to us is a transfer outside the EEA or the UK. Section 15 of our DPA includes the European Commission's Standard Contractual Clauses (Module Two, controller to processor, or Module Three where you are yourself a processor) and the UK Addendum, and these apply between you and us. As controller, you decide whether these transfers are permitted under the law that applies to you (section 4.1(e)).

9. How long we keep data

9.1 We keep personal data only as long as we need it for the purposes in this Policy:

We do not close Accounts or delete data because an Account has not been used for a while. Your Account, with its Credits and Patient Data, stays until you or we close it under the Terms. If you no longer use the Service, please ask us to close your Account (section 11.3(d)).

9.2 We may keep specific data for longer than shown above in two cases: where we need it to establish, exercise or defend a legal claim, or where a law, court or authority requires it. In those cases we keep only the data needed and only for as long as needed.

9.3 Anonymised data, which can no longer identify anyone, is not personal data. We may keep it. Data that can still be linked to you using other information we hold is not anonymised, and we treat it as personal data.

10. How we protect your data

10.1 We use these measures:

• HTTPS on every connection, with HTTP Strict Transport Security;
• a strict Content Security Policy that lets the Service load content only from our own website and our database provider;
• passwords stored by our authentication provider only in hashed form; we do not store or log them (temporary passwords are explained in section 4.3(d));
• sign-in cookies that scripts on the page cannot read and that are sent only over secure connections;
• a check of your session on every request. You can sign out your devices, and signing in on one device too many signs out the one you used least recently;
• checks by our server on every request, so you reach only your own data, and database row-level security rules that block access to other Accounts' rows through the database's public interface;
• rate limits on sign-in and other sensitive actions;
• payment card details that never reach our servers;
• an audit log of administrator actions; and
• administration screens that show counts, never Patient records (see section 4.3(d) on temporary passwords).

10.2 Measures we do not have.

• Patient Data is not separately encrypted by our application (section 4.4).
• The Service does not offer two-factor authentication.
• We do not verify mobile numbers at sign-up.
• The Service has not been independently certified to any security standard.

No system is completely secure, and we cannot guarantee that a breach will never happen.

10.3 What you can do. Use a strong password that you do not use anywhere else, and keep it to yourself. If we set a temporary password for you, change it as soon as you sign in. Sign out on shared devices. Check your list of signed-in devices regularly. Tell us at once if you think someone else has used your Account, or if your registered mobile number changes.

11. Your rights

11.1 EU and UK GDPR

If the EU GDPR or UK GDPR applies to you, you have the right to:

• access your personal data and get a copy of it;
• correct inaccurate data, and complete incomplete data;
• erase your data, in the cases the law provides;
• restrict our processing, in the cases the law provides;
• data portability: receive data you gave us in a structured, commonly used, machine-readable format, or have it sent to another provider where technically feasible;
• object at any time to processing based on our legitimate interests, for reasons relating to your situation. We will then stop, unless we have compelling legitimate grounds that override your interests, or we need the data for legal claims;
• withdraw consent at any time, where we rely on consent. This does not affect processing that took place before you withdrew it; and
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you (see section 13).

11.2 Egyptian law

If the Egyptian Personal Data Protection Law applies to you, you have the right to:

• be informed of, access and obtain your personal data;
• withdraw consent you have given for the keeping or processing of your data;
• have your data corrected, changed, deleted, added to or updated;
• restrict processing to a specific scope;
• be notified of any breach of your personal data; and
• object to processing, or to its results, where it conflicts with your fundamental rights and freedoms.

11.3 How to exercise your rights

(a) Contact us by email at munyashraf99@gmail.com, on WhatsApp at +20 112 569 2017 or +20 103 044 9593, or through the in-app support form. You can also contact our representatives (section 1.5).

(b) What you can do yourself in the Service. You can change your password, see and sign out your devices, see your referrals and edit chart readings. For anything else, such as correcting your name, mobile number or Patient record details, or deleting a Patient, chart or your Account, please ask us.

(c) Export. On request, we prepare an export of your charts and Patient records in JSON or PDF format within 30 days after we verify your request. We send it as an encrypted, password-protected file to the WhatsApp number registered to your Account, and give you the password in a separate message. We send it by email only if you ask for this from your registered number and accept that email is less secure. We never send an export as an unencrypted file. We delete our own working copies within 7 days after we deliver it. On request, we can also give you the personal data we hold about you as an Account holder in the same way.

(d) Deletion. We delete your Account, or specific Patients or charts, within 30 days after we verify your request. We acknowledge every request within 2 Working Days (as defined in the Terms). Section 9 explains what we keep afterwards and why.

(e) Identity checks. Your Account has no email address and we do not verify mobile numbers, so having the registered number is not enough on its own. If you can sign in, please send your request through the in-app support form, which shows us it comes from your Account. If you cannot sign in, message us from your registered mobile number and give us details that only the Account holder should know, such as the reference of a past credit request, roughly when you signed up, or the name on the Account. For a request to export or delete Patient Data, or to reset your password, we may ask for more than one of these. We may refuse or delay a request until we are reasonably satisfied it comes from the Account holder, and we will tell you why.

(f) Time limits. We respond within one month of receiving your request. If the request is complex, or you send several, we may extend this by up to two further months; if we do, we will tell you within the first month and explain why. If Egyptian data protection law applies to your request, we reply within six (6) working days of receiving it. The reply tells you what we will do and, if the action takes longer, when it will be done, which will be within the periods in this section.

(g) Cost. We do not charge for handling your request. If a request is manifestly unfounded or excessive, for example because it is repetitive, we may charge a reasonable fee based on our costs or refuse it. If we refuse, we will explain why.

(h) Other laws. If the law of your country gives you other data protection rights, contact us and we will honour them as that law requires.

11.4 Complaints

We would like the chance to address any concern first, but you may complain to a supervisory authority at any time:

• European Economic Area: the data protection authority in the country where you live or work, or where you believe an infringement took place. A list is published by the European Data Protection Board at https://www.edpb.europa.eu.
• United Kingdom: the Information Commissioner's Office, https://ico.org.uk.
• Egypt: the Personal Data Protection Centre.

12. Rights of Patients

12.1 We process Patient Data for the dentist or clinic that recorded it. If you are a Patient and want to access, correct or delete your data, or exercise another right, please contact your dentist or clinic directly. They decide how to respond.

12.2 If a Patient contacts us, we will ask them to contact their dentist or clinic. Where we can identify that dentist or clinic, we will also pass the request on to them. We do not act on a Patient's request ourselves unless the dentist or clinic instructs us to, or the law requires us to. If the dentist or clinic cannot be identified, does not respond within [to be completed], or the Account has been closed, we will deal with the request as the law that applies to us requires.

12.3 We help dentists and clinics respond to Patients' requests, as set out in the DPA.

13. Automated decisions

13.1 We do not make any decision based solely on automated processing that has legal or similarly significant effects on you.

13.2 The Service does use some automated rules. None of them makes that kind of decision:

• Device limit. If you sign in on more devices than your limit allows, the device you used least recently is signed out.
• Rate limits. Too many attempts in a short time temporarily block further attempts.
• Voice allowance. When the monthly voice allowance is used up, AI voice interpretation stops until the next month. You can still fill in charts by hand.
• Free-trial check. If a sign-up matches the phone number or device of an earlier trial, or several trials were recently granted on the same network, free charts are not granted automatically. Your Account is still created, and a person reviews the request.
• Diagnosis suggestion (may be enabled). This is a rule-based tool, not artificial intelligence. When you press the button, it proposes a periodontal status, stage and extent from the recorded measurements. It fills fields you can edit. The clinician makes the diagnosis and decides what to record.
• Calculated values. The Service also calculates values from your measurements, such as clinical attachment level, percentages and comparisons between visits. These are aids. The clinician remains responsible for every clinical decision.

14. Children

14.1 The Service is a professional tool for adults. You must be 18 or older, and old enough to make contracts under the law that applies to you (21 for Egyptian citizens), to create an Account (Terms, section 4.2). We do not knowingly hold an Account for anyone under 18. If we learn that we do, we will close the Account and delete its data, subject to sections 4.2 and 9.

14.2 Patient Data may include data about children. As controller, you are responsible for any consent a parent or guardian must give. Egyptian law, for example, treats all children's data as sensitive personal data.

15. Personal data breaches

15.1 As controller. If a breach affects the data we control about you:

• Under the EU GDPR or UK GDPR, we notify the competent supervisory authority within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms. If the risk to you is high, we tell you without undue delay.
• Where Egyptian law applies, we notify the Personal Data Protection Centre within 72 hours of becoming aware of the breach. We tell affected people within three (3) working days of that notification, together with what we have done about it.

15.2 As processor. If a breach affects Patient Data, we notify the affected dentist or clinic without undue delay and, where feasible, within 48 hours. We give them the information they need to meet their own obligations, as set out in section 12 of the DPA. Where the law requires a processor to notify an authority or the people affected directly, we do that too.

15.3 How we tell you. We give breach notices by WhatsApp or SMS to your registered mobile number, and by email if you have given us an email address. We may also show the notice in the Service. A WhatsApp message, SMS or email about a breach affecting Patient Data only tells you that there is a security matter concerning your Account and asks you to sign in or contact us. We give you the details once we have confirmed that we are speaking to you, or in the Service (DPA, section 12.2). Messages to your number contain no Patient Data. Because we do not verify mobile numbers, please tell us at once if your registered number changes.

16. Changes to this Policy

16.1 We may update this Policy, for example when the Service or the law changes. Each version has a version number and an effective date. We keep previous versions and will send you a copy on request.

16.2 If we make a material change, we tell you before it takes effect. We give at least 30 days' notice, the same as for the Terms (Terms, section 27). A change needed sooner for legal or security reasons may take effect earlier. We show you the new version the next time you open the app. For significant changes we also tell you by WhatsApp or SMS to your registered mobile number, in a message that says only that the Policy has changed and where to read it. We also email you if you have given us an email address. Where the law requires your consent to a change, we will ask for it.

16.3 Changes do not reduce your rights under the law that applies to you.

17. Contact us

• Operator: [to be completed], trading as PerioSync
• Postal address: [to be completed]
• Email (privacy, legal and support): munyashraf99@gmail.com
• WhatsApp: +20 112 569 2017 or +20 103 044 9593
• In the app: the support form
• EU representative: [to be completed]
• UK representative: [to be completed]
• Website: https://periosync.com

Related documents:

• Terms of Service: /terms
• Cookie Policy: /cookies
• Refund Policy: /refunds
• Data Processing Addendum: /dpa