Privacy Policy
How TeethFlow collects, uses, and protects clinic and patient data.
Last updated: July 2026
1. Data Controller
TeethFlow ("TeethFlow", "we", "us") is the data controller of the personal data processed through the TeethFlow platform. TeethFlow is an AI-first operating system for dental clinics operating in the Arab Republic of Egypt. For any privacy request, contact us at [email protected].
2. Data We Collect
We process the following categories of data to operate the service: • Clinic account data: organisation and branch details, owner/admin name, email, phone, and authentication credentials. • Patient records: names, contact details, clinical notes, treatment history, appointments, and documents uploaded by the clinic. • Communications: WhatsApp and SMS conversations between the clinic and its patients, including AI-assisted messages. • Appointment and billing data: scheduling, invoices, payments, and subscription records in EGP. • Usage and technical data: device, IP address, and logs necessary for security and service operation.
3. How We Use Your Data
We use the data to deliver the TeethFlow service, including patient scheduling, WhatsApp communications, clinical record management, billing, analytics, and AI-assisted features. We also use it to provide customer support, prevent fraud, and comply with legal obligations under Egyptian law.
4. Legal Basis
We process personal data on the following legal bases: • Performance of the subscription contract with the clinic. • Consent of the clinic and, where applicable, its patients. • Compliance with legal obligations under Egyptian Law No. 151 of 2020 on Personal Data Protection and other applicable regulations. • Our legitimate interests in operating, securing, and improving the service.
5. Data Storage and Security
TeethFlow stores clinic and patient data in a secure, encrypted cloud database hosted on enterprise-grade infrastructure. Each clinic's data is strictly isolated so that records are accessible only to authorised users within that clinic. We apply encryption in transit (TLS) and at rest, role-based access controls, audit logging, and regular security reviews, following healthcare data-protection principles aligned with international standards such as HIPAA and Egypt's Personal Data Protection Law No. 151 of 2020.
6. Payment Data Handling
Subscription payments in EGP are processed by Kashier, a payment gateway licensed by the Central Bank of Egypt. TeethFlow does not collect, store, or process card numbers, CVVs, or other full cardholder data. All card data is entered directly on Kashier's PCI-DSS compliant environment, and TeethFlow only receives a transaction reference and payment status. Responsibility for PCI-DSS compliance rests with Kashier.
7. Data Retention
Clinic and patient data is retained for the duration of the subscription and for the period afterwards required to meet legal, accounting, or regulatory obligations. Clinics may request export or deletion of their data at any time, subject to applicable legal retention requirements.
8. Your Data Protection Rights
Under Egyptian Law No. 151 of 2020 on Personal Data Protection, clinics and patients have the right to access their personal data, request correction, export, and deletion, and to withdraw consent. Clinics may exercise these rights directly within TeethFlow or by contacting us. For patient data, requests should be directed to the treating clinic, which is responsible for obtaining the patient's consent.
9. Third-Party Processors
We share data only with processors necessary to operate the service: • Cloud hosting and database infrastructure providers — secure, encrypted data hosting and storage. • WhatsApp / Meta — messaging infrastructure. • Kashier — payment processing. • AI and infrastructure providers used to deliver assistant and analytics features. Each processor is bound by contractual confidentiality and processes data only on our instructions, consistent with Law No. 151 of 2020.
10. International Transfers and Contact
Some processors may store or process data outside the Arab Republic of Egypt. We ensure such transfers are protected by appropriate safeguards, including standard contractual clauses and processor agreements consistent with Egyptian data protection law. To exercise your rights or to ask questions about this policy, contact us at [email protected].