Privacy Policy

Scope

This Privacy Policy explains how Dental Cloud Technologies LLC (“OccluTrace,” “we,” “us,” or “our”) collects, uses, shares, retains, and protects information when you use occlutrace.ai and related services (the “Service”).

The Service is intended for dental professionals, dental laboratories, and CAD/CAM technicians. It is not intended for direct patient use.

Who we are and our role

Dental Cloud Technologies LLC, 2125 Biscayne Blvd, Ste 204 #24161, Miami, FL 33137, USA (contact@occlutrace.ai) controls account, billing, website and marketing data.

For scans, cases, designs and results you upload, your practice or lab is the controller (or the HIPAA covered entity) and we act only on its instructions as processor, service provider or business associate under our BAA or data processing terms.

Information we collect

• Account information. Name, email address, organization where provided, and account settings such as language, display preferences, and two-factor authentication. If you sign in with Google, we receive your name, email address, and profile image from Google.
• Uploaded files and case data. The 3D scan files you upload, the results we generate, and the case data you save. See Dental case and health data below.
• Case metadata. Case label, file names, job status, timestamps, processing settings, and export history.
• Usage and device data. IP address, browser and device information, and security logs, which our servers record automatically. Usage events are collected only if you accept analytics.
• Billing data. We store the billing contact and email, plan and subscription identifiers, billing periods, invoices, payment status, usage counts, carry-over, and extra usage settings and spending. Card details are handled by our payment processor and are not stored by us. Billing emails and analytics contain no patient data.
• Messages. What you send through the contact and support forms, including any files you attach.

Dental case and health data

OccluTrace processes private dental case artifacts such as 3D surface geometry, patient photos, registration landmarks, masks, and related clinical project state. We use this information to provide the case workflow selected by the customer. Case names and original file names may appear in authenticated private case surfaces. Keep patient names and other direct identifiers out of public pages, URLs, logs, support messages, and telemetry; use the designated private case fields.

Business Associate Agreement. We sign a Business Associate Agreement with HIPAA covered entities and with business associates, such as dental labs that work for them. Request one at contact@occlutrace.ai from the email of your account. Where a BAA is signed, it governs how we use and disclose protected health information, together with this Policy. We do not claim HIPAA certification.

With your request or to diagnose a fault, authorized OccluTrace staff may open a saved case read-only, including its scans, designs, results, and case history; every opening is logged. We do not add any case to a training set. We never publish customer cases.

AI and your data

What the AI does. OccluTrace uses AI models to propose results, such as a margin line and a crown design, or the bite position of two scans. Every result is a proposal. The dental professional reviews and edits it and is responsible for the final design before it is manufactured.

What our models are trained on. Our models are trained only on data Dental Cloud Technologies LLC owns or is licensed to use. We never use your scans, cases, designs or results to train, fine-tune or improve any model.

Where AI runs. Some AI steps (segmentation, margin, crown shape, bite search) run on rented cloud GPU servers outside our AWS environment. Before a scan leaves AWS we make a geometry-only copy: patient names, file names, dates, case numbers, account details and all text inside the file are removed, and the copy is labelled with a code that carries no patient or account details. We treat this copy as de-identified under the HIPAA Safe Harbor method (45 CFR 164.514(b)(2)). The GPU servers keep it only to run the job, and it is deleted within about two days. We do not sell this data or attempt to re-identify it, and we disclose de-identified patient information only for this purpose.

No sale, no sharing. We do not sell your data. We share identifiable data only with the providers listed on our Subprocessors page, or when the law requires it.

Staff access. With your request or to diagnose a fault, staff may open a saved case read-only; every opening is logged. We do not add any case to a training set.

Technical data. We record technical data such as error logs, processing times, job status, and software versions. We use it only to run, secure, and fix the Service and to measure overall reliability.

If this changes. We will not use data you have already uploaded in a new way. Any new use would apply only after advance notice and your express consent.

OccluTrace for Windows

OccluTrace for Windows is a desktop application that submits the scans you choose to, and retrieves results from, the same cloud service. It keeps its access token in the Windows credential store on your own device and checks occlutrace.ai for updates.

The app sends usage and diagnostic events only if you turn on “Share anonymous usage analytics” in its settings. The setting is off by default. The events include the app version, the operating system build, mesh sizes, the verdict shown, error codes, and the IP address of the request, and they are linked to your account. They are deleted after 90 days. A problem report that you send from the app includes a log bundle.

The app processes the same private dental case files as the web application and is covered by this Policy.

How we use information

• To provide the Service: create accounts, accept uploads, run processing jobs, render previews, and make exports available.
• To keep the Service reliable and secure: detect abuse, investigate errors, protect accounts, and audit administrative actions.
• To communicate with you: verification, password reset, security alerts, receipts, support replies, and service-status messages. Optional product emails carry an unsubscribe link.
• To improve the product, using aggregated workflow metrics, reliability data, and support themes. These never include scan geometry.
• To comply with legal obligations: maintain required financial records, respond to lawful requests, enforce agreements, and protect rights and safety.

We never use your scans, cases, designs, or results to train, fine-tune, or improve any model. See AI and your data below.

Legal bases

• Account and billing: performance of our contract with you.
• Security, fraud prevention and server error logs: our legitimate interest in a safe, working service.
• Optional analytics and browser error reports: your consent, which you can withdraw at any time on your Account page.
• Marketing email: your consent, or, where the law allows, our legitimate interest for existing customers, with an opt-out in every message.

Service providers

We share information only with service providers that help us operate, secure, support, or bill for the Service. The Subprocessors page names each provider that processes personal data on our behalf, what it does for us, and the data it handles.

Recipients. Named providers are listed on the Subprocessors page. In addition, a GPU compute provider receives de-identified 3D geometry only, without patient names, file names or account data, to run AI computations. Customers with a signed BAA or data processing terms may request its identity under confidentiality.

We may also disclose information if required by law, subpoena, court order, or other valid legal process; to enforce our agreements; to protect the rights, property, or safety of users or the Service; or in connection with a merger, financing, acquisition, or sale of assets.

We do not sell personal information. We do not use advertising cookies or build advertising profiles from customer scans.

Retention

Scan files and results. Uploaded scan files and job results are automatically deleted 90 days after the job is created, subject to backups, audit logs, dispute preservation, and legal retention obligations. An occlusion case that you prepare but never run is deleted after 14 days. Case documents that you save stay with the case until you delete the case or your account.

Crown cases. The Crown design you save (margin lines, crowns, edits and exports) stays with the case until you delete the case or your account. Uploaded scan files of a finished Crown job follow the 90-day rule above; the scans of a Crown case still open for work are kept while you work on it.

Deleted cases. A case you delete stays in the trash for 30 days and can be restored. After that it is permanently deleted.

AI computation copies. The geometry-only copy of a scan that a rented GPU server reads (see AI and your data) is deleted within about two days.

Diagnostic copies. When a result fails, our staff may keep a de-identified geometry copy of the affected scans (the same geometry-only copy described above, with no link to your account or case) to diagnose the fault and to check that later fixes do not break it again. It is never used to train or improve AI models, is accessible only to designated engineers, every access is logged, and it is deleted no later than 24 months after it was made.

Account data. Deleted or anonymized when you delete your account, unless retention is required for security, fraud prevention, accounting, tax, dispute, or other legal obligations.

Billing records. Kept while your account exists. After you delete your account, the payment processor may keep the transaction records that it is required to keep for tax, accounting, chargeback, and legal compliance.

Security and audit logs. Retained for the period needed to protect the Service, investigate misuse, preserve evidence, and satisfy legal obligations.

Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, or export personal information, and to object to certain processing. On your Account page, Download your data gives you a JSON export of your account record, jobs, billing records, notifications, referrals, feedback, and audit entries. Scan files are downloaded from each case. Delete my account removes your account and its data as described under Retention.

To exercise other privacy rights, contact contact@occlutrace.ai. We will respond within the period required by applicable law.

US state privacy notice. We do not sell personal information or share it for cross-context behavioral advertising, and we do not process health data for those purposes. Residents of states with privacy laws can exercise their rights at contact@occlutrace.ai; we will not discriminate against you for doing so.

Cookies and analytics

We use essential cookies and local storage entries required for authentication, security, account preferences, and core Service functions.

We also offer optional product analytics and browser error reporting. They start only after you accept them in the cookie banner. You can accept or decline in the banner or later on your Account page. Analytics is used to understand product reliability and workflow usage, not to sell personal information or target ads. Errors on our servers are reported whatever you choose here, with request bodies, headers, and cookies removed.

Optional website analytics is hosted on our infrastructure. It records general site sections, campaign codes, visit times, and estimated active time. Signed-in activity uses a pseudonymous identifier that administrators can match to your account. It does not record case contents, patient names, file names, form contents, or screen recordings. An optional visitor cookie lasts up to 30 days. Turning analytics off stops collection and removes its browser cookies.

We treat a Global Privacy Control or Do Not Track signal as a refusal of optional analytics.

Security

We protect the Service with encrypted connections, account-scoped authorization, audit logging, and rate limiting. If we confirm a breach of personal information, we notify the people affected as the law requires. Where we hold data on behalf of a dental lab or practice, including protected health information, we tell that customer promptly, and within 10 days of discovering the breach (Florida law, s. 501.171, requires this of a third-party agent). See Security and data handling for detail.

International transfers

We are in the United States and process data there. Rented GPU compute may run elsewhere and receives de-identified geometry only. During early access the Service is not offered in the EU/EEA, the UK or Canada.

Children

The Service is not intended for individuals under 16. We do not knowingly collect personal information from children. If we learn that a child provided personal information, we will delete it promptly.

Changes

We may update this Privacy Policy from time to time. For material changes, we will notify registered users by email or in-product notice before the change takes effect when required by law or contract. The current version will remain posted on this page.

Contact

Dental Cloud Technologies LLC
2125 Biscayne Blvd, Ste 204 #24161
Miami, FL 33137, USA

Privacy inquiries: contact@occlutrace.ai.