Privacy policy

1. Controller and roles

For account, contact, billing and usage data of the Client and authorized users, the Controller is Byron Manuel Rosas Salguero, RUC 1723943393001, Quito, Ecuador. Contact: [email protected].

For patient data entered by the Client, the contracting practitioner or practice is the Data Controller. Saitooth acts as Processor, on that Controller's behalf and instructions. The practitioner obtains and uploads information; Saitooth does not collect it directly from patients.

Saitooth is a technology tool, not a medical service. The Client remains responsible for lawfulness, accuracy and integrity of entered data, clinical judgment, care, clinical records, clinical consent and healthcare obligations. This does not exclude Saitooth's own duties that cannot legally be limited.

2. Data and sources

• —Client data: name, identity or RUC, email, phone, billing details, supplied license information and technical usage logs.
• —Patient data: identity and health information the practitioner enters for care management, including history, diagnoses, treatments, images and documents.
• —Patient data comes from the authorized practitioner; Saitooth does not obtain it directly from patients.

Health data is sensitive. Practitioners must not enter information unnecessary for the clinical purpose.

3. Purposes and legal bases

• —Create and administer the account, provide support and manage the practitioner's subscription.
• —Host and provide contracted functions for managing clinical information.
• —Maintain security, prevent misuse, handle incidents and meet applicable legal obligations.

For Client data, legal bases may include contractual performance, legal duties and, where applicable, consent or properly assessed legitimate interest. The Client defines and documents the legal basis for patient data; Saitooth processes it only under instructions. Clinical informed consent and the data protection basis are separate matters.

Client data may be processed for account administration, billing, support, security and legal compliance. Saitooth does not sell or use patient data for advertising, marketing, profiling or AI model training.

4. Recipients and transfers

Saitooth uses providers for hosting, databases and storage, transactional email and bot protection (Supabase, Vercel, Resend and Cloudflare). Each subprocessor and its processed data are listed in the subprocessor register. All access is limited to service needs and applicable safeguards. Documentation is updated before integrating providers receiving personal data.

Cloud infrastructure may involve processing outside Ecuador. Recipients, purposes and safeguards will be disclosed before international transfers of practitioner or practice data.

5. Security and retention

Reasonable, proportionate MVP measures include access controls, logical separation and encrypted communications where available. No system is completely secure; uninterrupted availability or invulnerability is not promised.

Client data is kept during the relationship and as needed for legal duties or defense of claims. Clinical data is hosted and retained under Client instructions while service is active. Legal retention of clinical records, including the minimum fifteen years required by healthcare regulations, rests exclusively with the Client as Controller, not Saitooth. At termination, return or deletion is coordinated under Client instructions.

6. Large-scale processing

Given the service's nature — hosting and processing dental records for multiple organizations — Saitooth's health data processing may be classified as large-scale processing under Personal Data Protection Authority regulations (Resolution SPDP-SPD-2026-0005-R).

• —Finalidades: provide, maintain and secure the clinical record platform; meet legal obligations; handle Controller requests.
• —Data categories: identity and contact data; patient health data (sensitive data) entered by each responsible organization.
• —Titulares: patients of Client organizations and their authorized users.

Data subjects can exercise access, rectification, erasure, objection, portability and other rights by first contacting the responsible organization that treated them. Saitooth assists Controllers using available technical means and applies measures described in this policy and the DPA.

7. Rights and contact

Under the LOPDP, you may request information, access, rectification and updating, erasure where applicable, objection, suspension or restriction, portability, consent withdrawal and review of automated decisions. Clinical record requests must first go to the Client or authorized user who entered it. For data processed by Saitooth on its own behalf, contact [email protected].

We may request reasonable identity verification information. If your request was not addressed, you may contact the Personal Data Protection Authority.