For clinics
Data processing terms
Effective 6 November 2026
These terms apply when a clinic uses an OnlyTeeth clinic workspace to keep records about its patients. They form part of the terms of use. A clinic that needs a signed copy can ask at hello@onlyteeth.app.
Roles
The clinic decides what patient data to record and why: it is the controller. OnlyTeeth stores and processes that data only to provide the service to the clinic: it is the processor.
What we do, and do not do
- We process patient data only to run OnlyTeeth for the clinic, following the clinic's use of the app.
- We do not sell it, use it for advertising, or use it to train AI.
- Only the people who run OnlyTeeth can access the systems, and only when needed to keep the service working or to help the clinic when it asks.
Security
- Data travels encrypted. Our database host encrypts stored data.
- Database rules let each account reach only its own data and the clinics it belongs to, by role (owner, operator, front desk).
- Clinical photos and scans are in private storage, opened only through links that expire.
- Patient names never appear on shared images or exported reports.
Subprocessors
We use the companies on our subprocessor list. We update the list before adding one; a clinic can object by email, and if we cannot meet the objection the clinic can stop using the service.
Helping the clinic
- The app lets the clinic find, export, correct and delete patient records, so it can answer patients who ask for their data.
- If we become aware of a breach affecting the clinic's patient data, we tell the clinic without undue delay, and within 72 hours where we can.
At the end
When the clinic deletes records or its workspace, the data is removed from the live database at once. Copies can remain in our hosting provider's backups for a limited time until those expire.
Where the data is
Patient data is hosted in the European Union (Ireland). Where a subprocessor works from elsewhere, it is bound by its own data protection commitments for those transfers.