Clinical intelligence.

Privacy notice

DRAFT — owner to review. Drafted 2026-09-20 by reading the code that does the storing, not from a template. It has had no legal review. Every line marked DRAFT NOTE is a decision only the owner can make.

This notice describes what Ortho Advisor stores about you and about the work you do in it. It is written against what the software actually does today.

1. Who you are to us

Signing in uses your Google account. From it we receive your email address, your display name and your profile picture URL — nothing else, and no access to your mail, your calendar or your contacts.

Your account is identified internally by a randomly minted identifier, not by your email and not by a hash of it. Usage records carry that identifier alone, so they cannot be worked back to you from the record itself. Your email, name, clinic and phone number live in one place, keyed by that identifier.

2. What you gave us at sign-up

Your name, your clinic or city, and — only if you chose to give it — a phone number. Also the version of the terms you accepted and the moment you accepted them.

Trying it before you sign in

You can ask a few questions and draft one plan without signing in. To count those tries we set one cookie in your browser. It holds a randomly generated identifier, how many tries you have used, and which version of the terms you accepted with the one-tap card. It expires 30 days after your last try.

What you submit while trying it is stored exactly as described in section 3, under that random identifier instead of an account identifier. It is not linked to an account — including one you create afterwards.

To keep the free tries from being abused, the service counts requests per network address for up to a day. The address is used only for that count; it is not stored with your questions.

If you tap "sign in" in the middle of something, we keep what you were doing so you can carry on afterwards:

A case you were filling in stays in that browser tab's storage for up to two hours. Like a draft (section 3), it is never uploaded.
A question you had typed travels in the address of the page you return to after signing in, and is kept in that tab for up to an hour. Like any web address, it passes through our sign-in page and may appear briefly in our hosting provider's request logs; we do not store it ourselves.

3. Everything this product stores

This is the complete list, taken from the one place in the code that records it (the tenancy table the engineering team keeps). Nothing is stored that is not below.

Your profile — your name, your clinic or city, your phone number if you gave one, your email address, and which version of the terms you accepted and when. This is the only place personal details are held. You can see your own; no other clinician can.
Your saved cases — the title, the case description you wrote, and the delivered answer with its citations. Filed under your clinic, and everyone in your clinic can read them. Each one records who created it and who last changed it; what a colleague's screen shows about you is only whether a case is theirs or yours, never your identifier and never your name.
A delete receipt for every case removed — which case, from which clinic, when, by whom, and on what authority. It is what stops a deleted case reappearing from another device.
A visit log per case — the dated entries you or a colleague record at each visit (wires, elastics, appliance events, extraction decisions, IPR, free notes), each carrying the author's opaque identifier and, so colleagues can read the timeline, the author's profile name as it was when the entry was written. Everyone in the clinic can read it; entries are never overwritten — a correction or a removal is a new entry on top.
Your clinic record and your membership — the clinic's id, display name and kind, and which clinic you belong to with what role. Neither reaches any screen.
Clinic invitations — if your clinic administrator invites colleagues by email address, those addresses are held so that the right person joins the right clinic, together with a one-way hash of each address used only to find the invitation without scanning. Neither is shown to anyone, including other members of your clinic.
An audit line for every privileged action — who did it, what, to which id, and on what basis. Identifiers only, never prose, and no request can read it.
Every question and every case description you submit — not a summary, the text — with the opaque identifier, and which indexed sources the retrieval selected (opaque source identifiers and a relevance score, never the source text). Kept as an immutable record of the submission.
A meaning-index of that same text, so the owner can see which questions are asked repeatedly and which the library answers badly. It holds the first 500 characters, the opaque identifier, the mode and the date. No name, no profile field.
Answer ratings and usage records — if you rate an answer, the rating and any note you type, kept with the question it rates; and a record of which product actions you took (which feature, when, with the opaque identifier), including, for the discuss feature, the alternative you typed. These tell the owner what is used and what is failing.
Your sign-in mapping — a one-way hash of your Google account id pointing at your minted identifier. It is how the same person signing in twice is the same person.

If your clinic uses scan capture, three more records exist. They are about your patients, not about you, and they are held in separate patient storage that is kept apart from everything above.

A patient consent record — that a patient signed your paper consent form, which version of the form it was, the date on the paper, which member of your clinic recorded it, and the withdrawal if the patient later takes it back. There is no patient name, no phone number and no free text in it, and there is no field one could be typed into: the signed form stays in your clinic.
A capture link — a one-time capability you hand to a patient so their own device can upload. Only a one-way hash of its secret is stored, it allows a small fixed number of uploads, and it stops working after seven days or when you revoke it.
A scan record for each file uploaded — how large it was, its file type, when it arrived, and which capture link wrote it. The files themselves are patient scans: the three-dimensional scans of a patient's teeth that a clinic's scanner exports, and photographs where a clinic uses them. They are held in a different storage bucket with its own credential, so nothing that can read this product's library can read them, and nothing in the app can send one to a browser. Withdrawing a consent stops any further capture at once; removing scans already captured is a separate, deliberate act the owner performs.

The last two are the records a delete does not remove. Deleting a case removes the case — from the clinic and from every device — and leaves the submission record and the meaning-index entry in place, because that is what tells the owner where the library is failing clinicians. We say so in the delete dialog, and we say it here.

A draft is none of the above: it is autosaved in the browser you are typing in and is never uploaded. Clearing that browser's storage deletes it, and nobody else can see it.

If you upload a scan yourself (the Scans screen, or the scan card on the plan form), two more records exist. By uploading a scan you accept that it is stored and reviewed by the OrthoAdvisor team; the upload form says so in one line, and there is nothing to tick.

Uploaded scans — the upper and lower scan files you upload, a record of the job (your opaque identifier, when it was uploaded, its status, the two file sizes, which version of the upload notice was on screen, and — if you entered them on the form — the patient's age bracket, growth status and name), and what the scan worker made from them: the case description, the readings it withheld and why, the tooth-naming summary and six rendered views. File names are never sent or stored. They are held in the separate patient storage described above, you can see your own and no other clinician can, and they are never deleted: the owner reviews every uploaded scan and its result himself.
Your scan allowance — how many scans your account may run (100 by default, unless the owner has changed it), when it was set and by whom. It holds no email address.

DRAFT NOTE — for the owner: the upload notice ("Uploaded scans are stored and reviewed by the OrthoAdvisor team.") replaced the consent checkbox on your decision of 2026-09-26; it is draft wording too, and the two should be approved together. "Never deleted" is what the code does today (rule R3); if a patient or a clinician may ever ask for an uploaded scan to be removed, that promise has to change here first.

4. If you take part in the research

The research section holds its own records: who is on its allowlist, the tasks issued, the answers given and any later adjudication. It is entered only by invitation — see section 7.

5. Where it is kept

Profiles, cases, delete receipts, clinic records, invitations, audit lines and submission records live in object storage; the meaning-index lives in a hosted vector index; answers are generated by a hosted language-model provider, which receives the retrieved passages and your question or case text in order to write the answer.

DRAFT NOTE — for the owner: a privacy notice normally names its sub-processors and the country each one stores data in. Naming them is a disclosure decision, not a drafting one, so this section describes them by role. Decide whether to name them before this page is published.

6. Who can see what

Members of your clinic see your saved cases, and a clinic administrator can delete them. The owner — who operates the service — can read everything in section 3, and does so to improve the library and to run the clinics. Our infrastructure providers hold the data they store for us (section 5). Beyond those, nobody has access. We do not sell anything, and there is no advertising or third-party analytics in this product.

7. Research

There is a separate research section used to grade the system's answers. It is visible only to accounts on an explicit allowlist held by the owner; if you are not on it, the section does not appear in your menus at all. Being asked to help with the research is an invitation you can decline, and declining changes nothing about your normal use.

8. Retention

Cases stay until somebody deletes them. Everything else in section 3 is kept until you delete your account: nothing in this product deletes on a timer. What deleting your account removes, and what it keeps, is set out under "Deleting your account" below. After a deletion, one deletion record is kept — the date the account was deleted, with no name and no email — so that a device still signed in cannot rebuild the deleted profile.

DRAFT NOTE — for the owner: "until you delete your account" is what the code does since 2026-10-07 (self-service deletion). A retention policy file exists in the store and is read only by a manual purge tool the owner runs; nothing expires by itself. If a retention period is to be promised here, it has to be implemented first.

9. Your choices

You can delete any case you created, from the case list, and a clinic administrator can delete a colleague's. You can delete your whole account yourself — in the app on the Profile tab, or on the web at /account/delete — as described under "Deleting your account" below. You can stop using the service at any time. For anything else — a copy of what is held about you — write to us: support and contact.

DRAFT NOTE — for the owner: self-service account deletion shipped 2026-10-07 (both app stores require it). Data EXPORT is still manual, by request. The visit-log, ratings/usage and scan patient-field bullets in section 3 were added the same day because the list says it is complete and those stores were missing from it — wording is yours to approve, like the rest of this draft.

Deleting your account

You can delete your account yourself, at any time. In the app, open the Profile tab and choose Delete account. On the web, go to /account/delete, sign in, type DELETE and confirm. Deletion is permanent; signing in again afterwards starts a new, empty account.

What is deleted: your profile (name, clinic or city, phone number, email address and the record of which terms you accepted), your sign-in mapping, your clinic membership and your scan allowance. If you work alone, in a clinic with no colleagues, your saved cases, their visit logs and delete receipts and the clinic record are deleted too.

What is kept:

Cases you saved in a clinic you share with colleagues stay with that clinic. They carry an internal identifier that no longer links to you, and visits you logged keep their place in the visit log with your name replaced by “Deleted account”.
Uploaded clinical scan files and their job records are retained as clinical records, as are patient consent and scan records a clinic made.
Service logs and quality telemetry — the submission records, the meaning-index, answer ratings and usage events — are retained for quality and safety, but are no longer linked to you.
Research-study records are governed by the study's own terms.
Audit lines for privileged actions in a clinic are kept; they hold identifiers only.
A deletion record — the date the account was deleted, with no name and no email — is kept so that a device still signed in cannot rebuild your profile.