Privacy Policy

1. Introduction

ClearAlignerAI ("we", "us", "our") is operated by Novo Dental (ABN available upon request), a company incorporated in Australia. This Privacy Policy describes how ClearAlignerAI collects, uses, stores, and protects information in connection with our AI-powered orthodontic treatment planning platform (the "Service").

By accessing or using the Service, you acknowledge that you have read, understood, and agreed to this Privacy Policy. If you are using the Service on behalf of a dental practice, "you" refers to both you personally and the practice you represent.

2. Data We Collect

We collect two categories of data: Account Data relating to you as a practitioner, and Patient Data that you upload in the course of using the Service.

2.1 Account Data

• Name, email address, and password (hashed)
• Practice name, address, and professional registration details
• Billing information (processed via Stripe — we do not store full payment card details)
• Usage logs, session tokens, and device/browser metadata
• Communication history with our support team

2.2 Patient Data (Protected Health Information)

When you use the Service, you may upload Protected Health Information ("PHI") on behalf of your patients. This may include:

We recommend using de-identified or pseudonymised patient identifiers wherever possible. We do not require, and you should avoid uploading, patient names, dates of birth, or national health identifiers unless strictly necessary for your workflow.

2.3 Automatically Collected Data

• IP addresses and approximate geolocation (country/region)
• Browser type, operating system, and screen resolution
• Pages visited, features used, and time on platform
• Error logs and crash reports

3. How We Process Data

All data processing activities are carried out for the purpose of providing and improving the Service.

3.1 AI Analysis

When you submit patient data for analysis, the data is transmitted via encrypted API calls to our AI infrastructure, which is powered by Anthropic's Claude models. The data is processed transiently — it is not stored by Anthropic beyond the immediate inference request. We have executed a Data Processing Agreement with Anthropic to ensure compliance.

AI-generated treatment plan outputs are stored in your account to allow you to review, edit, export, and share results within the platform.

3.2 Legal Bases for Processing

We process Account Data on the basis of contractual necessity (to fulfil our agreement with you) and legitimate interests (to improve the Service). We process PHI on your instructions as a covered entity or business associate under HIPAA, and pursuant to your role as the data controller under applicable privacy laws.

3.3 What We Do Not Do

• We do not sell patient data to third parties.
• We do not use patient data to train AI or machine learning models without your explicit written consent.
• We do not share patient data with insurers, pharmaceutical companies, or marketing entities.
• We do not perform profiling or automated decision-making that produces legal effects on patients.

4. Data Storage and Retention

Data is stored on servers located in the United States and/or Australia, operated by cloud infrastructure providers that maintain SOC 2 Type II certification. All data is encrypted at rest using AES-256 and in transit using TLS 1.3 or higher.

4.1 Retention Periods

Upon account closure, we will purge all PHI within 30 days and provide a deletion confirmation on request.

5. HIPAA Compliance

ClearAlignerAI operates as a Business Associate under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations (the HIPAA Rules). Where you are a Covered Entity subject to HIPAA, we will enter into a Business Associate Agreement (BAA) with you upon request.

5.1 Safeguards We Maintain

• Administrative safeguards: Designated Privacy and Security Officers, workforce training programme, access management policies, and incident response procedures.
• Physical safeguards: Facility access controls and workstation security at our cloud provider data centres.
• Technical safeguards: End-to-end encryption, multi-factor authentication, automatic session timeouts, and comprehensive audit logging.

5.2 Breach Notification

In the event of a breach of unsecured PHI, we will notify affected Covered Entities within 60 days of discovery, as required under HIPAA's Breach Notification Rule. Our notification will include the nature of the breach, the PHI involved, recommended mitigating steps, and our remediation actions.

To request a BAA or for HIPAA-related inquiries, contact: felipe@novodental.net.

6. Patient Data Ownership

All patient data you upload to ClearAlignerAI remains the exclusive property of your dental practice. We act solely as a data processor — we process your patient data on your instructions and for your benefit.

This means:

• You retain full ownership and control over all patient records.
• You may export or delete your data at any time via the platform or by contacting us.
• We have no independent right to use patient data beyond delivering the Service.
• Upon termination of your subscription, your data is returned or deleted at your election.

7. Data Encryption

ClearAlignerAI applies industry-leading encryption standards throughout our infrastructure:

7.1 Data in Transit

All data transmitted between your browser and our servers, and between our servers and third-party processors, is encrypted using TLS 1.3. We enforce HSTS (HTTP Strict Transport Security) with a minimum max-age of one year. We do not support TLS versions below 1.2.

7.2 Data at Rest

All stored data — including patient scans, X-rays, treatment plans, and account records — is encrypted at rest using AES-256. Encryption keys are managed using hardware security modules (HSMs) and rotated on a scheduled basis. Key management follows the principle of least privilege.

7.3 Database Encryption

Our databases use transparent data encryption (TDE) in addition to field-level encryption for PHI fields. Database backups are encrypted using the same AES-256 standard and stored in geographically separate locations.

8. Third-Party Processors

We engage the following sub-processors to deliver the Service. Each has been assessed for security and privacy compliance:

We do not sell data to any third party and will not add new sub-processors that handle PHI without updating this policy and notifying active subscribers.

9. Data Deletion Rights

You have the right to request deletion of your data and your patients' data. To exercise this right:

1. Log in to your account and use the data management settings, or
2. Email felipe@novodental.net with the subject line "Data Deletion Request".

We will process deletion requests within 30 days. For PHI deletion, we will provide written confirmation once deletion is complete. Note that we may retain certain records where required by law (e.g., billing records for tax purposes).

Individual patient data deletion can be performed at any time from within your account dashboard, without affecting other patient records.

10. International Data Transfers

ClearAlignerAI is operated from Australia. If you are located in the European Economic Area (EEA), United Kingdom, or another jurisdiction with data transfer restrictions, be aware that your data may be transferred to, and processed in, Australia and the United States.

Where required, such transfers are conducted under appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Data processing agreements with all sub-processors

We comply with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where applicable, we also comply with the GDPR and UK GDPR.

11. Cookie Policy

We use the following categories of cookies on our website and application:

11.1 Essential Cookies

These cookies are necessary for the Service to function and cannot be disabled. They include session tokens, CSRF protection tokens, and authentication cookies. No consent is required for these cookies.

11.2 Analytics Cookies

We use privacy-focused analytics (no third-party tracking pixels) to understand how the platform is used. These cookies collect aggregate, non-identifiable data such as page views and feature usage. You may opt out via your account settings.

11.3 Preference Cookies

These cookies store your preferences such as language selection and dark mode setting. They do not collect personal information and are deleted when you clear your browser cookies.

We do not use advertising, targeting, or cross-site tracking cookies.

12. Contact Us

For privacy-related questions, data requests, or to exercise your rights under applicable privacy law, please contact:

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au, or with your local data protection authority if you are located in the EEA or UK.

We may update this Privacy Policy from time to time. Material changes will be communicated to registered users by email at least 14 days before taking effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.