Privacy and Data Protection Policy

KayDentPro is committed to protecting the privacy and confidentiality of its customers' data and their patients' data. This policy describes how we collect, use, store and protect data in connection with the use of our platform. It is an integral part of the contractual framework between KayDentPro and its client clinics.

The client clinic is the sole and exclusive owner of its patients' data and of all data entered, imported or generated on the platform. The clinic acts as the data controller.

KayDentPro acts exclusively as a technical processor. Hosting or processing data does not transfer any ownership to KayDentPro.

Clinic data

• Identification information (name, address, email, phone)
• Billing and payment data
• Clinic settings and preferences

Patient data

• Personal information (first name, last name, date of birth, phone, email)
• Medical data (history, consultations, treatments, prescriptions)
• Geographic data (department, commune, communal section)
• Financial information (invoices, payments, treatment plans)
• X-rays and medical files (stored on Supabase Storage)

Usage data

• Login and activity logs
• Navigation and platform usage data

Collected data is used exclusively to:

• Provide and improve KayDentPro services
• Enable clinic management (patients, appointments, billing)
• Send notifications to patients (reminders, confirmations) with their consent
• Generate aggregated, irreversibly anonymized statistics
• Comply with our legal and contractual obligations

KayDentPro never sells, rents or shares clinic or patient data with third parties for commercial, advertising or research purposes.

• Mobile phone numbers are collected only with the patient’s consent, obtained by the clinic at registration or through the online booking page.
• These numbers are used exclusively to send transactional messages: appointment reminders, confirmations, schedule changes, balance notifications and payment confirmations.
• Mobile phone numbers and SMS consent data are never sold, rented or shared with third parties for marketing or advertising purposes.
• Patients can opt out at any time by replying STOP, and get help by replying HELP.
• Message frequency varies based on the patient’s appointments. Message and data rates may apply.
• Messages are delivered by Twilio Inc., already listed as a technical subprocessor.

Infrastructure

• Data hosting: Supabase (PostgreSQL, AWS us-east-1, United States)
• Application deployment: Vercel (global CDN network)
• Files and X-rays: Supabase Storage with per-clinic isolation

Security measures

• Data encrypted in transit (HTTPS / TLS 1.3) and at rest (AES-256)
• Secure authentication via Supabase Auth (JWT)
• Multi-tenant isolation: each clinic can only access its own data
• Row Level Security (RLS) enabled on all database tables
• Automatic daily backups with point-in-time recovery (PITR)
• Compromised password protection (HaveIBeenPwned)
• Rate limiting on all sensitive routes
• HTTP security headers (HSTS, X-Frame-Options, CSP)

No member of the KayDentPro team accesses patient data without the clinic's prior, specific written authorization, except in cases of compelling technical necessity, duly documented and notified to the clinic within twenty-four (24) hours. All access is logged, and logs are provided to the clinic upon request.

The KayDentPro team is bound by an absolute duty of confidentiality regarding medical data, in accordance with professional secrecy obligations applicable in Haiti. This obligation survives the end of the contractual relationship without time limitation.

Clinics using KayDentPro are responsible for informing their patients about the use of their data and for honoring their rights, including:

• Right of access to their medical data
• Right of rectification in case of error
• Right to erasure, subject to legal medical record retention obligations
• Right to object to communications

KayDentPro provides clinics with the technical tools needed to effectively exercise these rights (viewing, correction, export and deletion of records).

• Active data: retained for the full duration of the contract.
• After termination: data remains accessible and exportable free of charge for sixty (60) days, then is securely and permanently deleted — including from backups — within a maximum of thirty (30) additional days. A deletion certificate is issued upon written request.
• Technical logs: retained for 90 days.
• Financial data: retained according to applicable legal obligations.

KayDentPro relies on the following technical subprocessors:

• Supabase Inc. — database and file storage
• Vercel Inc. — application hosting
• Twilio Inc. — SMS and WhatsApp message delivery
• Resend Inc. — transactional email delivery
• Sentry Inc. — technical error monitoring

Data is hosted on servers located in the United States (AWS, us-east-1 region). Each subprocessor is bound by contractual confidentiality and security commitments at least equivalent to those of this policy, and may only use data for the purposes defined by KayDentPro. KayDentPro notifies clinics of any subprocessor change affecting data hosting or storage with thirty (30) days' notice.

In the event of a security incident likely to affect clinic or patient data, KayDentPro commits to notifying the affected clinics as soon as possible, and no later than seventy-two (72) hours after becoming aware of it, and to taking all necessary measures to limit the impact.

KayDentPro may amend this policy to comply with legal or technical developments, or to strengthen data protection. No unilateral change may reduce the rights of clinics or their patients. Any substantial change is notified by email with thirty (30) days' notice.

• Email: info@kaydentpro.com
• Phone / WhatsApp: +509 5624 0786
• Website: kaydentpro.com