1. Introduction

DOQ Dental Practice Management ("we", "our", or "us") is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, store, share, and safeguard your information when you use the DOQ platform (www.doq.am), including our web application and progressive web app (PWA). This policy applies to dental practitioners, clinic administrators, and any other individuals who interact with our platform. We process data in accordance with the EU General Data Protection Regulation (GDPR), the Republic of Armenia Law on Protection of Personal Data, and other applicable data protection laws.

2. Information We Collect

We collect different types of information depending on how you interact with our platform. We only collect data that is necessary for the purposes described in this policy.

Information you provide directly

Personal identification: full name, email address, phone number, and profile photo
Professional information: dental credentials, practice name, and clinic details
Patient records: dental charts, treatment histories, clinical notes, appointment data, and patient photos (entered and managed by you as the data controller)
Billing information: payment records, treatment costs, and financial data related to your practice

Information collected automatically

Usage data: pages visited, features used, interaction patterns, session duration, and performance metrics
Device and technical data: IP address, browser type and version, operating system, screen resolution, and language preferences
Cookie data: authentication tokens, theme preferences, and language settings stored via cookies and local storage

3. Legal Basis for Processing

We process your personal data only when we have a valid legal basis to do so. The legal grounds we rely on include:

Consent: where you have given clear, affirmative consent for us to process your data for specific purposes, such as receiving marketing communications or enabling push notifications
Contractual necessity: where processing is necessary to fulfill our contract with you, including providing the DOQ platform, managing your account, and delivering customer support
Legal obligation: where we are required to process data to comply with applicable laws, such as tax record-keeping or responding to lawful requests from authorities
Legitimate interests: where processing is necessary for our legitimate business interests, such as improving our services, ensuring platform security, and preventing fraud, provided these interests do not override your rights

4. How We Use Your Information

We use the information we collect for the following specific purposes:

Providing and maintaining the DOQ platform, including patient management, appointment scheduling, dental charting, and billing features
Communicating with you about account updates, service changes, technical support, and responding to your inquiries
Analyzing usage patterns and platform performance to improve features, fix issues, and enhance the overall user experience
Protecting the security and integrity of our platform, detecting and preventing unauthorized access, fraud, and other malicious activity
Complying with applicable legal obligations, including tax, accounting, and regulatory requirements
Sending appointment reminders, push notifications, and WhatsApp or email notifications when you have opted in to receive them

5. Third-Party Services and Data Sharing

We work with trusted third-party service providers to operate and improve our platform. We only share the minimum amount of personal data necessary for these providers to perform their services on our behalf. We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.

Cloud infrastructure and database hosting (Supabase / AWS) for secure data storage and processing
Analytics services to understand platform usage and improve performance
Communication services for email delivery, push notifications, and WhatsApp messaging

All third-party service providers are contractually obligated to protect your data and may only process it according to our instructions. We conduct due diligence to ensure these providers maintain appropriate security standards and comply with applicable data protection regulations.

6. International Data Transfers

Your data may be transferred to and processed in countries outside of your country of residence, including countries within the European Economic Area (EEA) and the United States, where our infrastructure providers operate. When we transfer data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or we rely on the service provider's adequacy certifications. By using our platform, you acknowledge that your data may be processed in these jurisdictions, which may have different data protection laws than your home country.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy. Account data is kept for as long as your account remains active. After account deletion, we will erase or anonymize your personal data within 30 days, unless we are legally required to retain certain records (such as financial or tax records, which may be retained for up to 7 years). Patient records entered by dental practitioners are retained according to the practitioner's instructions and applicable medical record retention laws. You may request deletion of your data at any time by contacting us.

8. Data Security

We take the security of your personal data seriously and implement appropriate technical and organizational measures to protect it against unauthorized access, alteration, disclosure, or destruction. Our security measures include:

Encryption of all data in transit (TLS/SSL) and at rest using industry-standard encryption protocols
Strict access controls with role-based permissions, ensuring only authorized personnel can access personal data
Regular security audits, vulnerability assessments, and monitoring of our infrastructure for suspicious activity
A documented incident response plan for promptly addressing any data breach, including notifying affected users and relevant authorities within 72 hours as required by the GDPR

9. Your Rights

Under applicable data protection laws, including the GDPR, you have the following rights regarding your personal data. We will respond to all valid requests within 30 days:

Right of access: request a copy of the personal data we hold about you
Right to rectification: request correction of inaccurate or incomplete personal data
Right to erasure: request deletion of your personal data ("right to be forgotten"), subject to legal retention requirements
Right to data portability: receive your data in a structured, commonly used, machine-readable format and transfer it to another service
Right to object: object to the processing of your data for specific purposes, including direct marketing
Right to withdraw consent: withdraw your consent at any time where processing is based on consent, without affecting the lawfulness of prior processing
Right to lodge a complaint: file a complaint with your local data protection supervisory authority if you believe your rights have been violated

To exercise any of these rights, please contact us at support@doq.am or through our contact page. We may need to verify your identity before processing your request. We will not charge a fee for handling your request unless the request is clearly unfounded or excessive.

10. Cookies and Tracking Technologies

We use cookies and similar technologies (such as local storage) to operate our platform and remember your preferences. Cookies are small data files stored on your device. We use the following types of cookies:

Essential cookies: required for the platform to function, including authentication tokens and session management. These cannot be disabled.
Functional cookies: store your preferences such as language selection, theme (light/dark mode), and sidebar state to provide a personalized experience.
Analytics cookies: help us understand how users interact with our platform so we can improve it. These are only used with your consent.

You can manage your cookie preferences through your browser settings. Blocking essential cookies may prevent you from using certain features of the platform. We do not use cookies for third-party advertising or cross-site tracking.

11. Children's Privacy

The DOQ platform is a professional tool designed for licensed dental practitioners and clinic administrators. It is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@doq.am and we will promptly delete the information.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you by posting the updated policy on this page with a new effective date and, where appropriate, sending you an email notification. We encourage you to review this policy periodically. Your continued use of the platform after any changes constitutes your acceptance of the updated policy.

13. Contact Us

If you have any questions, concerns, or requests related to this Privacy Policy or our data practices, we are here to help. For privacy-specific inquiries, you may designate your request to our data protection team.

You can reach us through our contact page or by email at support@doq.am