Privacy Policy

1. About this policy

This policy explains how the DentOS desktop application (“the Software”) collects, uses, shares, stores, and protects information. DentOS is a Windows clinic-management application provided by Inover Studio (“we”, “us”) and used by dental clinics and their staff to manage patients, appointments, treatments, and billing. It is distributed through the Microsoft Store.

Who this policy is for

DentOS is used by the clinic and its staff, not by patients directly. Patients whose records are kept in DentOS should contact their clinic about their information (see section 8).

Who controls the data

The dental clinic that uses DentOS is the data controller of the patient and business records it holds — the clinic decides what is collected and how it is used. Inover Studio is the software provider and data processor: we build and maintain the Software and provide secure storage, sync, and messaging on the clinic’s behalf, but we do not use clinic or patient data for our own purposes.

Consent

When DentOS is set up for the first time, the clinic administrator is asked to read and accept this policy before any patient or health information is entered. The clinic is responsible for having a lawful basis, and any consent required, to record its patients’ information and to send them reminders.

2. Information the Software handles

Clinic and staff account information

Clinic name and contact details; staff names, login credentials (email/username and password), and assigned roles, used to sign staff in and control what each user can access.

Patient and health information entered by the clinic

Patient names, CNIC (national identity number), phone numbers and contact details, appointments, treatment plans and progress, visit history, prescriptions, clinical notes and documents, and billing and payment records. This is health information and is treated as sensitive. It is entered and controlled by the clinic as part of running its practice; the Software stores and organises it on the clinic’s behalf and collects only what is needed for that purpose.

Subscription and licence information

The clinic’s subscription plan, licence/activation status, and billing contact. DentOS subscriptions are billed directly by Inover Studio, not through the Microsoft Store. The Software does not collect or store payment card or bank account details.

Technical and device information

A device identifier used to link the installation to the clinic account and secure access, the Software version, and basic diagnostic or error logs used to keep the Software running and to provide support.

We do not sell any data, we do not use clinic or patient data for advertising, and we do not share it with third parties for their own marketing.

3. How the information is used

Information in DentOS is used only to: run the clinic’s scheduling, patient records, treatment, and billing workflows; authenticate staff and enforce role-based access; synchronise and back up the clinic’s data; send appointment reminders and follow-up messages to patients via WhatsApp on the clinic’s behalf, where the clinic enables this; show patients their own appointments and treatment plans in the DentOS Patient App, where the clinic uses it; manage the clinic’s subscription and licence; provide technical support for issues the clinic reports; and keep the Software secure and working correctly.

4. Where data is stored and who it is shared with

On the clinic’s Windows computer — operational data is kept in a local database on the computer where DentOS is installed, so the clinic can keep working. Access to it is protected by the clinic’s Windows user account and DentOS staff sign-in; clinics should keep their computers password-protected.

Supabase — hosted database and application services used to store and synchronise clinic and patient records (see the Supabase Privacy Policy).

WhatsApp appointment reminders — if the clinic enables reminders, the patient’s name, phone number, and appointment date and time are passed to our messaging server, hosted on Railway (see the Railway Privacy Policy), and delivered via WhatsApp from the clinic’s linked WhatsApp account (see the WhatsApp Privacy Policy). Reminder messages contain only the details needed for the reminder, not treatment or clinical details.

DentOS Patient App — if the clinic uses it, each patient can see only their own appointments, treatment plans, and visit history.

Microsoft — DentOS is installed and updated through the Microsoft Store. Microsoft may collect installation and diagnostic information under the Microsoft Privacy Statement; Inover Studio does not send clinic or patient data to Microsoft.

These providers process data on our and the clinic’s behalf, under their own security and privacy commitments. Data may be stored on servers outside Pakistan; by using the Software the clinic agrees to that transfer. We may also disclose information if required by law.

5. Data retention and uninstalling

Clinic and patient records are kept for as long as the clinic requires, in line with its own medical record-keeping obligations. Diagnostic logs are kept only as long as needed to operate and support the Software.

Uninstalling DentOS deletes all of its local data from that computer. Records already synchronised to our backend are not affected. Clinics should make sure their data has finished syncing before uninstalling or moving to a new computer.

6. Security

We protect information handled by the Software with: encrypted transmission (HTTPS/TLS) for all communication with our backend and messaging server; staff sign-in with role-based permissions; restricted backend database access, with records reachable only through controlled server functions. No system can be guaranteed completely secure, but we protect this information appropriately given its sensitivity, and we will notify affected clinics of any security incident involving their data.

7. Clinic controls

Within DentOS, the clinic can add, remove, and change staff accounts and access, correct or delete records it holds, and turn WhatsApp reminders on or off. A clinic can also contact us at support@inoverstudio.com to request an export of its data or deletion of its account and data, subject to its legal record-keeping obligations.

8. Patients’ rights

Because the clinic controls the records in DentOS, patients who want to access, correct, or delete their information, or stop receiving WhatsApp reminders, should contact their clinic. We will help the clinic fulfil these requests. Clinical records may be kept where the clinic is legally required to retain medical records.

9. Children

DentOS is a professional tool operated by clinic staff and is not directed to children. Where a patient record concerns a minor, the clinic creates and manages it as data controller, with any required parent or guardian consent.

10. Changes to this policy

We may update this policy as the Software changes. The “Last updated” date above shows the latest revision, and significant changes will be communicated in the Software or directly to clinics.

11. Governing law & contact

This policy is governed by the laws of the Islamic Republic of Pakistan. Contact: Inover Studio, support@inoverstudio.com, inoverstudio.com.