Dentalendar — Privacy Policy

Last updated: October 12, 2026

This Privacy Policy explains how nisotab (“we”, “us”, “our”), a sole proprietorship based in Istanbul, Türkiye, collects, uses, stores, shares and protects information in connection with the Dentalendar mobile application (the “App”) and related services (together, the “Service”). Dentalendar is a practice management tool for dental clinics: appointments, patient records, treatment charts, payments, expenses and inventory.

1. Who This App Is For and Our Role

The App is intended for dentists, clinic owners and clinic staff, for professional use. It is not intended for patients, and you must be at least 18 years old to create an account.

The Service involves two kinds of personal data, with different roles:

• Your account data (Section 2.1) — nisotab is the data controller.
• Clinic and patient data that a clinic enters into its workspace (Sections 2.2–2.5) — the clinic (the dental practice that uses the App) is the data controller, and nisotab processes this data only on the clinic’s behalf and according to its instructions, as a data processor. Patients who have questions about their data, or want to exercise their rights, should contact their clinic first; we will assist the clinic in responding.

2. Information We Process

2.1 Account data

• Name, professional title, email address, and optionally phone number, specialty and profile photo.
• Language preference.
• Sign-in information: if you sign up with email, your password is stored only as a secure hash by our authentication provider. If you sign in with Google or Apple, we receive an identifier, your email address and (where provided) your name from that service. Apple may give us a private relay email address instead of your real one.

2.2 Clinic workspace data

Clinic name, branch, address, phone number, logo, working hours and settings; team members, their roles and permissions; and invitations (the invitee’s name, email address and role).

2.3 Patient data entered by the clinic

• Identity and contact details: name, phone number, date of birth, gender, marital status, occupation, workplace, address, national ID or passport number, insurance, referral source, tags, custom fields and notes; for minors, the guardian’s name, phone number and relationship.
• Health data: medical history questionnaire (diseases, allergies, medications and similar answers), signed consent forms including the signature image, tooth chart and treatment records, and intraoral (before/after) photos.
• Appointments and financial records (charges, discounts, payments, refunds, receipts and account notes).

2.4 Practice management data

Expenses (including staff payments linked to a team member), recurring expenses, and inventory items and stock movements.

2.5 Accountability records

A change history (who created, changed or deleted which record, when, and the values before and after the change) and a patient file access log (who opened which patient’s file, and when). These records help clinics meet their security and accountability obligations; they cannot be edited by users.

2.6 Notifications

In-app notifications (for example, a new or moved appointment, or a team member joining) and your notification preferences. If you allow push notifications, your device’s push token and subscription are linked to your user ID.

2.7 Technical data

Crash and error reports (device model, operating system and app version, and error details). Before a report is sent, email addresses and long numbers are masked. Our providers also process IP addresses transiently to deliver the Service and protect it from abuse.

2.8 What we do not collect or do

• We do not use advertising identifiers, show ads, or track you across other apps or websites. The App contains no analytics SDK; we only receive crash and error reports.
• If you enable the app lock, Face ID / Touch ID / fingerprint verification happens on your device; we never receive biometric data.
• We do not sell personal data, and we do not use it to train AI models.

3. How We Use Information

• To provide the Service: accounts, clinic workspaces, team permissions, and keeping data in sync across a clinic’s devices.
• To send notifications you have chosen to receive: appointment changes, reminders before appointments, a daily summary, and team events.
• To keep the Service secure: access control, change history and access logs, preventing abuse, and fixing errors.
• To provide support and to comply with legal obligations.

We do not make automated decisions that produce legal effects about you.

4. Legal Bases

For account data we rely on the performance of our contract with you (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)), our legitimate interests in securing and improving the Service, such as crash reports (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)), and our legal obligations (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)). Push notifications rely on the permission you grant on your device.

For patient data, including health data, the clinic determines the legal basis as the data controller (for example, processing by persons under a duty of professional confidentiality for medical diagnosis and treatment, KVKK Art. 6(3); GDPR Art. 9(2)(h)), and is responsible for informing its patients and obtaining any consent required.

5. Service Providers (Processors)

We share personal data only with service providers that help us operate the Service, under contracts that restrict their use of the data:

Push notifications never contain patient names: they show, for example, the appointment time and the procedure. We may also disclose information if required by law or an enforceable request of a public authority, or to protect the rights and safety of users and the public.

6. International Transfers

Account, clinic and patient data is stored in the European Union (Frankfurt). Some providers (such as OneSignal) process limited data in the United States. Such transfers rely on the safeguards available under applicable law, such as standard contractual clauses, and on KVKK Art. 9 for transfers from Türkiye.

7. Retention and Deletion

• Account data is kept until you delete your account. When you do, your sign-in account, notification preferences and push subscription are deleted, and your profile is anonymized (“Deleted user”). The anonymized entry remains in the records of clinics you worked in (for example, “who recorded this payment”), because those records belong to the clinic. Clinics in which you are the only member are deleted together with all their data.
• Clinic and patient data is kept for as long as the clinic keeps it in the App. A clinic owner can delete a patient (their records and photos are deleted and their entries in the change history are anonymized to the file number) or delete the whole clinic (all of its data is deleted). Clinics remain responsible for their own legal record-keeping obligations for health records.
• Photos are removed from storage shortly after the record they belong to is deleted (usually within an hour).
• Notifications are deleted after 90 days; push delivery records after 30 days.
• Backups made by our hosting provider are kept for up to 7 days and then overwritten. Crash reports are kept by Sentry for a limited period (typically 90 days).

8. Security

We use encryption in transit (TLS) and encryption at rest by our hosting provider; role-based permissions enforced on the server (row-level security), so each user sees only what their role allows; private photo storage checked on every request; secure session storage on your device (Keychain / Keystore); an optional app lock with Face ID or fingerprint and optional screenshot blocking; and the change history and access logs described above. No system is perfectly secure; we will notify you and the relevant authorities of a personal data breach where required by law.

9. Your Rights

Under KVKK (Art. 11), the GDPR and other applicable laws, you may have the right to learn whether your data is processed, access it, have it corrected or deleted, object to or restrict certain processing, receive your data in a portable format, withdraw consent (for example, by turning off push notifications), and complain to a supervisory authority (in Türkiye, the Personal Data Protection Authority; in the EEA, your local data protection authority).

To exercise your rights regarding your account, contact us at support@nisotab.com; we respond within 30 days. If you are a patient, please contact your clinic, which controls your data; we will support the clinic.

10. Clinics’ Responsibilities

A clinic using the App is responsible for informing its patients about the processing of their data, obtaining any consent required (including for photos and, for minors, from their guardians), giving team members only the permissions they need, and complying with health-data, confidentiality and record-keeping rules that apply to it. We process clinic data only to provide the Service.

11. Push Notifications

Push notifications are optional. The App asks for permission when you first open a clinic; you can choose which notifications you receive in the App and turn them off at any time in your device settings.

12. Children

Users must be at least 18. Clinics may record minors as patients together with their guardian’s details; the clinic is responsible for the guardian’s consent.

13. Changes to This Policy

We may update this Privacy Policy. Material changes will be announced in the App or by other reasonable means before they take effect, and the “Last updated” date above will change.

14. Contact

nisotab, Istanbul, Türkiye — support@nisotab.com