1. Overview

DentaFlow is a dental clinic procurement and inventory management platform. This policy explains how we collect, use, store, and protect information when clinics, staff members, and administrators use the website, admin panel, mobile app, or Windows app.

2. Information We Collect

• Account information such as name, email address, phone number, role, clinic, branch, and user code.
• Procurement data such as item requests, quantities, approvals, purchase orders, supplier receipts, deliveries, and inventory movements.
• Authentication and verification data, including Firebase verification status and device notification tokens.
• Operational records such as audit logs, notifications, and system activity needed to secure and operate the service.

3. How We Use Information

• To create and manage user accounts and clinic tenant access.
• To process procurement requests, approvals, supplier receiving, stock allocation, and delivery handover.
• To send account verification, password reset, workflow, and system notifications.
• To generate reports for clinic administrators, doctors, nurses, warehouse managers, and super administrators.
• To protect the platform, detect misuse, and maintain audit history.

4. Multi-Tenant Data Isolation

Clinic data is isolated by clinic account. Users can only access records permitted by their clinic, branch, role, and assigned permissions. Super administrators may access platform-level information required to operate and support the service.

5. Third-Party Services

We use Firebase services for email or phone verification and push notifications. Firebase may process technical identifiers needed to deliver these services. Your use of those features may also be subject to Google Firebase terms and privacy practices.

6. Data Retention and Security

We keep information as long as needed to provide the service, meet operational needs, maintain audit records, or comply with applicable requirements. We use reasonable administrative and technical safeguards, including password hashing, role permissions, token-based API access, and clinic-level data scoping.

7. Account Deletion

Users may request account deletion or use the in-app delete account option when available. Some operational records may be retained where necessary for clinic procurement history, audit integrity, security, or legal obligations.

8. Contact

For privacy questions or account requests, contact the DentaFlow administrator or support team through your clinic account owner.