Privacy Policy

1. Who controls your data

Dental Connect ("we", "us") is the data controller for personal data processed through dentalconnect.co.tz (the "Platform"). For any question about this policy or your data, contact us at info@dentalconnect.co.tz or support@dentalconnect.co.tz, or by phone at +255 000 000 000.

2. What we collect, and why

Who	What we collect	What it is used for
Everyone	Name, phone and/or email, password (stored hashed, never in plain text), account role, IP address at sign-up and sign-in, device/browser information, pages visited	Creating and securing your account; signing you in; fraud and abuse prevention; measuring which parts of the Platform are used
Patients	Date of birth, gender, phone/email, the clinic(s) you enrol with, appointment dates and status, prescriptions and clinical notes recorded by your clinic, messages with your clinic, reviews you write	Booking and managing your appointments with the clinic you choose; letting your clinic keep its own patient record; showing your own review history to you
Clinics & dentists	Business name, licence and registration documents, address, staff details, services and pricing you publish, patient records you enter for your own patients	Verifying your business before listing it; running your clinic profile, staff, appointments and patient list; billing your onboarding package
Suppliers	Company details, registration documents, product catalogue, quotation ("RFQ") messages with clinics	Verifying your business; running your product listings; connecting you with clinics that request a quotation; billing your onboarding package
Everyone paying an onboarding fee	Payment reference and status from our payment provider (we do not store your card or mobile-money PIN)	Confirming and recording your package payment

We deliberately collect as little clinical detail as possible. Detailed diagnoses, X-rays and full clinical records are not collected by the Platform itself unless a future, separately-approved module says otherwise; what a clinic records about its own patient (such as a prescription or a visit note) is entered and controlled by that clinic as part of its own patient-record keeping.

3. Our legal basis for processing your data

• Performance of a contract: to create your account, run the booking, enrolment, RFQ and onboarding-payment features you asked to use, and to provide customer support;
• Consent: where you tick a box to agree to these terms, to receive a marketing newsletter, or to submit optional information such as a profile photo; you can withdraw consent at any time, as described in Section 7;
• Legitimate interest: to keep the Platform secure, prevent fraud and abuse, run basic analytics, and enforce our Terms, balanced against your right to privacy;
• Legal obligation: where the law requires us to keep or disclose a record, such as a financial record for tax purposes.

4. Who we share data with

• The clinic you enrol with sees the patient record, appointments and messages you create with that clinic. A clinic never automatically sees your history with a different clinic.
• A supplier you send a quotation request to sees your clinic's contact details and the request itself, so they can reply.
• Service providers who process data on our behalf, under contract and only for the purpose we specify: our hosting provider (which stores the database and uploaded files), our email-delivery provider (which sends account and notification emails), and, once enabled, our payment provider for onboarding fees. We do not sell your personal data to anyone, and we do not share it with advertisers.
• Authorised Dental Connect staff (super admins and supervisors), for verification, moderation, support and legal-compliance purposes, on a need-to-know basis; every privileged action they take is recorded in an audit log.
• Regulators or courts, if we are legally required to disclose data, or to protect the rights, safety or property of Dental Connect, our users, or the public.

5. Where your data is stored

The Platform's database and files are hosted with our hosting provider's infrastructure. Depending on the provider's own architecture, backups or infrastructure components may be processed on servers outside Tanzania. Where that happens, we rely on our hosting provider's contractual and technical safeguards to protect your data to a standard consistent with this policy and with Tanzanian law.

6. How long we keep your data

• An active account's data is kept for as long as the account is active and in use.
• If you close your account, or a clinic/supplier account is terminated, we keep the minimum data needed for legal, accounting, dispute and safety purposes (for example, a clinic's past patient records, which by their nature belong to the clinic's own record-keeping obligations, and financial records of onboarding payments) for as long as the law requires, and delete or anonymise the rest.
• Backups are kept on a rolling basis (see our operational backup schedule) and age out automatically; a backup is not a way to keep data indefinitely.
• Audit logs of privileged administrative actions are kept for accountability and are not deleted on request, since they are records of what our own staff did, not of you.

7. Your rights

Subject to the Personal Data Protection Act, 2022 and any conditions or exceptions it sets out, you may ask us to:

• access a copy of the personal data we hold about you;
• correct inaccurate or incomplete data;
• delete your data, where we are not required to keep it for a legal, contractual or safety reason described in Section 6;
• object to or restrict a particular use of your data, including withdrawing a consent you previously gave (this does not affect anything we already did while your consent was in effect);
• receive an explanation of how an automated decision about you was made, if we ever use one that has a significant effect on you (the Platform does not currently make automated decisions of this kind).

Patients can use the "Request my data" option in their account settings. Every user, patient, clinic, dentist, supplier or staff, can also email info@dentalconnect.co.tz to exercise any of these rights. We will respond within a reasonable time and may need to verify your identity first. If you are not satisfied with our response, you may complain to Tanzania's Personal Data Protection Commission (PDPC).

8. Keeping your data secure

We use technical and organisational measures appropriate to the sensitivity of the data, including: encrypting sensitive documents and database fields at rest; enforcing HTTPS and modern browser security headers; requiring two-factor authentication for platform staff; role-based access so a clinic, supplier or patient can only reach its own data; encrypted, regularly tested backups; and an audit trail of privileged actions. No system is completely secure, and we cannot guarantee absolute security, but we work to reduce risk and will tell you, and the regulator where required, if a breach is likely to put your rights or freedoms at risk.

9. Cookies and similar technology

The Platform uses only the cookies it needs to work: a session cookie to keep you signed in, and a security cookie (CSRF protection) to stop forged form submissions. We do not use third-party advertising or tracking cookies, and the Platform does not load scripts, fonts or trackers from other websites.

10. Children

The Platform is not directed at children, and creating your own Dental Connect account requires you to be 18 or older. A patient under 18 is cared for through their guardian's account or directly by the clinic's own patient records, which the clinic controls and is responsible for under its own professional and legal obligations.

11. Changes to this policy

We may update this policy as the Platform, the law, or our own practices change. We will post the updated policy here with a new effective date and version number, and where the change is material we will ask you to acknowledge it again.

12. Contact and complaints

Email info@dentalconnect.co.tz for any privacy question, correction or deletion request. If you believe we have not handled your personal data lawfully, you also have the right to lodge a complaint with Tanzania's Personal Data Protection Commission (PDPC).

This page is a plain-language summary of how we handle personal data and is not itself legal advice. If you have a legal question about your own rights, please consult an independent lawyer or contact the PDPC directly.