Privacy policy

1. Who is responsible for your data

We are the data controller for accounts, customer companies, subscriptions, support and the security of the service.

The data that laboratories, practices and subcontractors enter about their patients and partners is processed on their behalf: each company is the controller of its data and we act as processor (article 10 of the terms and conditions). A patient exercises their rights with their practitioner or laboratory; if a request reaches us, we forward it to them.

Our team is based in Armenia and accesses the data from Armenia for support and maintenance. The data is hosted by Amazon Web Services (eu-west-3, Paris, France).

2. Data we collect

• User account: first name, last name, e-mail, phone, language, password (stored hashed, never in plain text), display preferences.
• Company: company name, address, SIRET, VAT number, billing e-mail, e-invoicing identifier and, if you enter them, bank details (IBAN, BIC).
• Case content: patient's first and last name, practitioner's name, teeth, shades, instructions and comments, files (3D scans, photos, scanned order forms), messages and notes.
• Invoicing: invoices issued and received, payments and reminders.
• Subscription: plan, status and subscription identifiers at Paddle. Card details are entered at Paddle; we have no access to them.
• Sign-in: sessions (operating system, browser, device type, expiry date) and a log of actions performed in the application. Our database does not record your IP address: it only appears in the web server's technical logs and is used to limit sign-in attempts.
• Support and contact: support tickets and messages sent through the contact form (e-mail, subject, message).

3. Why we use it

• Providing the service and managing accounts: performance of the contract.
• Managing subscriptions and their payment, with our reseller Paddle: performance of the contract.
• Sending and receiving electronic invoices for laboratories that activate this feature: performance of the contract and the laboratory's legal obligation.
• Protecting the service (limiting sign-in attempts, anti-bot check at sign-up, action log): legitimate interest.
• Answering support and contact requests: performance of the contract or legitimate interest.
• Informing you by e-mail about important changes to Labflo: legitimate interest; you can object at any time by writing to info@labflo.io.
• Meeting our accounting and legal obligations: legal obligation.

We do not sell your data and do not carry out targeted advertising.

4. Who has access

The companies you work with on Labflo (laboratory, practices, subcontractors) see the cases you share with them. Our authorised staff access the data needed for support and maintenance; they may sign in to an account to assist a user.

We use the following sub-processors:

• Amazon Web Services EMEA SARL: hosting of servers, database and files (eu-west-3, Paris, France).
• Brevo (Sendinblue SAS): sending e-mails (France).
• Paddle.com Market Limited: reseller, payment and invoicing of subscriptions (United Kingdom); for payment, Paddle acts as a separate data controller.
• B2Brouter: e-invoicing platform, for laboratories that activate it; it receives the laboratory's account and invoices, which may include the patient's name if the laboratory chooses to display it (Spain).
• Google Ireland Limited: reCAPTCHA anti-bot check on the sign-up page and address geocoding (Ireland, with possible transfers to the United States).
• Iconify: display of some icons in the application; the service receives the browser's IP address.
• Our e-mail provider: the info@labflo.io mailbox and receipt of contact messages.

5. Transfers outside the European Union

Transfers to the United States (Google) are covered by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses. The United Kingdom (Paddle) benefits from an adequacy decision.

When a laboratory shares a case with a subcontractor established outside the European Union, for example in China, that sharing is decided by the laboratory, which is responsible for the transfer.

Our team accesses the data from Armenia, a country that does not benefit from an adequacy decision of the European Commission.

6. Retention periods

• Account and company: for as long as they are used. When a user account is deleted, its identifying data is anonymised.
• Case files: depending on the laboratory's plan, at least 30 days, 1 year, 3 years or 10 years after the case is shipped or cancelled, then deleted after warning the laboratory (see the terms and conditions).
• Order forms, delivery notes and invoices: for the lifetime of the laboratory's account and at least 10 years, for accounting obligations and traceability of custom-made devices.
• Sign-in sessions: valid for 30 days, erased 30 days after they expire.
• Action log: 12 months.
• Messages sent through the contact form: 3 years.

7. Security

• Encrypted connections (HTTPS); files encrypted at rest by the host.
• Hashed passwords; limited number of sign-in attempts.
• Strict separation between companies: each one only accesses its own data and the cases shared with it.
• Files downloaded through temporary links valid for one hour.
• Payment and e-invoicing notifications authenticated by signature.
• Staff access limited to authorised persons.

8. Cookies and browser storage

The website only uses cookies that are necessary for it to work; they do not require consent. It uses no audience measurement or advertising cookies.

• Sign-in (tdd-token, tdd-refresh-token, tdd-storage-token, tdd-session-token): keep you signed in; 30 days at most. The long-lived cookie is only set if you choose to stay signed in.
• Display (themeMode, themeLayout and other theme… preferences): remember your display settings; 3 days.
• Browser local storage: columns shown in tables and filters on the Production page, until you clear them; cache of the application's icons, 7 days.
• Third-party services: Google reCAPTCHA, loaded only on the sign-up page, and Paddle, loaded only on the Subscription page, may set their own cookies for security and payment.

You can delete cookies from your browser; you will then need to sign in again.

9. Your rights

You have the right to access, rectify, erase, restrict, object to and port your data, and to give instructions on what happens to it after your death.

You can delete your account yourself from "My account". For any other request, write to info@labflo.io: we answer within one month. You can also lodge a complaint with the data protection authority of your country (in France, the CNIL: www.cnil.fr).

10. Changes

We may change this policy; the date of the last update is shown at the top of the page. In the event of a significant change, we inform you by e-mail or in the application.

11. Contact

THE DENTAL DESIGNERS, 1/13 Malkhasyants street, 0051 Erevan, Arménie · info@labflo.io.