Privacy Policy

For the purposes of data protection and privacy laws, Tiya Pte. Ltd. and Topmuse Pte. Ltd. (“we” or “us”) act as joint controllers of personal information processed under this Privacy Policy, except for PHI processed on behalf of a Covered Entity under the BAA. Topmuse Pte. Ltd. is the designated joint controller representative and acts on behalf of Tiya Pte. Ltd. in handling privacy inquiries and requests from individuals or public authorities concerning that joint-controller processing.

Where Topmuse Pte. Ltd., doing business as Denti Note, processes PHI on behalf of a Covered Entity, it acts as that Covered Entity’s Business Associate and complies with the applicable BAA and HIPAA requirements. In that capacity, Topmuse Pte. Ltd. assists the Covered Entity with individual requests and forwards requests received directly from individuals as required by the BAA, unless applicable law requires a direct response. We remain committed to protecting personal information as described in this Privacy Policy. This Policy does not replace the treating provider’s notice of privacy practices or permit any use or disclosure prohibited by the BAA or applicable law.

If you have questions about how we collect, use, process or protect your personal information, or if you have any requests in respect of your personal information, our contact information is as follows:

• Name of Joint Controller Representative: Topmuse Pte. Ltd.
• Address: 6 Shenton Way, #37-03, OUE Downtown, Singapore 068811
• Attn: Data Protection Officer
• Email: support@dentinote.ai

Before acting on a request, we may take reasonable steps to verify your identity and, where applicable, the authority of an agent acting on your behalf. Verification may include confirming your registered email address or requesting other information reasonably necessary to assess the request. Requests concerning PHI are handled in accordance with the BAA and applicable law.

We will consider and respond to privacy inquiries and requests in accordance with applicable law and, where relevant, the BAA. Any applicable fee, extension or refusal will be subject to the requirements and limitations of applicable law. If your concerns remain unresolved, you may contact the competent privacy regulator where applicable.

(I) Information You Provide

(II) Information We Get When You Use Our Services

When you use the Services, we collect technical and usage information for service operation, analytics and security.

(III) Information We Collect from Third Parties

DO NOT SELL. We do not sell your personal information. We do not use PHI to train, fine-tune, improve or refine any AI model, and we do not permit our AI service providers to do so. We may use information to maintain, troubleshoot, assess and improve the quality and functionality of the Services. Any use of PHI for those purposes is limited to uses permitted by the applicable BAA and HIPAA requirements; this Privacy Policy does not independently authorize such use or expand the BAA.

We use your personal information for the following purposes only when it is necessary to do so for valid reasons (such as with your consent, to comply the law, to provide you with the Services, to protect your rights and interest or to fulfil our legitimate business interests) and in accordance with applicable laws:

We may share your information with other entities in the following situations:

A) Our Related Entities

We may share personal information within our corporate group for the activities listed below, subject to applicable law and this Privacy Policy. PHI is shared only through arrangements covered by an applicable BAA; Other personal information that is not PHI may be processed for the ordinary corporate purposes described below.

• Technical Operations: Data hosting, analytics, maintenance, and enhancing security against spam, abuse, fraud, or infringement.
• Corporate Functions: Finance, legal, HR, accounting, and strategic planning.
• Corporate Transactions: Mergers, acquisitions, sales of company assets, or financing.
• Compliance: Adherence to applicable laws and internal audits.

Each entity within the group may only use your personal information in accordance with this Privacy Policy.

B) Our Authorised Partners

We work with third party vendors to provide the Denti Note app ("Authorised Partners" or "Vendors"). We seek to update our list of Authorised Partners below as soon as practicable. These Authorised Partners process your information only at and according to our instructions. They perform tasks such as hosting, user support, analytics and fraud detection and prevention. For more information, please read the privacy policies of our Vendors.

C) AI Service Providers and Data Processing

We use AssemblyAI for speech-to-text transcription and OpenAI, accessed through a dedicated organization, to generate clinical-note drafts, derivative documents and structured dental charts. These providers process the audio, transcripts and related information needed for the requested functions. Any processing of PHI through these services must comply with applicable HIPAA requirements and the applicable BAA.

Regarding these AI partners, we further disclose:

• Explicit Consent: Before recording or transmitting clinical audio for AI transcription, we explain the relevant processing and obtain your express recording and AI-processing consent. Microphone permission is also required. BAA acceptance is required before enabling Services involving PHI. Your consent does not replace any notice, patient consent or authorization required by applicable law.
• Limited Purpose: Our AI service providers process clinical content to transcribe recordings, generate clinical-note drafts, derivative documents and structured dental charts, and support your review and correction of those outputs, subject to applicable law and the BAA. Any internal use of PHI to maintain, assess or improve the Services is separately limited to purposes permitted by the applicable BAA and HIPAA requirements and does not include AI model training. Outputs assist professional documentation and do not replace clinical judgment or independently determine diagnosis, treatment or medication.
• Data Minimization: AI processing uses the session audio or transcript and the template, patient information and professional profile details relevant to the requested output. We limit PHI processing to what is necessary and permitted under the applicable BAA and HIPAA requirements.
• No Model Training with PHI: We do not use PHI to train, fine-tune, improve or refine any AI model, and we do not permit our AI service providers to use PHI for those purposes. PHI submitted for transcription or document generation is not made available for model training.
• Retention and Deletion: PHI may be retained only for the permitted processing purposes and as allowed by the applicable BAA and law. Exclusion from model training does not itself mean zero retention.
• Data Security and HIPAA: PHI processed in connection with our AI services is subject to the safeguards required by applicable HIPAA rules and the applicable BAA, including restrictions on access, use and disclosure and appropriate protection during transmission and storage.
• User Control: You may withdraw recording authorization through Privacy & Security settings or disable microphone access in your device settings. These are separate controls, and further recording requires the necessary authorization and microphone permission. Requests concerning BAA termination or the return or deletion of PHI are handled separately under the applicable BAA and law; submitting a request does not itself terminate the BAA or complete deletion.

D) Government Agencies

In order to combat fraud and illegal activity, we may process and disclose information to other organizations or provide information to government agencies in response to any lawful request. If required by any government authority or courts for any purposes such as the enforcement of any laws or to prevent their contravention, we may release your personal information as is legally required or permitted.

Denti Note is intended for use in the United States. We use Google Cloud Platform for cloud database, audio storage, computing and deployment infrastructure, and the servers supporting the Services are located in the United States. If you access the Website or Platform from outside the United States, information you provide may be transferred to, processed, maintained and used on servers in the United States, outside the state, province or country where you are located.

Recordings are encrypted and temporarily cached on your device while awaiting upload, including when offline or an upload fails. The temporary recording cache is cleared after upload is confirmed; the app does not keep recordings as long-term local storage. Sessions, profile information and results are synchronized between the app and web application. Signing out does not delete cloud data.

Privacy laws in the United States may differ from those in your jurisdiction. We will take steps to ensure that adequate safeguards are in place to protect your personal information, as described in this Privacy Policy, including contractual mechanisms and other lawful safeguards where applicable. Processing remains subject to applicable law and, for PHI processed on behalf of a Covered Entity, the applicable BAA. Access from outside the United States does not waive rights that cannot lawfully be waived or replace any consent or authorization required by law.

A) Device Settings

We will ask for your permission to access your microphone and notifications where required so that you may use the features of the app. You may opt-out at any time by changing the settings on your mobile device.

B) Access the personal information we hold about you

Upon your written request and successful verification of your identity, we will provide you with a copy of your personal information in an electronic format.

You may submit a data-access request using the app or contact us at support@dentinote.ai. For PHI processed on behalf of a Covered Entity, we assist that Covered Entity with access, amendment and accounting-of-disclosures requests under the BAA. We make information available to the Covered Entity or, as it directs, to the individual or the individual’s designee. If we receive an individual’s request directly, we promptly forward it to the Covered Entity unless applicable law requires us to respond directly; we do not deny an access request on the Covered Entity’s behalf. Identity verification and applicable legal restrictions may affect the information provided.

C) Personal information rights

You may, at any time, withdraw your consent for us to collect, use, disclose or transfer your personal information to third parties. You also have the right to rectify or delete your personal information, or limit the processing of your personal information.

• Processing Time: Upon receipt of your written request, we require reasonable time (depending on the complexity of the request and its impact on our relationship with you) for your request to be processed and for us to notify you of the consequences regarding the same. In general, we shall seek to process your request within thirty (30) calendar days of receiving it.
• Consequences & Feature Requirements: Depending on the nature and scope of your request, you may not be able to access some or all features on Denti Note, and we may have to terminate the Terms of Use we have with you. We will notify you before completing the processing of your request. Should you decide to cancel your request, please inform us immediately.

Please note that:

1. If you choose not to provide us with all the personal information as required to (i) register and access your account, (ii) use the Services, (iii) process your personal information requests or (iv) assist you on other feedback, queries or requests, we may (x) be unable to, or refuse to, process your personal information for any of the purposes stated herein, (y) be unable to (or continue to) perform our contractual obligations owed to you (if any), and/or (z) have to terminate the Terms of Use, without any liability on our part.
2. You may withdraw your consent to using or disclosing your personal information at any time by adjusting the relevant settings on the App or by contacting us, but withdrawing does not affect the lawfulness of the processing before the withdrawal nor our rights to collect such information where (i) such use or disclosure is required by law, (ii) the personal data in question was collected from publicly available sources or (iii) such use or disclosure is necessary in an emergency where the life or health of a person is at risk.
3. You may, by providing us with a notice in writing, limit the processing of your personal information (including to request us to cease or not begin processing your personal information for purposes of direct marketing). If you limit the processing of your personal information, we may not be in a position to continue to administer any arrangement or contractual relationship in place, which in turn may result in: (i) us being unable to (or continue to) process your personal information for any of the purposes stipulated in this Privacy Policy; (ii) unable to (or continue to) perform our contractual obligations owed to you (if any); and/or (iii) the termination of any arrangements/agreements/contracts you have with us, without any liability on our part.
4. Even if you ask us to delete all or some of your personal information, we may still retain some of your data to the extent necessary to comply with applicable legal obligations, resolve disputes, and enforce our agreements, subject to any applicable BAA and restrictions on protected health information. Where required under applicable law, we will explain why we cannot delete particular information.

Under applicable laws, you may have the right to obtain a transferable version of your personal information to transfer to another provider.

To exercise your personal information rights, please contact us according to Section 1 "Contact Us" above. You will not be subject to discriminatory treatment for exercising your rights.

D) Cancelling your subscription plan

You may cancel your paid subscription plan at any time through Apple’s subscription controls. Cancellation does not delete your account or clinical records. Results generated before subscription expiry remain available to view; new generation requires an active entitlement.

E) Deleting your Account, App or Local Data

You may request account deletion through account settings. You can also delete a session; session deletion removes the associated transcript, clinical-note draft, dental chart and derivative documents, without deleting the patient profile or other sessions.

App, web and server records are synchronized and corresponding local caches are cleared.

A) Security

In order to help ensure a secure environment for the Services and safe experience for our users, we are continuously developing and implementing reasonable administrative, technical and physical security measures to protect your personal information from unauthorized use or access and against loss, misuse or alteration.

While we try our best, we cannot warrant the security of any information transmitted to us through or in connection with the Services, that we store on our or our authorised partners' systems.

Any improper collection or misuse of personal information is a violation of this Privacy Policy and our Terms of Use and should be reported to support@dentinote.ai.

B) Use of Data for Analytics and Service Improvement

We limit information used for analytics and service improvement to what is necessary for the purposes described in Section 3. Any use of PHI to maintain, troubleshoot, assess or improve the Services is limited to purposes permitted by the applicable BAA and HIPAA requirements. Where de-identification is required for an intended use, that use may occur only after the information has been de-identified in accordance with the applicable HIPAA standard and the BAA. We do not use PHI to train, fine-tune, improve or refine any AI model, and we do not permit our AI service providers to do so. Nothing in this paragraph independently authorizes a use prohibited by the BAA or applicable law.

C) Personal information retention

Generally, we will store your personal information only for the time period necessary:

1. to fulfil the purposes for which such personal information was collected;
2. for as long as you have an active subscription or active account or as needed to provide you the Services; or
3. as required or permitted by applicable laws (such as tax, accounting, or other legal requirements).

Once we determine that the retention of your personal information is no longer necessary for the above purposes, or that retention is no longer necessary for any legal or business purpose, we will cease to retain your personal information, or anonymise the personal information so that it can no longer be used to identify any particular individual.

Original audio is retained for 30 days from the end of each recording and then automatically deleted. A supplemental recording does not reset the deletion deadline for an earlier recording segment. Denti Note temporarily caches recordings on the mobile device until upload is confirmed and then clears the local cache. Deleting original audio does not by itself delete existing transcripts, clinical-note drafts, dental charts or derivative documents. Other retention periods remain.

We take our responsibilities to the Denti Note community very seriously. We also believe in protecting children's privacy online. The Denti Note app is not meant for use by persons under the age of 18 years old. If you are under the age of 18, please do not use our Denti Note app in any manner. If you are a minor, you may only access and use the Denti Note app with the consent and under the supervision of your parent or legal guardian. Please note that you must be of legal age according to the laws of your home country to make any In-App purchases on Denti Note.

We do not knowingly collect personal information or data from anyone under the age of 18, and the Denti Note app is not directed at children under the age of 18. Any person who provides their personal information to us through our Services explicitly represents that they are 18 years of age or older. If we become aware that someone under 18 years of age has provided us with their personal information, we will promptly delete, remove, or anonymize their information to the extent required by law, except where we are under a legal obligation to retain certain information.

If you are a parent or legal guardian of a minor and wish to review any personal data that we may have collected from your child or ward for security reasons, or request that their Denti Note account or personal information be modified or deleted for security or accuracy reasons, you may contact us at support@dentinote.ai. We will respond to your request after verifying the identities of the relevant user and their parent or legal guardian, and obtaining consent from the relevant user where required by law.

You are responsible for any and all app activity and In-App purchases conducted by a minor on your mobile device using the Denti Note application.

We use Firebase and AppsFlyer to help us understand how Denti Note is used and to improve performance and user experience. These services may collect and analyze certain device and usage data, including mobile identifiers, app usage statistics, and crash reports.

These technologies may function similarly to cookies and may involve the collection of personally referable information under applicable laws. This data may be shared with or accessed by the respective service providers to perform analytics, attribution, or to optimize Denti Note’s performance.

The following state-specific notices supplement the rights and choices described in Section 6 and do not limit any other rights available under applicable law.

We do not sell your personal information, including patient or clinical information, as “sell” or “sale” is defined under applicable U.S. state privacy laws.

A) Notice to California Residents

Under California Civil Code Section 1798.83 (the “Shine the Light” law), California residents who have an established business relationship with us may, where that law applies, request information about the categories of personal information disclosed to third parties for those third parties’ direct marketing purposes during the preceding calendar year, and the names and addresses of those third parties. Where required, the response also includes examples of the products or services marketed by those third parties. To submit a request, email support@dentinote.ai with the subject line “California Shine the Light Request.” We will respond in accordance with applicable law. This notice does not limit any additional rights you may have under other applicable California privacy laws.

B) Notice to Nevada Residents

Consistent with the commitment above, we do not sell covered information as “sale” is defined in Nevada Revised Statutes Chapter 603A. Because Denti Note does not engage in such sales, no opt-out request is required to prevent a sale. Nevada residents may contact support@dentinote.ai with questions about this notice or to submit a verified request where applicable. We will respond in accordance with applicable law.