1. Who we are
Orthoram ("Orthoram", "we", "us") publishes the Orthoram app, an orthodontic practice-management tool for licensed orthodontists and their staff, and the website at orthoram.app.
The clinic is the data controller. The clinic that enters a patient record decides what is recorded, who on its staff may see it, and when it is deleted. Orthoram acts as a processor (and, under HIPAA, as a business associate) and handles that data only on the clinic's instructions. This policy covers both the data we process for a clinic and the small amount of account data we hold about the clinic itself.
Orthoram is a tool for clinics, not a service for patients. Patients do not create accounts and are never asked to install the app.
2. Data we collect
2.1 Account data
When a clinic signs up we hold the doctor's or owner's name, email address, clinic name, country, chosen plan, and authentication records (a hashed password and session tokens, managed by our identity provider). We do not receive a plaintext password.
2.2 Clinical data entered by the clinic
On the clinic's instruction, the app stores the records the clinic creates:
- Patient identity and contact details (name, age or date of birth, gender, phone).
- Clinical records: diagnoses, treatment plans, appliance and arch-wire choices, stage progress, bonding and bracket-failure notes, odontogram and bite findings.
- Progress photographs and case media.
- Appointments, staff and room scheduling, service catalogue.
- Financial ledger entries, installment plans and payments recorded by the clinic.
- Optional voice notes recorded on the clinician's device.
Some of this is health information about a patient, including a minor. It therefore also falls under Section 8 (HIPAA posture) and Section 9 (minors).
2.3 Where clinical data is held depends on the plan
Free plan: local only. Records stay on the clinic's own device in an encrypted local database. We do not receive them, cannot read them, and cannot recover them if the device is lost and the clinic holds no backup.
Paid plans: cloud sync. Records are synchronised to our cloud database under the clinic's account, so several devices and staff members can work on the same case. Uploaded images and case media are stored in object storage, addressed by clinic-scoped keys.
Upgrading from Free to a paid plan copies the records that exist on the device into the clinic's cloud account. Downgrading does not delete cloud records unless the clinic asks for deletion.
2.4 Technical and diagnostic data
We record sign-in and permission events in an audit log, and we receive crash and error reports when the app fails. Crash reports are filtered before they leave the device: a redaction layer removes patient identifiers, names, free-text clinical notes and file paths, so a report describes a failure without describing a patient. Push notification delivery requires a device messaging token.
2.5 What we do not do
- We do not sell clinic or patient data, and we do not share it for advertising.
- The app contains no advertising SDK and no third-party behavioural tracking.
- We do not use clinic data to train machine-learning models.
- We do not read patient records for our own purposes; support access is granted only with the clinic's consent and is logged.
3. How we use data
- To operate the app: sign the clinic in, sync records, store media, show the roster, case snapshot and ledger.
- To deliver the features the clinic switched on, including appointment and account emails and push notifications.
- To keep the service secure: authenticate sessions, enforce per-clinic isolation, detect abuse and maintain audit trails.
- To diagnose failures: read redacted crash reports and fix the defect.
- To bill a paid plan and to answer a support request the clinic raised.
- To meet legal obligations, including responding to a lawful request addressed to the clinic.
We do not use clinical data for marketing. We contact the clinic at its account email about service changes, security notices and billing; promotional email is separate and can be refused.
4. Storage and security
Encryption at rest. The on-device database is encrypted with SQLCipher (AES-256). Cloud records and media are stored in provider storage that encrypts data at rest. Backups inherit the same encryption.
Encryption in transit. Every network call uses TLS. Media is never fetched with a long-lived credential: the app asks our signing Worker for a short-lived presigned URL, and the storage credentials themselves live in the Worker's secret store, never in the app.
Clinic isolation. Cloud rows carry the clinic they belong to, and row-level security in the database restricts every read and write to the signed-in clinic. Isolation is enforced by the database, not by the screen the user happens to be on, so one clinic cannot reach another clinic's patients even through a crafted request.
Access control and audit. Staff roles decide which records a user may open. Sign-in, permission changes and record access are written to a protected audit log, and audit records cannot be edited from the app. A configurable automatic logoff, plus biometric unlock, limits exposure when a device is left unattended.
Operational controls. Production access is limited to named operators, secrets are held in the platforms' secret stores rather than in the repository or the app, and changes to the database schema are versioned and reviewed before they run.
No system is perfectly secure. If we become aware of a breach affecting clinic data we will notify the affected clinics without undue delay, with what we know, what we are doing, and what the clinic must do.
5. Third-party services
We use a small set of infrastructure providers. Each receives only the data needed for its function, acts on our instructions, and is bound by a data-processing agreement.
| Provider | Purpose | Data it handles |
|---|---|---|
| Neon | Postgres database and identity (authentication) for paid plans | Cloud-synced clinic records; account email, hashed password, sessions |
| Backblaze B2 | Object storage for photos and case media | Images and attachments, under clinic-scoped keys, reached only by short-lived presigned URL |
| Cloudflare | Hosting, CDN and the media-signing Worker | Web traffic, this website, request metadata; the Worker holds storage credentials and mints presigned URLs |
| Sentry | Crash and error reporting, only when enabled for a build | Redacted crash reports — no patient identifiers or clinical free text |
| Resend | Transactional email, including password reset | Recipient address and the content of the service email |
| Firebase Cloud Messaging | Android push notification delivery | Device messaging token and the notification payload |
| Google Play | App distribution and, where applicable, subscription billing | Install and purchase records held by Google; Orthoram does not receive card details |
We may disclose data if a competent authority compels it. Where the request concerns a clinic's patients we will direct the requester to that clinic, and we will tell the clinic unless we are legally barred from doing so. If Orthoram is ever merged or acquired, clinic data would move under the same terms and clinics would be told before the change took effect.
Infrastructure is hosted in data centres operated by these providers, which may be outside the clinic's country. Transfers rely on the providers' standard contractual clauses or equivalent safeguards.
6. Retention
Cloud records are kept while the clinic's account is active. When a clinic asks for deletion, the account, its records and its media are removed, and the deletion is completed within 30 days. Copies in rolling provider backups may persist for a further short period before ageing out; they are not used for any other purpose.
Some records must be kept longer to meet legal or professional-record obligations, such as financial records for tax purposes or a clinical record the clinic is required to retain. Where that applies we keep only what the obligation requires and nothing else.
Data on a Free-plan device is controlled entirely by the clinic: uninstalling the app or clearing its data removes it, and we hold no copy.
7. Your rights
A clinic, and through the clinic an individual patient, may ask us to act on the data we hold. Because the clinic is the controller, a patient request should normally be addressed to the clinic; we assist the clinic in answering it.
- Access and export. A clinic can request a copy of its account data and its clinical records in a machine-readable export. Contact us and we prepare it; there is no self-service export button in this release.
- Correction. Records can be corrected in the app by the clinic. Where a correction is not possible in the app, ask us and we will apply it.
- Deletion. A clinic can ask for its account and all associated records and media to be deleted. See Section 6 for timing and the narrow legal exceptions.
- Restriction and objection. A clinic can ask us to stop a particular processing activity, for example marketing email or non-essential diagnostics.
- Portability. An export is provided in a structured, commonly used format so it can be imported elsewhere.
- Complaint. A clinic may complain to us first, and also to its local data-protection authority.
Deleting your account
Email support@orthoram.app from the address registered to the clinic with the subject "Account deletion request". We confirm receipt, verify control of the account, and delete the account, its records and its media within 30 days. Records the clinic is legally required to retain are the only exception, and we tell you which ones before deleting anything else.
We answer a verified request within 30 days, and we do not charge for it.
8. HIPAA posture
Orthoram is built to help a clinic meet its HIPAA obligations. We treat ourselves as a business associate of the clinics that use the paid cloud plans, and we apply the HIPAA Security Rule's technical safeguards as engineering requirements rather than options:
- Unique user identification and role-based access control, with no shared logins.
- Encryption of data at rest and in transit, without an off switch.
- Audit controls that record access to protected health information and cannot be edited from the app.
- Automatic logoff and device-level authentication.
- Per-clinic isolation enforced by the database, so a misdirected request cannot cross clinics.
- Transmission security through short-lived, scoped media URLs and TLS.
These controls are permanent: they cannot be disabled by a user or by an administrator.
What we do not claim. Orthoram does not claim HIPAA certification, because no such certification exists, and this page is not a representation that every administrative and contractual requirement is already satisfied for every deployment. A business associate agreement is available to clinics and is required before protected health information is processed on a paid plan. As of the effective date we are finalising business associate agreements with our infrastructure subprocessors; until a clinic's own BAA and the relevant subprocessor agreements are executed, the clinic should treat the service as not yet suitable for live protected health information. Ask us for the current status before you migrate real patients.
Where a clinic operates outside the United States, the same controls are offered as the baseline, and the clinic remains responsible for its own local obligations.
9. Minors
Most orthodontic patients are children or adolescents. Their records are created by the clinic, which is responsible for obtaining the consent required from a parent or guardian before recording the patient's information, and for deciding what may be shared with the patient. Orthoram does not create accounts for minors and does not market to them.
10. Changes to this policy
We update this page when the way we handle data changes. The version and effective date are shown at the top. A change that materially affects how clinic data is handled is announced to clinics by email before it takes effect, and continued use of the app after the effective date means the updated policy applies.
This policy is published in English and that version governs. A translation can be provided on request.
11. Contact
Questions about this policy, a data request, or a security concern:
Orthoram · orthoram.app