DentalSlip Privacy Notice Version 2026-10-13 This notice describes how the DentalSlip website and product handle information. It is not a HIPAA notice of privacy practices for a dental office. Each practice remains responsible for its own patient notice. Marketing site. We collect what you type into the contact form: your email, a subject, and a message. Do not include patient information. We store that message so we can reply. We do not run advertising pixels on referral forms. Accounts. We store the owner’s name, work email, password hash, office profile, and security log. Passwords are hashed with Argon2id. Authenticator secrets are encrypted. Recovery codes are stored only as hashes. Referrals. A referring office submits patient and clinical details into the receiving office’s account. That information is used to show the inbox, print a PDF, and tell verified staff that a referral arrived. Notification email does not include patient names, reasons, or files. Web addresses do not include patient details. Payments. Card numbers are collected by the payment processor on its hosted page. We store a customer id and subscription status. We do not send referral contents to the processor. Cookies. The signed-in product uses a secure session cookie and a matching token to prevent cross-site requests. Public referral forms do not require an account cookie. Retention. UCPlaces LLC keeps submitted referrals for the period the office chooses: 1 year, 3 years (the default), 7 years, or no automatic cleanup. The period runs from the submission date and covers the submission, attachments, notes, and status history. DentalSlip is not the office’s chart. When a subscription ends or the BAA is terminated, forms stop taking new submissions and the office has 90 days of read-only access to export. Automatic cleanup pauses during those 90 days. Unpaid or disputed fees do not turn off that access or export. On day 90 the remaining referral content is deleted. Backups of deleted content expire within 7 days. A deletion record lists the office, the categories deleted, and the date, without the referral content. Acceptance records, deletion records, disclosure accounting, and security logs are kept for 6 years and then removed. Contact. Use the contact page for privacy questions. Do not send patient records by email.