Privacy policy

Version 1.4 — September 30, 2026. This policy is accepted electronically when the account is created. The accepted version, with its date and time, is recorded on the platform. This is a courtesy translation: the Spanish version is the authentic one and prevails in case of discrepancy.

1. Who is the data controller

The controller for personal data collected through this site and the Dently platform is:

• Carlos Frederick Díaz Sánchez (individual — self-employed), operating under the trade name Dently.
• Tax ID (NIF): 02336521C.
• General contact: support@dently.es.
• Privacy and exercise of rights: privacy@dently.es.

Hereinafter, "Dently", "we". You can also review ourLegal notice.

2. What data we process

Dently processes two distinct types of data:

2.1 Data of professionals and clinics that hire Dently

• Identification data: first name, last name, email, phone.
• Professional data: clinic name, role, specialty.
• Billing data when applicable.
• Platform usage data (logs, IP address, browser).

2.2 Patient data managed by clinics

When a clinic uses Dently, it stores and manages patient data (identification, contact, appointments, clinical notes, etc.). For this processing Dently acts as adata processor; the controller is always the contracting clinic. The relationship is governed by theData processing agreement, accepted electronically when the account is created.

Clinical notes and any other information about the patient's health are aspecial category of personal data under article 9 of the GDPR. The clinic, as data controller, is responsible for obtaining the patient's explicit consent or applying the corresponding legal basis under article 9.2 (for example, provision of healthcare) and for maintaining its own privacy notice to the patient. Dently, as data processor, applies enhanced security measures (encryption in transit, encrypted backups, role-based access control and audit trails of activity on the clinical schedule) and processes this data only following the clinic's instructions. The full and up-to-date detail of these measures, including their limitations, is set out in Annex I of theData Processing Agreement.

3. What we use the data for

• To provide the contracted appointment, patient and doctor management service.
• To respond to demo requests, queries and technical support.
• To send operational communications about your account.
• To comply with legal obligations (tax, accounting, etc.).
• To improve the product based on aggregated and anonymized information.
• To measure the effectiveness of our advertising campaigns (e.g. which ad led to a demo request or sign-up), only if you accept marketing cookies.
• To analyze, in aggregate, how the website is used so we can improve it (Google Analytics), only if you accept analytics cookies.

4. Legal basis

The processing described is based on contract performance (when you are already a customer or have requested information), consent (when you voluntarily fill out a form) and compliance with legal obligations. For patient data, the legal basis lies with the clinic acting as data controller.

The use of cookies and advertising measurement technologies (Google Ads) and analytics (Google Analytics) is based solely on your consent, which you can grant or withdraw at any time from the "Cookie settings" link in the footer. If you do not grant it, these technologies store no identifiers on your device.

5. Who we share your data with

We only share personal data with vendors we need to operate the service, always under contract and with adequate security guarantees:

• Hetzner Online GmbH — server and database hosting.
• Cloudflare, Inc. — backup storage (R2), content delivery network and security services.
• Resend, Inc. — transactional email delivery.
• Stripe Payments Europe, Ltd. — subscription payment processing, when applicable.
• WhatsApp Ireland Limited (Meta group) — WhatsApp messaging to patients, only when the clinic connects its WhatsApp number to Dently.
• Google Ireland Limited — advertising conversion measurement (Google Ads) and website usage analytics (Google Analytics), only per the cookies you accept (marketing and/or analytics).

Every vendor is bound by a data processing contract with adequate security measures. The list is kept up to date and can be checked at any time. We do not sell or share personal data with third parties for commercial purposes.

6. International transfers

The main hosting of the platform and the database is in the European Union (Hetzner Online GmbH, Germany / Finland), with no international transfer. Some of the vendors listed in section 5 process data in the United States. Each of those transfers relies on the Standard Contractual Clauses approved by the European Commission (Decision 2021/914, article 46.2.c GDPR) and, where the vendor is certified, on the EU-U.S. Data Privacy Framework (European Commission adequacy decision of July 10, 2023, article 45 GDPR). Detail per vendor:

Vendor	Processing country	Purpose	Transfer safeguard
Cloudflare, Inc.	United States	Content delivery network and protection of the website and the platform; storage of encrypted backups (R2)	Standard Contractual Clauses incorporated in its Data Processing Addendum + certification under the EU-U.S. Data Privacy Framework
Resend, Inc.	United States	Sending transactional emails (account verification, password reset, account notices) and the patient communications configured by the clinic	Standard Contractual Clauses incorporated in its Data Processing Agreement + certification under the EU-U.S. Data Privacy Framework
Stripe Payments Europe, Ltd., with transfers to Stripe, LLC	Ireland, with transfers to the United States	Subscription collection and billing of the service (the clinic's billing data; Dently does not store full card details)	Standard Contractual Clauses incorporated in its Data Processing Agreement + certification of Stripe, LLC under the EU-U.S. Data Privacy Framework
WhatsApp Ireland Limited (Meta group), with transfers to WhatsApp LLC and Meta Platforms, Inc.	Ireland, with transfers to the United States	Sending and receiving WhatsApp messages to patients (appointment reminders and notices), only when the clinic connects its WhatsApp number to Dently. Accesses the phone number, the message content and delivery metadata	Standard Contractual Clauses (processor-to-processor module) incorporated in its WhatsApp Business Data Transfer Addendum + certification of WhatsApp LLC and Meta Platforms, Inc. under the EU-U.S. Data Privacy Framework
Google Ireland Limited, with transfers to Google LLC	Ireland, with transfers to the United States	Advertising conversion measurement (Google Ads) and website usage analytics (Google Analytics), only if you accept marketing and/or analytics cookies	Standard Contractual Clauses incorporated in its data processing terms + certification of Google LLC under the EU-U.S. Data Privacy Framework

You can obtain a copy of the applicable safeguards by writing toprivacy@dently.es, or review them in each vendor's public documents (for example, Google'sprivacy policy). For patient data, the same list of vendors, with their role regarding the processing and their safeguard, is set out in Annex II of theData Processing Agreement.

7. How long we keep your data

We keep data while you have an active account or there is an ongoing contractual relationship. Retention periods by category:

• Account and operational data: while your account is active. After cancellation, it is anonymized or deleted within a maximum of 30 days.
• Trial clinics that do not activate the subscription: 30 days after the trial ends we email the owner and, 30 days later, the clinic and all its data are deleted. Until then it can be downloaded.
• Billing and accounting data: 6 years from issuance, per applicable tax and accounting regulations.
• Patient clinical records: retention is determined by the clinic as data controller under the healthcare regulations applicable in its country (in Spain, between 5 and 15 years from the discharge of each episode of care depending on regional law). Dently keeps the data for the entire period as instructed by the clinic.
• Data for the defense of legal claims: during the limitation periods of any applicable legal actions.

8. Your rights

You can exercise your rights of access, rectification, deletion, opposition, restriction and portability anytime by writing toprivacy@dently.es. You can also file a complaint with the Spanish Data Protection Agency (www.aepd.es) or with your local supervisory authority in the EU/EEA, if you believe your rights have not been properly addressed.

9. Changes to this policy

We may update this policy when features, vendors or legal requirements change. The last update date appears at the top of the document. For significant changes we will notify you by email or from within the platform itself.

Version history

• Version 1.4 — September 30, 2026: section 7 with the retention period for trial clinics that do not activate the subscription.
• Version 1.3 — September 7, 2026: section 6 rewritten with the full list of international transfers (entity, country, purpose and safeguard) for Cloudflare, Resend, Stripe, WhatsApp/Meta and Google, EU hosting declared as no transfer, and WhatsApp Ireland Limited added to section 5.
• Version 1.2 — August 30, 2026: Cloudflare and Resend international transfers stated expressly, clinical record retention computed from the discharge of each episode of care, and reference to the supervisory authority of your country of residence.
• Version 1.1 — August 4, 2026: security measures description aligned with Annex I of the Data Processing Agreement.
• Version 1.0 — July 27, 2026: first published version.