Compliance and security

Security program overview

Protecting data

• Encryption in transit for all traffic between browsers, our servers and the services we use
• Encrypted storage for the database, its backups and stored files
• A second layer of application encryption on selected sensitive fields: clinical note text, health history answers and insurance member numbers
• Insurance member numbers can be searched only by an exact match against a one-way index, never read in bulk

Identity and access

• Sign-in is handled by a dedicated identity provider (Amazon Cognito); passwords never reach our database
• The long-lived part of a staff session is kept in a secure, HTTP-only cookie that page scripts cannot read
• Every request is checked against the practice and role of the person making it, so one practice can never reach another's records
• Role-based access by job (front desk, doctor, billing, practice admin and others) and by location
• Practices can require their own single sign-on, limited to a domain they prove they own
• Practices can remove a person's access at once, and sessions end when a user signs out

Monitoring and response

• Audit logs of administrative actions and sign-ins
• An append-only log of every time a patient record is opened, kept for six years, with a "Who viewed this patient" view for each practice's privacy officer
• Automated monitoring that flags refused-request bursts, repeated failed sign-ins and unusual patient-record access
• An incident response procedure with defined roles, and breach notification in line with the HIPAA Breach Notification Rule

HIPAA

DenteCure is built for dental practices that are covered entities under HIPAA, and we act as their business associate. In practice that means:

• A practice signs our BAA before any patient information can be added; the Platform asks for it first
• We apply administrative, physical and technical safeguards consistent with the HIPAA Security Rule
• We review our risks and safeguards when the Platform changes materially
• Breach notification follows 45 CFR Part 164, Subpart D

To request our BAA, email sales@dentecure.com with the subject line "BAA Request".

Certifications

We design our controls around widely used security frameworks covering security, availability, confidentiality and processing integrity. DenteCure does not currently hold a SOC 2 report or any other third-party certification, and nothing on this page claims one. Practices that need security documentation for their own reviews can contact us.

Insurance and claims transactions

DenteCure's revenue cycle features exchange electronic transactions that follow HIPAA's Electronic Transactions and Code Sets standards (45 CFR Part 162):

• Eligibility checks (270/271) through a certified health care transaction partner
• Claims (837D) through a certified clearinghouse
• Remittance advice (835) received from payers and matched to claims and patients
• Claim status checks (276/277) for outstanding claims

Transaction records are kept for audit. We work to transmit every transaction to the standards HHS has adopted, but we cannot guarantee the accuracy of data supplied by payers or clearinghouses.

Payment security

DenteCure never stores, processes or transmits card numbers itself. Payments are handled by our payment processor, Stripe, which returns a token in place of the card, so card data never reaches our systems. Practices should review Stripe's own security documentation for its certifications.

Service providers

We use a small number of providers that may process customer data. Each is bound by written terms that protect that data, and we require a business associate agreement from any provider that handles protected health information. They are:

• Amazon Web Services: hosting, database, file storage, sign-in, telephone and contact center, text messages, email delivery and AI services, in the United States
• Stripe: subscription and patient payments
• Stedi: insurance eligibility and electronic claims
• Microsoft 365: DenteCure's business email
• Google: optional sign-in for patients, and calendar sync when a practice turns it on

We review a provider before we start using it and when its terms change, and we will update this list before adding a provider that handles patient information.

Backups and recovery

• The database is backed up automatically every day, with point-in-time recovery for the last seven days
• Deletion protection prevents the production database from being removed by mistake
• Planned maintenance that affects practices is announced in advance by email or in the Platform

We aim to restore core services within hours of an incident, but recovery times depend on the nature of the incident and are goals, not guarantees. Any availability commitment is set out in a signed subscription agreement.

Our team

• Access to production systems is limited to a small number of named people, granted on least privilege and removed when no longer needed
• Administrative access to cloud systems uses separate credentials from the application, and the application runs with only the permissions it needs
• Code changes are reviewed and automatically tested before they reach the Platform
• Security policies are reviewed at least once a year and whenever the Platform changes materially

What practices are responsible for

Security is shared. DenteCure secures the Platform; each practice remains responsible for:

• Its own user accounts and roles, and removing access promptly when someone leaves
• Getting and keeping the patient consents that texting and call recording require under HIPAA, the TCPA and state law
• Signing the BAA before entering patient information
• Following the laws and rules that govern its practice and communications
• Keeping its own devices and networks secure
• Reporting suspected security incidents to us promptly

Reporting a security concern

We welcome responsible disclosure. If you find a possible vulnerability in DenteCure:

• Email sales@dentecure.com with the subject line "Security Vulnerability Report"
• Describe the issue, how to reproduce it and its possible impact
• Do not access other people's data, and give us reasonable time to fix the issue before disclosing it

We aim to acknowledge reports within two business days and to give an update within ten business days. We do not currently run a bug bounty program.

Governance

DenteCure has designated a Privacy Officer and a Security Officer responsible for this program. We review our policies and risks at least once a year and when the Platform or the threats it faces change, and we update this page within a reasonable time of any material change.

Disclaimer

This page describes our approach as of the date shown above. Security practices change as threats and technology change, and no security program can prevent every unauthorized access or breach. Our contractual obligations are governed solely by the agreements we sign with each practice, and this page does not create or change them.