Privacy Policy

1Personal Information We Collect

When you browse through our Website, subscribe to our newsletter, log in to our Platform, or otherwise use any of our Services, we may collect, process, or store your personal information including, without limitation and where applicable, the information described below. All personal information that you provide to us must be true, complete, and accurate. Please keep in mind that you do not need to provide us with any personal information to browse through our Website. However, we may still automatically collect certain information as described below.

• Account Information: your name, email address, phone number, mobile number, physical address, professional credentials, specialty, clinic or organization name, and related professional details.
• Patient Data: dental radiographs (including lateral cephalometric X-rays), intraoral and extraoral photographs, patient identifiers, age, gender, and clinical notes as provided by the healthcare Provider.
• Analysis Data: landmark positions, cephalometric measurements, analysis results, tracing data, treatment plans, and generated reports.
• Usage Data: log data, access times, pages and features accessed, referring URLs, actions performed within the platform, and interaction patterns.
• Device and Technical Information: browser type and version, operating system, device identifiers, IP address, screen resolution, time zone, language preferences, and cookie data.
• Payment Information: billing name, billing address, and payment method details. Note: full payment card numbers are processed directly by our secure third-party payment processors and are never stored on our servers.
• Communication Data: support tickets, emails, feedback forms, chat transcripts, and any other correspondence with our team.
• Demographic Information: if at any time you are requested to provide demographic information, please note that providing such information is always voluntary and your refusal to provide it shall not negatively impact your Services.

Personal information does not include information that has been irreversibly anonymized or aggregated in a manner which no longer enables anyone, whether in combination with other information or otherwise, to identify you. When you contact us by email or through the platform, we may keep a record of the correspondence.

2Patient Data Processing

As a platform serving healthcare providers, we process patient dental imaging and related health information. In this context, the healthcare Provider acts as the Data Controller — determining the purposes and means of processing — and zCeph acts as the Data Processor, processing patient data on behalf of and in accordance with the instructions of the Provider. We do not have a direct relationship with patients and rely solely on Providers to secure appropriate consent and legal basis for data processing.

• Data Controller: The healthcare Provider who uploads patient data determines the purposes and means of processing. The Provider's own privacy policy governs the collection and use of patient data.
• Data Processor: zCeph processes patient data on behalf of the Provider, solely for the purpose of delivering the cephalometric analysis Services as instructed.
• Patient Consent: The Provider is solely responsible for obtaining all necessary consents, authorizations, and legal bases from patients (or their legal guardians) before uploading their data to the platform.
• Processing of Minor's Data: The Platform is designed to process dental imaging data of patients of any age, including minors. If processing data for a minor patient, the Provider represents and warrants that they have obtained legally valid consent from the minor's parent or legal guardian, in accordance with all applicable laws.
• Data Minimization: We only process patient data that is necessary for the requested analysis services and platform functionality.
• Purpose Limitation: Patient data is processed solely for providing cephalometric analysis services as instructed by the Provider and is not used for any unrelated or unauthorized purposes.
• Business Associate Agreements: Where applicable, we process PHI (Protected Health Information) in accordance with applicable healthcare data regulations and may enter into Business Associate Agreements (BAAs) or Data Processing Agreements (DPAs) with Providers as required.
• No Direct Patient Relationship: We do not have a direct relationship with patients. All communications regarding patient data should be directed to the healthcare Provider.

We may use fully anonymized and de-identified data — which cannot be used to identify any individual patient — for research, development, improvement of our AI models and algorithms, and enhancement of our Services. The Provider is responsible for ensuring that such anonymization complies with applicable legal requirements.

3How We Use Your Information

We will use your personal information in order to comply with our contractual obligations, to supply to you the services that you have purchased, to contact you with information relating to the delivery of the services, and to deal with any requests, questions, comments, or complaints you have. We may also use your personal information for our legitimate interests, including improving our Services, enforcing our Terms, ensuring platform security, and for regulatory and legal compliance purposes.

• Providing, operating, and maintaining the cephalometric analysis platform and all related Services.
• Processing dental images, detecting anatomical landmarks, performing cephalometric calculations, and generating analysis reports.
• Training, validating, and improving our AI landmark detection algorithms and analysis models (using anonymized and de-identified data only).
• Managing your account, authenticating your identity, and providing customer support.
• Processing payments, managing subscriptions, and handling billing inquiries.
• Sending service-related notices, including security alerts, maintenance notifications, platform updates, and administrative messages.
• Analyzing usage patterns, feature adoption, and user behavior to improve the user experience and platform performance.
• Complying with legal obligations, responding to lawful requests, and enforcing our Terms of Service.
• Preventing fraud, unauthorized access, abuse, and other harmful or illegal activities.
• Conducting research, development, and testing for new features, capabilities, and improvements.
• Personalizing your experience by remembering your preferences, settings, and analysis configurations.

4Marketing Communications

It is necessary for our legitimate interests to use your contact information to send you marketing communications, which may include newsletters, blog posts, product updates, educational content, webinar invitations, and information about new features and services. Marketing communications are sent only to users who have provided applicable consent or where we have a legitimate basis to do so.

• You can choose to opt out of receiving marketing communications at any time by clicking the "unsubscribe" link in any marketing email.
• You may also contact us at [email protected] to update your communication preferences.
• If you do unsubscribe from marketing communications, it may take up to five (5) business days for your new preferences to take effect.
• Opting out of marketing communications does not affect service-related communications, such as security alerts, billing notices, maintenance notifications, and other operational messages that are essential to the provision of the Services.
• We shall retain your personal information for marketing purposes until you notify us that you no longer wish to receive marketing communications from us.

5Data Storage and Infrastructure

We use industry-standard cloud infrastructure to securely store and process your data. All information you provide to us is stored on secure cloud servers with comprehensive physical and digital security measures. Our infrastructure is designed for high availability, durability, and disaster recovery.

• Data is stored on secure cloud servers with geographic redundancy and automated backup systems.
• All data transmissions between your browser and our servers are encrypted using TLS/SSL protocols (TLS 1.2 or higher).
• Database records containing personal information and patient data are encrypted at rest using AES-256 encryption.
• Regular automated and manual backups are performed to prevent data loss, with backup data also encrypted.
• Access to servers, databases, and data stores is restricted to authorized personnel only, following the principle of least privilege.
• We maintain comprehensive disaster recovery and business continuity plans to ensure data availability.
• Server infrastructure is monitored 24/7 for performance, availability, and security anomalies.

6Data Security Measures

We process your personal information in a manner that provides appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical and organizational measures. While we take commercially reasonable steps designed to protect your personal information, you acknowledge that no system can be completely secure. Therefore, although we take these steps seriously, we do not and cannot promise that your personal information will always remain completely secure.

• End-to-end encryption for all data in transit using TLS 1.2+ with strong cipher suites.
• AES-256 encryption for all sensitive data at rest, including patient imaging and analysis results.
• Multi-factor authentication (MFA) options available for account access to enhance security.
• Regular security audits, vulnerability assessments, and penetration testing by qualified security professionals.
• Role-based access control (RBAC) implementing the principle of least privilege across all systems.
• Automated intrusion detection and prevention systems (IDS/IPS) with 24/7 monitoring.
• Secure software development lifecycle (SDLC) practices, including code review and security testing.
• Employee security awareness training and background verification for personnel with access to sensitive data.
• Incident response plan with defined procedures for detecting, responding to, and recovering from security incidents.
• Regular data backup and recovery testing to ensure data integrity and availability.

While we implement commercially reasonable security measures, the transmission of information via the internet is not completely secure. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures employed by the Services by third parties.

7Sharing Personal Information

We will never sell, rent, or trade your personal information to any third party. We will not share your personal information with third parties except in the limited circumstances described below. All third-party service providers with whom we share information are contractually required to maintain the confidentiality and security of the information and to use it only for the purposes for which it was disclosed.

• With our employees, service providers, sub-contractors, and agents that we appoint to perform functions on our behalf, including cloud hosting providers, email service providers, payment processors, analytics providers, IT service providers, accountants, auditors, and legal counsel.
• With healthcare Providers as Data Controllers, when we have collected or processed information on their behalf in our capacity as Data Processor.
• Under certain circumstances where we may be required to disclose your personal information under applicable laws and/or regulations, for example, in response to lawful requests by public authorities, to comply with court orders, or to protect our legal rights.
• To protect the rights, property, or safety of the Company, our users, patients, or the public, including for fraud prevention and security purposes.
• In connection with, or during negotiations of, any merger, sale of assets, consolidation, restructuring, financing, or acquisition of all or a portion of our business by or into another company, provided that affected users are notified.
• With your explicit consent for purposes stated at the time consent is obtained.

We conduct due diligence on our third-party service providers' data protection practices and require them to implement appropriate security measures. We enter into Data Processing Agreements (DPAs) with service providers that process personal data on our behalf.

8Cross-Border Transfer of Personal Information

We may share personal information with our employees, consultants, and third-party service providers outside your country, but only for the purposes of performing the services for which you provided your personal information. These countries may not offer a level of protection for your personal information that is equivalent to the one offered in your country of residence. When we transfer data internationally, we implement appropriate safeguards to ensure your data receives adequate protection.

• We use Standard Contractual Clauses (SCCs) or other approved transfer mechanisms for international data transfers where required by applicable law.
• We ensure that all data recipients in third countries provide adequate levels of data protection consistent with applicable regulations.
• We will obtain your explicit consent before using your personal information for purposes other than performing the services for which it was originally provided.
• For EU and Swiss users: information may be transferred outside the European Economic Area (EEA) and Switzerland. In such cases, we rely on approved contractual clauses, binding corporate rules, or other lawful transfer mechanisms.
• Transfers are made only for the purpose of performing the Services and related operational functions.

9Cookies and Tracking Technologies

A cookie is a small text file containing a unique identification number that is transferred (through your browser) from a website to your device. Our Website and Platform use cookies so that we can recognize you when you return and personalize your settings and preferences. Most browsers are initially set up to accept cookies. You can change your browser settings to either notify you when you have received a cookie or to refuse to accept cookies. Please note that certain features of our Services may not function properly if you refuse to accept cookies.

• Essential/Functional Cookies: Required for platform operation, including authentication, session management, security tokens, and remembering your login state. These cookies are strictly necessary and cannot be disabled.
• Analytics Cookies: Help us understand how users interact with the platform by collecting usage data anonymously. We use these to improve performance, identify popular features, and optimize the user experience.
• Preference Cookies: Remember your settings and preferences such as language selection, theme (dark/light mode), layout preferences, and analysis method defaults.
• Session Cookies: Temporary cookies that remain only until you close your browser or log out.
• Persistent Cookies: Remain on your device for longer periods (as specified by each cookie's lifetime) to remember your preferences across visits.
• You can control cookie settings through your web browser's preferences. You can delete cookies, block specific types, or configure notifications for when cookies are set.
• Disabling essential cookies will impair core platform functionality including authentication and security features.

We do NOT use advertising or remarketing cookies. We do NOT use cookies for targeted advertising purposes. Our cookies are used solely for platform functionality, security, and analytics. We may use cookies to limit certain types of cyberattacks and for fraud prevention.

10Analytics Services

We may use third-party analytics service providers to monitor and analyze the use of our platform. These services collect information anonymously and generate reports detailing usage patterns including the number of visits, visitor geography, session duration, and pages visited. The data collected by analytics services does not personally identify you.

• Google Analytics: a web analytics service offered by Google that tracks and reports website traffic anonymously. Google Analytics places cookies on your device to collect usage data. Google uses this data to track and monitor the use of our Services. For more information on Google's privacy practices, visit: https://policies.google.com/privacy. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.
• Error tracking and application performance monitoring services that help us identify, diagnose, and resolve technical issues to maintain platform reliability.
• Server-side logging for security monitoring, audit trails, and compliance purposes.
• We do not share any personally identifiable information with analytics providers.

11Your Data Protection Rights

Depending on your jurisdiction and applicable law, you may have certain rights regarding your personal information. We are committed to respecting and facilitating the exercise of these rights. You have the right to obtain from us a copy of the personal information that we hold, and to require us to correct errors in the personal information if it is inaccurate or incomplete, or to limit or object to its processing, partially or entirely. You also have the right at any time to require that we delete your personal information or transfer it to a third party. To exercise these rights, please contact us at [email protected].

• Right to Access: Obtain confirmation of whether we process your personal data and, if so, request a copy of the data we hold about you.
• Right to Rectification: Request correction of inaccurate personal data or completion of incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data, subject to applicable legal retention requirements.
• Right to Restriction of Processing: Request that we restrict or limit the processing of your personal data under certain conditions.
• Right to Data Portability: Receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Right to Object: Object to the processing of your personal data based on our legitimate interests, or to processing for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, withdraw that consent at any time without affecting the lawfulness of processing done prior to withdrawal.
• Right to Lodge a Complaint: File a complaint with a supervisory authority if you believe our processing of your personal data violates applicable data protection law.

Please note that we reserve the right to charge an administrative fee if your request is manifestly unfounded or excessive. Individual data subject requests will be completed as soon as possible following their receipt and in any event within thirty (30) days from our confirmation. Some rights may be subject to limitations as provided by applicable law, and our ability to uphold these rights may depend on our obligations for security, fraud prevention, compliance with regulatory or legal requirements, or because processing is necessary to deliver the services you have requested.

12GDPR Rights (European Economic Area Users)

If you reside within the European Economic Area (EEA), our processing of your personal information is additionally subject to the General Data Protection Regulation (EU) 2016/679 ("GDPR"), notwithstanding anything to the contrary herein. We process your data on the following legal bases:

• Consent (Article 6(1)(a)): Whenever we require your consent for the processing of your personal information, such processing will be justified pursuant to Article 6(1)(a) of the GDPR.
• Performance of a Contract (Article 6(1)(b)): If the processing of your personal information is necessary for the performance of a contract between you and us, or for taking pre-contractual steps upon your request.
• Legal Obligation (Article 6(1)(c)): Where the processing is necessary for us to comply with a legal obligation under EU or member state law.
• Legitimate Interests (Article 6(1)(f)): Where the processing is necessary for the purposes of our legitimate interests, such processing will be made in accordance with Article 6(1)(f), balanced against your fundamental rights and freedoms.
• You may make a GDPR complaint to the relevant Supervisory Authority. A list of Supervisory Authorities is available at: http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm
• For transfers of EEA personal data outside the EEA, we implement Standard Contractual Clauses as adopted by the European Commission, or rely on other approved transfer mechanisms.
• We maintain records of our processing activities as required by Article 30 of the GDPR.

13California Privacy Rights (CCPA/CalOPPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Online Privacy Protection Act (CalOPPA). To the extent applicable to you, we comply with CalOPPA and CCPA requirements.

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of your personal information that we have collected from you, subject to certain exceptions.
• Right to Opt-Out: If we sold personal information (we do NOT sell personal information), you would have the right to opt out of such sales.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.
• We do NOT sell personal information to third parties. We do NOT sell the personal information of minors under 16 years of age.
• Users can visit our site anonymously. Our Privacy Policy link includes the word "Privacy" and can easily be found on our website.
• Users will be notified of any privacy policy changes on our Privacy Policy page.
• Users are able to change their personal information or request deletion by emailing us at [email protected].

14"Do Not Track" Signals

We honor Do Not Track (DNT) signals and do not track users, plant advertising cookies, or use targeted advertising when a Do Not Track browser mechanism is in place. Do Not Track is a preference you can set in your web browser to inform websites that you do not want to be tracked. You can enable or disable Do Not Track by visiting the Preferences or Settings page of your web browser.

15Children's Data Protection

The Services are intended for use by dental and medical professionals who are at least eighteen (18) years of age. We do not knowingly collect personal information directly from individuals under the age of 18. Our Platform is designed to process patient dental imaging data, including that of minors (e.g., pediatric dental patients), which is provided to us by healthcare Providers — not collected directly from minors.

• The healthcare Provider is solely responsible for obtaining any necessary parental or guardian consent before providing a minor patient's personal information and imaging data to us through the Services.
• If we become aware that we have inadvertently collected personal information from a minor without the necessary consent from a parent or guardian, we will take immediate steps to delete the information.
• If we become aware that we have collected the personal information of an individual under sixteen (16) who has directly created an account, we will take steps to delete the information as soon as possible, unless the parent or legal guardian requests otherwise.
• Please immediately contact us at [email protected] if you become aware that a minor has directly provided us with personal information without proper consent.

16Data Retention

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, to comply with legal and regulatory obligations, to resolve disputes, and to enforce our agreements. The specific retention period depends on the type of data and the purpose of processing.

• Active account data is retained for as long as your account remains active and in good standing.
• Patient analysis data and records are retained according to the Provider's instructions and applicable medical record retention laws and regulations.
• If you receive marketing communications from us, we retain your contact information until you opt out.
• Upon account termination or deletion request, your data may be retained for up to ninety (90) days in backup systems for recovery purposes and legal compliance.
• Financial and transaction records are retained for the period required by applicable tax and accounting regulations.
• Security logs and audit trails are retained for a minimum period as required for security monitoring and incident response.
• Anonymized and de-identified data used for research, development, and AI model improvement may be retained indefinitely, as it cannot be used to identify any individual.
• You can request that we suspend or remove your personal information at any time, subject to legal retention requirements.

17Links to Third-Party Sites

Our Website and Platform may contain links to other sites and services that are not owned or controlled by the Company. Once you have used these links to leave our Website and/or Platform, you should note that we do not have any control over those third-party sites. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites, and such sites are not governed by this Privacy Policy. You should exercise caution and look at the privacy policy applicable to the website or service in question. WE STRONGLY ADVISE YOU TO READ THE TERMS OF SERVICE AND PRIVACY POLICIES OF ANY THIRD-PARTY WEBSITES OR SERVICES THAT YOU VISIT.

18Changes to Applicable Law

This Privacy Policy shall be governed by and construed in accordance with the laws of the Socialist Republic of Vietnam and applicable international data protection frameworks. We may also comply with data protection requirements of other jurisdictions where our users are located, including the GDPR (for EEA users), CCPA (for California residents), and other applicable data protection regulations. We reserve the right to update this policy to reflect changes in applicable law.

19Changes to This Privacy Policy

We may change the terms of this Privacy Policy from time to time. We will notify you of material changes by posting a notice on our website, sending an email notification, or through an in-platform notification. You are responsible for regularly reviewing this policy so that you are aware of any changes to it. The date of the most recent revision will be indicated at the top of this policy. If you continue to use our Website and/or Platform after the time we state the changes will take effect, you will have accepted the changes. If you do not agree with the updated Privacy Policy, you should discontinue use of the Services.

20HIPAA Compliance Guide

This HIPAA Compliance Guide is provided to members of zCeph services who are subject to the requirements of the U.S. Federal Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act ("HITECH"), and related regulations (collectively, "HIPAA Rules"). zCeph acts as a Business Associate under HIPAA when processing Protected Health Information (PHI) on behalf of healthcare providers (Covered Entities) who use our Platform. This guide outlines the responsibilities and requirements for HIPAA compliance when using zCeph services.

• Protected Health Information (PHI): When you, as a Covered Entity under HIPAA, use zCeph services, you may upload the following categories of PHI from your patients: date of birth, contact information, address, diagnosis content, treatment records, dental radiographs (including lateral cephalometric X-rays, panoramic X-rays, and CBCT scans), intraoral photographs, facial photographs, and other clinical imaging data.
• Business Associate Relationship: zCeph (operated by zCeph Platform) acts as a Business Associate under HIPAA. We may maintain, transmit, create, or receive PHI from you in order to provide our services, including diagnostic data analysis for cephalometric evaluation. We will enter into a Business Associate Agreement (BAA) with Covered Entities upon request, as required by HIPAA.
• HIPAA Authorization Requirement: When you use zCeph services as a Covered Entity collecting PHI from patients, the HIPAA regulations apply and must be adhered to. The fundamental rule is that PHI may not be used or disclosed to anyone except the person to whom it belongs. You must obtain a valid HIPAA authorization from your patient before uploading their PHI to zCeph services.
• Valid HIPAA Authorization — Required Elements: A valid HIPAA authorization must contain ALL of the following elements: (1) A specific description of the PHI to be used or disclosed; (2) The name or identification of the person or class of persons authorized to make the requested use or disclosure; (3) The name or identification of the person or class of persons to whom the Covered Entity may make the requested use or disclosure (e.g., zCeph); (4) A clear description of the purpose for each requested use or disclosure (e.g., cephalometric analysis); (5) An expiration date or expiration event for the authorization; and (6) The signature of the individual (patient) and the date of signing.
• Valid HIPAA Authorization — Required Statements: In addition to the above elements, a valid HIPAA authorization must include ALL of the following statements: (1) The individual has the right to revoke the authorization in writing at any time, along with a description of how they may revoke it; (2) The individual's treatment, payment, enrollment, or eligibility for benefits is NOT conditioned on whether they sign the authorization; and (3) Any information disclosed pursuant to the authorization may be re-disclosed by the recipient and is no longer protected by federal or state health privacy laws.
• Invalid Authorization: If any one of the required elements or statements is missing from the authorization form, the authorization is NOT valid. An incomplete authorization should be returned to the patient or their representative for correction before any PHI is uploaded to zCeph.
• Covered Entity Responsibilities: As a Covered Entity, you are responsible for: (a) obtaining valid HIPAA authorization from patients before uploading their PHI; (b) maintaining records of all authorizations obtained; (c) honoring patient requests to revoke authorization; (d) ensuring your own HIPAA policies and procedures are current; (e) training your staff on HIPAA requirements; and (f) reporting any suspected breaches to zCeph and to your patients as required by the Breach Notification Rule.
• zCeph Business Associate Obligations: As your Business Associate, zCeph will: (a) use or disclose PHI only as permitted or required by the BAA or as required by law; (b) implement appropriate administrative, physical, and technical safeguards to protect PHI; (c) report any discovered security incidents or breaches; (d) ensure that any subcontractors who access PHI agree to the same restrictions; (e) make PHI available to satisfy patients' rights under the HIPAA Privacy Rule; and (f) upon termination, return or destroy all PHI received.
• Technical Safeguards: zCeph implements the following technical safeguards for PHI protection: encryption of data at rest (AES-256) and in transit (TLS 1.2+), access controls with role-based permissions, unique user identification and authentication, automatic session timeout, audit logging of all access to PHI, emergency access procedures, and regular security assessments.
• Breach Notification: In the event of a breach of unsecured PHI, zCeph will notify the affected Covered Entity without unreasonable delay and no later than sixty (60) calendar days after discovery of the breach. The notification will include: identification of each individual whose PHI has been or is reasonably believed to have been affected, a description of the breach, the types of PHI involved, and steps individuals should take to protect themselves.
• De-identified Data: zCeph may use de-identified data (data that has been stripped of all 18 HIPAA identifiers) for research, product improvement, and analytics purposes. De-identified data is not considered PHI and is not subject to HIPAA restrictions.
• Contact for HIPAA Inquiries: If you have questions about HIPAA compliance, need to request a Business Associate Agreement, or wish to report a security concern, please contact us at [email protected]. We are committed to helping our healthcare provider users maintain full compliance with HIPAA requirements.

21Contact and Data Protection

For any privacy-related inquiries, data subject access requests, questions about our data practices, or to exercise any of your data protection rights, please contact our support team or Data Protection Officer through the communication channels listed below. We will respond to your inquiry as promptly as possible and in any event within the timeframes required by applicable law.