Privacy policy

[Company name] Limited, registered in England and Wales under company number [number], registered office [address] ("edonto", "we"), is responsible for the processing of personal data described in this policy.

You can reach us at the email address on our contact page. [Data protection officer / encarregado for Brazil: name and contact.] [Representative in the EU, if required.]

This policy covers this website, the application at app.edonto.com and the lab portals at *.edonto.net.

Labs and clinics use edonto to manage cases, which can contain patient information. For this data, the clinic or lab is the controller and edonto processes it only on their behalf and according to their instructions (as processor, or "operador" under the LGPD). If you are a patient, please contact your clinic about your data.

Account data: name, email address, language, password (stored only as a secure hash) and two-factor and passkey settings.

Organization data: name, type, address, tax ID, contact details and billing details that labs show on their invoices.

Usage and security data: IP address, browser, times of access and actions in the application, as far as needed to run and secure the Service.

Invitations and communication: email addresses entered to invite colleagues or customers, and messages you send to us.

We process this data to provide the Service under our contract with your organization (UK GDPR Art. 6(1)(b); LGPD Art. 7, V), to keep the Service secure and prevent abuse (legitimate interests, UK GDPR Art. 6(1)(f); LGPD Art. 7, IX), to comply with legal obligations such as accounting (UK GDPR Art. 6(1)(c); LGPD Art. 7, II) and to inform you about the Service.

We use aggregated usage information to improve edonto. We do not sell personal data and do not send marketing emails without consent where consent is required.

This website sets no cookies and uses no third-party trackers or analytics. Our hosting provider records technical access data (such as IP address, time and requested page) to deliver and protect the website; these logs are deleted after [14] days.

The application only uses strictly necessary cookies – for the sign-in session (which also keeps your language), protection against cross-site request forgery and, if you choose it, staying signed in. We use no advertising or analytics cookies.

Case data is shared with the organizations you work with in edonto – for example, a case you send is visible to the lab you send it to.

We use service providers for hosting, email delivery and error monitoring, who process data on our behalf under contracts. [The list of service providers will be published before launch.] We disclose data to authorities only where we are legally required to.

Some service providers may process data outside the United Kingdom, Brazil or the European Economic Area. In that case we use appropriate safeguards, such as the UK International Data Transfer Agreement, the EU standard contractual clauses or the standard clauses of the Brazilian data protection authority (ANPD).

We keep account and organization data while the account exists. After an account is closed, we delete the data within [30] days, unless we have to retain it by law – for example for accounting – in which case we restrict its use. Security logs are deleted after [90] days.

edonto uses encrypted connections, separates the data of every organization, controls access with roles, offers two-factor authentication and passkeys and records changes to cases. Backups are made regularly.

Under the UK GDPR you have the right of access, rectification, erasure, restriction of processing, data portability and objection, and you can withdraw any consent at any time. You can complain to the Information Commissioner's Office (ICO).

Under the LGPD (Art. 18) you can request confirmation of processing, access, correction, anonymization, blocking or deletion, portability, information about the entities your data is shared with, and revoke consent. You can complain to the Brazilian data protection authority (ANPD).

To exercise your rights, write to us at the email address on our contact page. For patient data, please contact your clinic.

edonto is a service for businesses and not intended for persons under 18. Clinics may process data of patients who are minors through edonto; they are responsible for this processing.

We may update this policy. The date at the top shows the latest version; we will inform you of material changes by email or in the application.