Privacy Policy

DIGIART DENTAL STUDIOS LTD is a private limited company registered in Kenya (Company No. PVT-6Y1Y735L), located at 6 House, 118 Kabete, Westlands, Nairobi. We operate a platform that connects dental clinics and hospitals with dental technicians and laboratories.

For information we collect about our own website visitors and account holders, we are the data controller. When a clinic submits patient-related case information, the clinic remains responsible for that patient data and we process it on the clinic's behalf as a data processor.

• Account information: name, email address, phone number, role, and password (stored only as a secure hash). If you sign in with Google, we receive your name, email address, and profile picture from Google.
• Clinic and business details: clinic or hospital name, contact person, phone number, email, and delivery details.
• Dental case information: treatment requirements, tooth details, notes, and files such as images, scans, and documents uploaded with a case. This may include health information about patients, which is sensitive personal data.
• Payment information: invoice records and M-Pesa transaction details such as the paying phone number, amount, and transaction reference. We do not store M-Pesa PINs.
• Communications: messages exchanged about a case and emails we send or receive.
• Technical information: IP address, browser type, and log data generated when you use the site, used to keep the service secure and working.

• To create and manage accounts and sign you in securely.
• To receive, produce, track, and deliver dental cases submitted by clinics.
• To issue invoices, request and confirm payments, and keep financial records.
• To send service messages such as case updates, invitations, password resets, and payment notices.
• To maintain, secure, and improve the platform, and to prevent fraud or misuse.
• To comply with our legal and tax obligations.

We do not sell personal data or use it for advertising.

We process personal data where it is necessary to perform our contract with you or your clinic, to comply with legal obligations, for our legitimate interests in running a secure and reliable service, or with your consent where required. Patient health information is processed on the instructions of the submitting clinic, which is responsible for having a lawful basis to share it with us.

We share personal data only where needed to provide the service:

• Within a case workflow: between the submitting clinic and the technicians or laboratory handling the case.
• Service providers: cloud hosting and file storage (Amazon Web Services), payment processing (Safaricom M-Pesa), email delivery providers, and Google for sign-in. They may use the data only to provide their services to us.
• Legal requirements: where required by law, court order, or a lawful request from a public authority.

Our platform and files are hosted with Amazon Web Services in the European Union. Where personal data is transferred outside Kenya, we do so in line with the Data Protection Act, 2019, using providers that maintain appropriate safeguards for the security of the data.

We keep personal data only for as long as needed for the purposes above. Account data is kept while the account is active. Case, invoice, and payment records are kept for as long as needed to meet clinical, accounting, and tax record-keeping requirements, after which they are deleted or anonymised.

We use encryption in transit (HTTPS), hashed passwords, role-based access controls, and access restricted to authorised personnel. No system is completely secure, but we work to protect your data and will notify affected people and the Office of the Data Protection Commissioner of a breach where required by law.

We use essential cookies only, to keep you signed in and protect against cross-site request forgery. We do not use advertising or third-party tracking cookies.

Under the Data Protection Act, 2019, you have the right to:

• be informed of how your personal data is used;
• access the personal data we hold about you;
• have inaccurate data corrected;
• have data deleted where it is no longer lawfully needed;
• object to or restrict certain processing;
• receive your data in a portable format where applicable.

To exercise these rights, contact us using the details below. Patients whose information was submitted by a clinic should contact that clinic first; we will assist the clinic in responding. You may also lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya.

Our platform is intended for dental professionals and businesses. We do not knowingly collect personal data directly from children. Any information about minors is received only as part of a dental case submitted by a clinic.

We may update this policy from time to time. The latest version will always be available on this page with its effective date.

For privacy questions or requests, contact: