Privacy policy

Who we are

BreezeHub Dental is a web application for dental practices, provided by BreezeHub, Athens, Greece. For anything about this policy or your data, write to info@breezehub.gr.

Each practice decides what it records about its patients and why, so the practice is the controller of its patients' data. BreezeHub processes that data on the practice's behalf, only to run the application for it.

What data the application holds

For practice staff: name, email address, role, and a password that is stored only as a hash. For patients, whatever the practice enters: contact details, medical history, treatment, payments, notes and files such as X-rays. The application also keeps a log of changes that records which user made each one, when, and from which IP address.

Google user data

A practice can connect a Google Calendar to BreezeHub Dental. This is optional, and only the practice owner can do it. The application asks Google for these permissions:

• calendar.events: To read, create, change and delete events in the one calendar the practice owner chose, so staff can manage appointments from the application.
• calendar.calendarlist.readonly: To list the calendars in the connected account, so the owner can choose which one holds the appointments.
• openid, email: To show which Google account is connected, so the owner knows whose calendar the practice is using.

When a user books an appointment for a patient, the event title is the patient's name, followed by the treatment if one was chosen, and the description holds any notes the user typed. The event also carries the internal identifier of the patient's record as a private property, which only BreezeHub Dental reads, so it can open the right patient from the calendar. The application does not read or change any other calendar in the account.

BreezeHub Dental stores the Google access and refresh tokens in its database, encrypted. It does not copy calendar events into its database. Events it reads are kept in a short-lived cache for up to one minute, so the overview screen does not ask Google on every visit, and are then discarded.

Google user data is used only to show and manage the practice's appointments inside BreezeHub Dental. It is not sold, not shared with anyone, not used for advertising, and not used to train artificial intelligence or machine learning models. BreezeHub staff do not read it, except with the practice's permission to fix a problem, or where the law requires it.

BreezeHub Dental's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting and deleting Google data

The owner can disconnect Google Calendar at any time from the application's settings. Disconnecting revokes the application's access with Google and deletes the stored tokens at once. The events themselves stay in the owner's Google Calendar. Access can also be removed from the Google account at myaccount.google.com/permissions.

Where the data is stored

The application and its database run on servers in Falkenstein, Germany, operated by Hetzner Online. Backups are encrypted on the server before any copy of them leaves it.

Security

All traffic to the application uses HTTPS. Each practice's data is kept apart from every other practice's, staff see only what their role allows, and changes are recorded in the log described above.

Your rights

Under the GDPR you can ask to see, correct or delete your personal data, or object to how it is used. Patients should contact their dental practice, which controls their data. Practice staff and practice owners can write to info@breezehub.gr. You can also complain to the Hellenic Data Protection Authority at dpa.gr.

Changes to this policy

If this policy changes, the new version will be published on this page with a new date.