Privacy Policy

1. What we collect

• Account details: full name, email address and phone number (managed through the Clerk identity service).
• Medical information: the treatment plan and dental x-ray you upload — this is “sensitive information” under the Protection of Privacy Law.
• Payment information: applies to clinics only. Clinic subscriptions are processed through the PayPlus payment provider, and we do not store card details on our servers. Patients are never charged and are never asked for payment details at any stage.
• Technical information: basic operational logs (timings, errors) for maintenance and security.

2. How we use it

• To provide the service — sending your request and medical documents to the clinics you chose, and receiving their quotes.
• To manage clinic subscriptions and process their billing.
• To contact you about your request and to provide support.
• To secure the service, prevent fraud, and comply with legal requirements.

The legal basis for processing is your consent and the performance of our agreement with you.

3. Sharing your medical information

The medical documents you upload are sent only to the clinics you explicitly selected when creating your request, for the purpose of obtaining a quote. They are sent only after your explicit confirmation. We do not publish this information, we do not use it for advertising, and we do not sell information to third parties.

4. Service providers (data processors)

We rely on providers who process information on our behalf under appropriate agreements:

• Clerk — identity and account management.
• Vercel — site hosting and file storage (Vercel Blob), with private, secured access.
• Neon — the database.
• PayPlus — payment processing.
• Resend — sending email.

4a. Where your information is stored

Your information — including your treatment plan and your dental x-ray — is processed and stored on servers in the United States. This is not a footnote: it is the central fact a patient should know before uploading a medical document, which is why it also appears on the consent checkbox itself rather than only here.

Concretely: server functions and file storage run in Vercel’s iad1 region (Virginia, USA), and the database is hosted with Neon. Clerk handles identity and Resend sends email.

For patients in the European Union, the EEA and the United Kingdom, the transfer relies on «transfer mechanism — SCCs / Data Privacy Framework, for legal review» together with your explicit consent, which is recorded alongside the wording it was given to and the moment it was given.

5. Retention

We keep information for as long as your account is active and as needed to provide the service and meet legal obligations (tax requirements, for example). You may request deletion, subject to section 7. Defined retention period: «retention period — to be settled with a lawyer».

6. Information security

We apply accepted security measures: encryption in transit (HTTPS) and at rest, permission-based access controls (only the request’s owner or an authorised administrator can reach the files), rate limiting, and signature verification on payment interfaces. No security is perfect, however, and we cannot guarantee absolute immunity.

7. Your rights

Deleting it yourself:every request in your account has a “Delete request” button, which removes the request together with the treatment plan and x-ray from storage. You do not need to contact us.

• To review the information collected about you.
• To request correction of inaccurate information.
• To request deletion of your account and the information relating to it, subject to legal retention obligations.
• To withdraw your consent to future uses.

For privacy enquiries and to exercise these rights: support@dentalcompare.co.il. Data protection officer: «name and contact details — if applicable».

8. Cookies

The service uses essential cookies only (mainly for authentication). For details see the cookie policy.

9. Changes to this policy

We will update this policy from time to time. Continued use of the service after an update constitutes acceptance of the updated policy.