VstreamX Studio Inc. provides DentalX. This page lists the companies that process data for DentalX as the Service is built today, what each one receives, and where, in three groups: the sub-processors we engage to deliver DentalX, the payment processor for our own billing, and the services a clinic connects itself. Each receives only what its purpose needs. The Privacy Policy explains how we handle personal information, and the Terms of Service set out how we process the data clinics enter.
Our sub-processors
We engage these providers to deliver DentalX. Each processes data under its written terms with us, and we remain responsible to the clinic for the part of the Service each one performs, as section 8.6 of the Terms of Service provides.
| Provider | Purpose | Data | Where |
|---|---|---|---|
| Google Cloud / Firebase | Hosting, database, file storage, sign-in (including the text messages that carry a second-factor code), server functions, backups and server logs | All Customer Data, including patient health information, and the accounts of clinic staffFirestore, Cloud Storage and Cloud Functions are covered by the Google Cloud Business Associate Agreement. | The United States, with the database in Google’s United States multi-region (nam5) and files and server functions in Iowa (us-central1) |
| Google Vertex AI (Gemini) | The AI features a clinic’s staff choose to use, and drafts of our replies to support tickets | The text, image or document sent with each AI requestCalled from DentalX’s own Google Cloud project. Radiograph analysis is off for United States clinics. | The United States and other countries: Vertex AI’s global endpoint lets Google serve a request from a data centre outside the United States |
| Google (Gmail) | Reminders, recall notices, consent links, prescriptions and treatment plans sent by email | The recipient’s email address and the message, with its PDF attachment where there is oneOne DentalX sender address sends for every clinic. It also sends the monthly summary a clinic owner can choose to receive. | The United States and other countries where Google operates |
| Meta (WhatsApp Business Platform) | Reminders, recall notices and the two-way inbox over WhatsApp, for a clinic that sends through DentalX’s own WhatsApp Business account rather than one it connects itself | The patient’s phone number, the messages sent and received, and the files a patient sendsNot available to clinics in the United States. A clinic that connects its own WhatsApp Business account is listed under services you connect instead. | The United States and other countries where Meta operates |
| Google reCAPTCHA | Checking that a person, not a program, is at the browser when a User sets up or uses a text-message second factor | Information about the User’s browser and device and how the page is used, which the browser sends to Google; no patient dataLoaded only on the screens where a text-message second factor is set up or used. | The United States and other countries where Google operates |
The payment processor for our own billing
Stripe processes the payments clinics make to VstreamX Studio Inc. for DentalX. It receives billing data about the clinic, never Patient Data, so it is not a processor of patient information.
| Provider | Purpose | Data | Where |
|---|---|---|---|
| Stripe | Payment processor for VstreamX’s own billing: clinic subscriptions and their payments | The clinic’s name, billing email and payment details; no Patient DataVstreamX Studio Inc. is the merchant. Card details are entered on Stripe’s pages and never reach DentalX. | The United States and other countries where Stripe operates |
Services you connect
A clinic can connect these accounts of its own to DentalX. DentalX sends them what the table shows, but they are not our sub-processors: the clinic’s own agreement with the provider governs each one, as section 10 of the Terms of Service provides.
| Provider | Purpose | Data | Where |
|---|---|---|---|
| Your Google Calendar | Appointment sync, only for a clinic that connects its own Google account | Appointment time, the treatment, the dentist and the patient’s nameNo phone numbers or clinical notes. Your own agreement with Google governs that account. | Your Google account, which Google keeps in the United States and other countries where it operates |
| Your WhatsApp Business account (Meta) | Reminders, recall notices and the two-way inbox over WhatsApp, for a clinic that connects its own WhatsApp Business account, where DentalX offers it | The patient’s phone number, the messages sent and received, and the files a patient sendsNot available to clinics in the United States. Your own agreement with Meta governs that account, its number and its bill. Connecting it loads Meta’s sign-up script, which can set Meta’s cookies in that browser. | The United States and other countries where Meta operates |
What is not on this list, and why
- Other AI providers. Every AI feature runs on Google Gemini through Vertex AI. The code can reach OpenAI only if we switch it on, and it is switched off, so no data is sent to OpenAI or to any other AI provider.
- Analytics and advertising. DentalX loads no analytics, advertising or session-recording tool on any page, including the public website.
- Your browser’s speech recognition. Dictation uses the speech recognition built into the browser, which sends the audio to the company that makes the browser (for example, Google for Chrome) under that company’s terms. We do not engage it and never receive the audio. Dictation is off for clinics in the United States.
- Unsplash. Some photographs on the public website at dentalx.studio are loaded from Unsplash, so a visitor’s browser sends its IP address and browser details to Unsplash when it opens that page. Unsplash receives nothing from the clinic app.
When this list changes
We publish a change here before it takes effect. When a new sub-processor will receive patient data, we publish it at least 30 days before it starts and tell clinic owners by email, as section 8.6 of the Terms of Service provides. Removing a provider, or narrowing what one receives, can take effect at once. Questions: admin@vstreamx.com.