Privacy Policy

1. Who we are and how to reach us

This Privacy Policy is issued by CRMBridge.ai, doing business as CRMBridge.ai ("CRMBridge", "we", "us"). It covers the website at crmbridge.ai, the developer portal, our APIs, our support chat assistant, our telephone line, and the integration services we provide to dental and veterinary practices and their software partners (together, the "Services").

The privacy team is our designated point of accountability under PIPEDA and the person in charge of the protection of personal information under Quebec law. Requests sent to any of the addresses above are routed to the privacy team.

2. The two roles we play

2.1 Data we process on behalf of practices (processor role)

Dental and veterinary practices, and the software vendors they authorise, connect their practice management systems to CRMBridge. The patient, appointment, ledger and clinical data that flows through those connections belongs to the practice. For that data we are a business associate under HIPAA, a service provider or agent under Canadian federal and provincial privacy and health-information laws, a service provider under the California Consumer Privacy Act, and a processor under the GDPR and UK GDPR. We use it only as the practice and our agreement with the practice instruct. Section 6 describes this in detail.

If you are a patient, your dental or veterinary provider decides how your records are used and is the right place to send access, correction or deletion requests. We will assist your provider with any request that concerns data we hold for them. We cannot act on a patient request directly without the provider's instruction, because the data is not ours to change.

2.2 Data we collect for our own purposes (controller role)

When you visit our website, create a developer-portal account, contact sales or support, call our phone line, or use the chat assistant, we decide how that information is used and are the controller (or "business" in California terms). Sections 3 to 5 describe this data. The remainder of this policy applies to both roles unless it says otherwise.

3. Information we collect as a controller

The table lists each category of personal information we collect, where it comes from, why we use it, our legal basis where the GDPR or UK GDPR applies, and how long we keep it.

We do not collect precise geolocation, government identifiers, payment card numbers, biometric data, or information about your health from website visitors or developer-portal users. Please do not send health information about yourself or anyone else through the chat assistant or the contact form.

4. How we use information

We use the information described in section 3 to:

• provide, operate, secure and support the Services, including authenticating users and enforcing usage limits;
• respond to enquiries, calls, chat messages and support requests, and follow up when you ask us to;
• send service communications such as verification codes, security alerts, invoices and product or release announcements to developer-portal accounts, each with an unsubscribe link for non-essential messages;
• monitor and improve performance, reliability and documentation, using aggregated usage statistics wherever possible;
• comply with legal obligations, enforce our Terms of Service and agreements, and protect against fraud, abuse and security threats;
• maintain the audit records HIPAA and our customer agreements require.

We do not use personal information for advertising, profiling, or automated decisions that have legal or similarly significant effects on you. We do not use customer data, patient data, chat transcripts or call records to train AI or machine-learning models, and we do not perform image analysis on patient imaging.

5. Cookies and similar technologies

We use only the cookies and browser storage needed to run the site and keep accounts secure. We use no advertising, tracking or analytics cookies, and we do not allow third parties to place cookies on our pages.

Because we set no optional cookies, we do not show a cookie banner, and there is nothing to opt out of. We honour Global Privacy Control and Do Not Track signals in the sense that matters: we never sell or share personal information or track visitors across other sites, whether or not a signal is present.

Third-party content on our pages

• Google Fonts. Our pages load the Poppins typeface from Google's servers, which receive your IP address and browser information to deliver the font files. Google's privacy policy governs that processing.
• Demo scheduling. The Book a Demo page embeds a Google Calendar appointment page. If you book, the details you enter are processed by Google and by us to hold the meeting.
• Security rating widget. The Trust Center embeds a SecurityScorecard rating, which receives your IP address when it loads.

6. Practice and patient data we process on behalf of practices

Through connections that a practice or its authorised software partner sets up, we may process patient demographics, appointments and scheduling, ledger, insurance and billing entries, treatment plans, clinical notes, recall information and imaging files. In Canada this is personal health information; in the United States much of it is protected health information (PHI). Our commitments for this data:

• Instructions only. We process it solely to provide the integration the practice configured and as our Business Associate Agreement, Data Processing Agreement or service agreement permits. We do not sell it, use it for our own marketing, or use it to train models.
• Minimum necessary. Each integration retrieves only the entities and fields the practice or partner has enabled, and each partner sees only the practices and locations assigned to it.
• Subprocessors under contract. Every subprocessor that can touch practice data is bound by a written agreement with equivalent obligations, and the current list is published in our Trust Center. We give at least 30 days' notice before adding or replacing one.
• Security incidents. We notify the practice of a breach of unsecured PHI without unreasonable delay and no later than three business days after we become aware of it, and support the practice's own notification duties. For Canadian practices we notify the custodian at the first reasonable opportunity, as PHIPA and equivalent provincial laws require.
• Return or deletion. When a practice disconnects or the agreement ends, we return or securely delete the data, keeping only what law requires us to retain and only for as long as it requires.
• Assistance with rights. We help practices respond to patient access, amendment, restriction and accounting-of-disclosures requests, and to data-subject requests under the GDPR.
• De-identified data. Where a practice agreement permits, we may create aggregated or de-identified statistics that cannot reasonably be linked to a person, following the HIPAA de-identification standard, for service reliability and reporting. We do not re-identify such data.

A Business Associate Agreement and a Data Processing Addendum are available on request from [email protected]. The practice remains responsible for its own notices to, and consents from, its patients.

7. How we share information

We share personal information only in the following circumstances.

7.1 Service providers and subprocessors

The providers below process data for us under contract and only on our instructions. The authoritative, dated list, including which providers may access practice data, is in the Trust Center.

7.2 Your organisation and the partners you authorise

Developer-portal accounts belong to an organisation. Administrators of that organisation can see the names, emails, roles and activity of its users. Practice data is shared only with the software partners the practice has authorised.

7.3 Legal reasons

We disclose information when the law requires it, in response to valid legal process, to regulators, or where necessary to protect the rights, safety or property of CRMBridge, our customers, patients or the public. Where the law allows, we tell the affected customer before responding to a request for its data.

7.4 Business transfers

If CRMBridge is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction. We will notify affected customers and require the successor to honour this policy and the agreements in place.

7.5 What we never do

We do not sell personal information, and we have not sold it in the preceding 12 months. We do not share personal information for cross-context behavioral advertising or targeted advertising, and we do not disclose it to data brokers.

8. International data transfers

CRMBridge is operated from the United States and our platform is hosted there. If you use the Services from outside the United States, your information is transferred to and processed in the United States, and by the providers in section 7 in the locations listed there.

• Canada. Personal information transferred for processing in the United States remains protected by contract and by the safeguards in section 10, and may be subject to lawful access by United States authorities. We remain accountable for it under PIPEDA. Practices in Quebec should note that personal information is communicated outside Quebec; we carry out the assessment Quebec law requires before such transfers and can share its conclusions with customers on request.
• European Economic Area, United Kingdom and Switzerland. We rely on the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum and the Swiss amendments where applicable, supported by a transfer risk assessment. A copy of the clauses we use is available from the privacy team. We will state here if we obtain certification under the EU-US Data Privacy Framework.
• Australia and New Zealand. A practice that connects to CRMBridge discloses information to us overseas. We give Australian practices the written commitments that Australian Privacy Principle 8 calls for, and New Zealand practices the comparable-safeguard commitments that Information Privacy Principle 12 calls for, and we remain responsible for our subprocessors. Section 15 has the detail.

We do not rely on your consent, or on your continued use of the Services, as the basis for international transfers.

9. How long we keep information

We keep personal information only as long as needed for the purposes in this policy, and the retention column in section 3 gives the period for each category. In summary:

• Account and organisation data: for the life of the account. When an account is deleted, an archived copy is held for a short recovery and dispute-handling window and is then permanently deleted, except for records that section 3 says we must keep longer.
• Practice and patient data: for as long as the practice's connection and agreement are active, then returned or deleted as section 6 describes. Backups are overwritten on a rolling schedule.
• Support chat transcripts and phone line records: 24 months after the last interaction, then deleted automatically.
• Security, access and audit logs: 6 years, as HIPAA and our customer agreements require.
• Billing and tax records: 7 years.

Where deletion is not immediately possible, for example in encrypted backups, the data is isolated from use until it is overwritten.

10. How we protect information

We maintain administrative, physical and technical safeguards designed for health information and reviewed against the HIPAA Security Rule. The current controls, external ratings and available attestations are published in the Trust Center. Highlights:

No system is perfectly secure. If you believe your account or data has been compromised, contact [email protected]. Where a security incident affects your personal information and the law requires notice, we will notify you and the relevant authority within the period the law sets.

11. Your rights and how to exercise them

Depending on where you live, you may have the right to:

• know and access the personal information we hold about you and receive a copy in a portable format;
• correct inaccurate or incomplete information;
• delete your information, subject to the records we are required to keep;
• restrict or object to certain processing, including any processing based on legitimate interests;
• withdraw consent at any time where processing is based on consent, without affecting processing that already took place;
• opt out of sales, sharing for targeted advertising and profiling (we do none of these, so there is nothing to opt out of);
• not be discriminated against for exercising any of these rights;
• complain to a supervisory authority, listed in section 19.

How to make a request

• Developer-portal users can update profile details and delete their account from the portal settings, and can revoke API keys and partner authorisations at any time.
• For anything else, email [email protected] or call the toll-free number in section 1. Tell us which right you are exercising and, if you have one, the email address on your account.
• We verify requests by matching the details you give us against the account or communications we hold, and may ask you to confirm a code sent to the email address on file. An authorised agent may act for you if they show your written permission and we can verify your identity.
• We respond within 30 days, or within 45 days for California requests, and tell you if we need more time and why. If we refuse a request in whole or part, we explain the reason and how to appeal by replying to our response; appeals are reviewed by a different person than the one who decided the original request.
• Requests are free. We may charge a reasonable fee or decline requests that are manifestly unfounded or excessive, and we will say so in writing.

Patients: please direct requests about your dental or veterinary records to your provider, as section 2 explains. Marketing: product and release announcements carry an unsubscribe link; essential service messages, such as security alerts and invoices, cannot be unsubscribed from while you hold an account.

12. United States residents, including California

12.1 HIPAA

CRMBridge is a business associate of the practices that use it. Your provider's Notice of Privacy Practices explains your HIPAA rights, and requests to access or amend your records go to your provider. Complaints about the handling of protected health information may be made to the provider, to our HIPAA Privacy Officer, or to the U.S. Department of Health and Human Services Office for Civil Rights.

12.2 California Consumer Privacy Act and California Privacy Rights Act

This section applies to California residents and to personal information we hold as a business. It does not apply to protected health information we hold as a business associate, or to medical information covered by the Confidentiality of Medical Information Act, which are exempt from the CCPA.

Categories collected in the preceding 12 months

We use sensitive personal information only to provide the Services and secure accounts, which are purposes permitted without a right to limit. We do not sell or share personal information, we have no actual knowledge of selling or sharing the personal information of consumers under 16, and we do not use or disclose personal information for purposes beyond those in this policy.

Your California rights

You may request to know what personal information we collect, use, disclose and sell (we sell none); request deletion; request correction; opt out of sale or sharing (not applicable); limit the use of sensitive personal information (not applicable); and not receive discriminatory treatment for exercising these rights. Submit requests by email to [email protected] or by calling (833) 992-7624. Section 11 describes verification, authorised agents and timing. We treat a Global Privacy Control signal as a valid opt-out request for the browser it comes from. Metrics on the requests we received in the previous calendar year are available on request.

Notice at collection. The forms, chat assistant and phone line through which we collect information link to or announce this policy, which serves as our notice at collection. Shine the Light: we do not disclose personal information to third parties for their own direct marketing.

12.3 Other state privacy laws

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island, and of any other state with a comparable law, have the rights of access, correction, deletion, portability and opt-out described in section 11, and the right to appeal a refusal as described there. If an appeal is refused, you may contact your state attorney general. Most of these laws exempt data we hold as a HIPAA business associate.

12.4 Washington My Health My Data Act and similar laws

We do not collect consumer health data from website visitors, callers or portal users. Health information we process for practices is protected health information handled under HIPAA and is outside these laws. If you nonetheless send us health information through the chat or contact form, we will delete it on request.

12.5 Automated agents

California law requires that we tell you when you interact with a bot. Our website chat assistant and the assistant that answers our phone line are automated AI systems, and both identify themselves as such at the start of the conversation.

13. Canada

This section applies to individuals in Canada and adds to the rest of this policy. We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply, the private-sector laws of Alberta, British Columbia and Quebec (including the Act respecting the protection of personal information in the private sector as amended by Law 25).

• Accountability. Our privacy team, reachable at [email protected], is accountable for our compliance and is the person in charge of the protection of personal information for Quebec purposes.
• Purposes and consent. We identify our purposes at or before collection in this policy and on the forms and channels where we collect information. Where consent is the basis for processing, we obtain it expressly for sensitive information and may rely on implied consent for information you provide for an obvious purpose, such as an email address you give us so we can reply. You may withdraw consent at any time by contacting us, subject to legal or contractual restrictions and reasonable notice, and we will explain the consequences of withdrawal.
• Limiting collection, use and retention. We collect only what the purposes in section 3 require, use it only for those purposes or ones you would reasonably expect, and keep it only for the periods in section 9.
• Access and correction. You may ask what personal information we hold, how it is used and to whom it has been disclosed, and ask us to correct it. We respond within 30 days and may extend once for a further 30 days with notice. Quebec residents may also request a copy of computerised personal information in a structured, commonly used format, and may request that a hyperlink to their personal information be de-indexed where the law provides.
• Transfers outside Canada and Quebec. Section 8 explains that information is processed in the United States and by the providers listed in section 7.
• Automated decisions. We make no decisions based exclusively on automated processing that affect you. Should that change, Quebec residents will be informed and may request the factors and parameters used and submit observations.
• Breach of security safeguards. We keep a record of every breach of security safeguards involving personal information, report to the Office of the Privacy Commissioner of Canada and the Commission d'acces a l'information du Quebec where required, and notify affected individuals when the breach creates a real risk of significant harm or serious injury.
• Health information custodians. For Ontario practices we act as an agent and electronic service provider under the Personal Health Information Protection Act; for practices in Alberta, British Columbia, Manitoba, Nova Scotia, New Brunswick and other provinces we act in the equivalent role under their health-information laws. We use personal health information only as the custodian instructs, keep an electronic record of access, and notify the custodian of any unauthorised use, disclosure or loss at the first reasonable opportunity.
• Commercial electronic messages. We send product and release announcements to developer-portal accounts on the basis of an existing business relationship, and every such message identifies us and includes an unsubscribe mechanism that takes effect within 10 business days, as Canada's Anti-Spam Legislation requires.
• Complaints. You may challenge our compliance by contacting the privacy team. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada, to your provincial commissioner, or, for health information, to the relevant provincial health-information commissioner.
• Language. A French version of this policy is available on request from the privacy team.

14. European Economic Area, United Kingdom and Switzerland

This section applies where the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection applies to our processing.

• Controller and processor. CRMBridge.ai is the controller of the information described in sections 3 to 5. For practice and patient data we are a processor acting under a Data Processing Addendum with the practice or partner, who is the controller.
• Legal bases. The table in section 3 states the legal basis for each category: performance of a contract (Article 6(1)(b)), compliance with a legal obligation (Article 6(1)(c)), our legitimate interests in operating, securing and improving the Services and responding to enquiries (Article 6(1)(f)), and consent (Article 6(1)(a)) where you volunteer contact details in the chat or on a call. We do not process special-category data as a controller. As a processor, the legal basis for health data is the controller's, usually the provision of health care under Article 9(2)(h).
• Representative. We have no establishment in the EEA or the United Kingdom. Where Article 27 requires a representative, contact the privacy team for the current details.
• Data protection officer. Enquiries that a data protection officer would handle are directed to the privacy team at [email protected]; we will publish a designated officer's details here if we appoint one.
• Your rights. Access, rectification, erasure, restriction, portability, objection (including to processing based on legitimate interests) and withdrawal of consent, as section 11 describes, within one month, extendable by two further months for complex requests with notice.
• Transfers. See section 8 for the Standard Contractual Clauses and UK Addendum we rely on.
• Complaints. You may lodge a complaint with the supervisory authority of your habitual residence, place of work or the place of an alleged infringement, with the UK Information Commissioner's Office, or with the Swiss Federal Data Protection and Information Commissioner.

15. Australia and New Zealand

15.1 Australia

This section applies to individuals in Australia and to personal information we handle in connection with Australian practices and partners. We handle it in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) and, for health information, the state and territory health records laws that apply to the practice, such as the Health Records Act 2001 (Vic), the Health Records and Information Privacy Act 2002 (NSW) and the Health Records (Privacy and Access) Act 1997 (ACT).

• What we collect and hold. Sections 3 and 6 describe the kinds of personal information we collect and hold, how we collect it and why. Health information is sensitive information under the Privacy Act. We hold it only for the practice that collected it from its patients, and we never collect it from patients directly.
• Notification at collection. This policy, together with the forms, the chat assistant and the phone greeting through which we collect information, is our notification under APP 5.
• Use and disclosure. We use and disclose personal information only for the purposes in section 4 and in the ways section 7 describes. Our only direct marketing is product and service updates to developer-portal account holders, who can opt out at any time using the link in each message or by contacting us, as APP 7 and the Spam Act 2003 require.
• Overseas disclosure. Personal information is stored and processed in the United States and by the providers, in the countries, listed in section 7. Practice data is disclosed to us by the practice as its contracted service provider; we support the practice's obligations under APP 8 with written commitments to handle the information in accordance with the APPs, and we remain accountable for our subprocessors. When you give us information directly, you consent to that overseas handling, and we take reasonable steps to ensure the recipients do not breach the APPs.
• Security and retention. Section 10 describes our safeguards. We destroy or de-identify personal information once it is no longer needed for a permitted purpose, following the periods in section 9, as APP 11 requires.
• Access and correction. You may ask for access to, or correction of, the personal information we hold about you, as section 11 describes (APPs 12 and 13). We respond within 30 days. If we refuse, we give written reasons and explain how to complain. Requests about your dental records go to your practice, which we will assist.
• Automated decision-making. We do not use computer programs to make decisions that could reasonably be expected to significantly affect your rights or interests; section 16 describes our AI features. If that changes, this policy will describe the kinds of personal information used and the decisions made.
• Data breaches. If a data breach is likely to result in serious harm to anyone, we assess it promptly and, where we are the responsible entity, notify the Office of the Australian Information Commissioner and the affected individuals under the Notifiable Data Breaches scheme. For practice data we notify the practice without delay so it can meet its own obligations.
• Complaints. Send complaints to the privacy team (section 1). We acknowledge them within 7 days and aim to resolve them within 30 days. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au or, for health information, to your state or territory health or privacy commissioner.

15.2 New Zealand

This section applies to individuals in New Zealand and to personal information we handle in connection with New Zealand practices and partners. We handle it in accordance with the Privacy Act 2020 and its 13 Information Privacy Principles (IPPs) and, for health information, the Health Information Privacy Code 2020.

• Agent for practice data. A practice that connects to CRMBridge remains the agency that holds its patients' health information. Under section 11 of the Privacy Act 2020 we hold and process that information only as the practice's agent, for the practice's purposes and on its instructions, and we do not use or disclose it for our own purposes.
• Collection from you. When we collect personal information from you directly, sections 1 and 3 tell you who we are, why we collect it, who will receive it, that providing it is voluntary, and how to access and correct it, as IPP 3 requires.
• Overseas disclosure. Information is stored and processed in the United States and by the providers listed in section 7. Where a practice discloses personal information to us, we support its obligations under IPP 12 by agreeing to protect the information in a way that provides comparable safeguards to the Privacy Act 2020, including through the Privacy Commissioner's model contractual clauses when the practice asks for them. When you give us information directly, you authorise that overseas handling, and you should be aware that the protections in the United States may not be comparable to New Zealand law.
• Access and correction. You may ask for access to, or correction of, your personal information as section 11 describes (IPPs 6 and 7). We respond within 20 working days and tell you if we need to extend that period. If we decline to make a correction, you may ask us to attach a statement of the correction you sought.
• Retention and security. We keep personal information only for as long as it is needed for a lawful purpose, using the periods in section 9 (IPP 9), and protect it with the safeguards in section 10 (IPP 5).
• Privacy officer. Our privacy team (section 1) performs the privacy officer role that the Privacy Act 2020 requires of every agency.
• Privacy breaches. If a privacy breach is likely to cause serious harm to affected individuals, we notify the Office of the Privacy Commissioner and the affected individuals as soon as practicable. For practice data we notify the practice immediately so that it can do so.
• Marketing messages. Product and service updates to account holders are sent on the basis of your consent as an existing customer, identify us, and include an unsubscribe facility that we honour within five working days, as the Unsolicited Electronic Messages Act 2007 requires.
• Complaints. Send complaints to the privacy team. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner at privacy.org.nz.

16. AI features and automated decision-making

Two of our channels are operated by artificial intelligence, and both tell you so when the conversation starts.

• Website chat assistant. Your messages, along with the page you are on and our public documentation, are sent to a large-language-model provider (section 7) to generate the answer. The conversation is stored with your IP address and browser type for 24 months so that we can follow up if you ask us to and improve our documentation. It is not used to train models.
• Phone line. Calls are answered by a conversational AI assistant provided by ElevenLabs. The call audio is processed to transcribe and understand it, and we keep a written summary, the caller number, the call time and duration, and any name, company, email address or use case you provide, for 24 months, so that returning callers are recognised and our team can follow up. We do not keep the audio recording after the summary is produced. If you would rather not talk to an AI assistant, ask for a person or email [email protected].
• Natural-language query features in the developer portal send the text of your query, and not practice records, to a model provider to translate it into a structured request.

None of these features makes decisions that produce legal or similarly significant effects on you, and the assistants' answers are informational only. A person reviews any commitment made on our behalf before it is acted on.

17. Children

Our website and developer portal are intended for adults acting for a business, and we do not knowingly collect personal information from anyone under 18 through them. Practices may process the records of minors through the Services; that data is the practice's, subject to the parental-consent and health-information rules that apply to the practice. If you believe a child has given us information directly, contact the privacy team and we will delete it.

18. Changes to this policy

When we make material changes, we update the date at the top of this page, notify developer-portal account holders by email or by a notice in the portal at least 14 days before the change takes effect, and, where the law requires it, ask for your consent. We review this policy at least once every 12 months.

• Version 2.0, September 12, 2026: full rewrite to separate our controller and processor roles, add the cookie inventory, subprocessor table, retention periods, AI disclosures, and jurisdiction sections for the United States, Canada, the EU and UK, and Australia and New Zealand, and remove statements about image analysis and model training that did not reflect our practices.
• Version 1.0, April 30, 2025: initial policy.

19. Contact and complaints

If we cannot resolve your concern, you may contact:

• United States, health information: U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr.
• California: the California Privacy Protection Agency or the California Attorney General. Other states: your state attorney general.
• Canada: the Office of the Privacy Commissioner of Canada at priv.gc.ca, or your provincial privacy or health-information commissioner.
• EEA, UK and Switzerland: your national supervisory authority, the UK Information Commissioner's Office at ico.org.uk, or the Swiss FDPIC.
• Australia: the Office of the Australian Information Commissioner at oaic.gov.au, or your state or territory health or privacy commissioner.
• New Zealand: the Office of the Privacy Commissioner at privacy.org.nz.