Privacy policy

Who we are

Klint Dental is a product of I+ Innovaciones Tecnologicas, whose details appear above. For any question about this policy or about your data, write to us at hola@klintdental.com.

When we decide and when the clinic decides

This policy covers two different situations:

• On this site and when you write to us, we are the data controller: we decide why and how that data is used.
• In the software, each clinic is the controller of the data of its patients and its team. We are the processor: we handle that data on the clinic's behalf and following its instructions.

If you are a patient of a clinic that uses Klint, your first point of contact is that clinic. If you write to us, we pass your request on to it.

Data on this site

This site has no forms or accounts, uses no cookies and has no third-party analytics or advertising. We only handle the following:

• Server logs: IP address, date and time, page requested, referring page, language and browser details. We use them to keep the site secure and running, which is our legitimate interest. They overwrite themselves as their allotted space fills up.
• Email: if you write to us, your address and what you tell us. We use them to reply and, if you ask, to prepare a proposal. We keep them for as long as the conversation or the business relationship lasts.
• Language: if you switch languages, your browser stores that choice on your device and does not send it to us. The address of each page does show which language it is in.

Data in the software

The clinic enters it and its team uses it:

• About the clinic's team: name, email, role, activity in the system, IP address and browser, and professionals' fee data.
• About patients: identification and contact details, appointments, medical history and signature, clinical notes, prescriptions, tooth chart, periodontal chart, implants, aligners, photos and files, treatment plans, transactions, surveys and messages, plus the IP address and browser used to complete a form. Health data is sensitive data.
• About other contacts: name, phone and notes on people who ask the clinic about something without being patients.

We use it only to provide the service to the clinic, support it and keep it secure. We do not sell it or use it for advertising. If the support team needs to enter a clinic, that access is recorded in the audit log.

The clinic must have the legal basis to process its patients' data, including consent where applicable. The software lets it record that in the signed medical history or by attaching the signed consent document.

Artificial intelligence and dictation

The AI features help professionals write and organize information. Before sending a text to the AI provider, the system replaces the patient's name, ID number, phone and email with placeholders. This is not anonymization: the clinical content is sent, and other data that gets typed or dictated, such as a relative's name or an address, may reach the provider.

Voice dictation may use the browser's speech recognition or a transcription service on the server. The recording may include the patient's voice. On the server, the audio and its transcript are stored temporarily: they are deleted after 24 hours or within the period the clinic sets, up to 30 days, and a technical copy of the audio may be kept for up to 90 more days.

No decision about a person is made automatically. What the AI proposes for a clinical note is a draft that a professional reviews and signs. Its other answers are support for the team, which decides what to do with them.

Providers and international transfers

Our servers are not in Paraguay. These are the providers that may receive data:

• Google Cloud: hosting, database and files in São Paulo, Brazil, and encrypted database backups in South Carolina, United States.
• Anthropic: AI features. It receives the text with the patient's data pseudonymized, the clinical content and the team names needed.
• OpenAI: server-side transcription of dictation, when used. It receives the audio.
• The browser's speech service, for example Google in Chrome: it receives the audio when dictating with that option, under the browser maker's terms.
• Meta (WhatsApp): messages from the clinic, if it turns them on. It receives the phone number of the patient or their guardian and what each message carries: first name, clinic, branch, professional, date and time; on receipts and adjustments, amount, receipt number, balance and reason; form links and codes; and, on completing the medical history, a PDF copy of the health history.
• Google Calendar: if the clinic connects it, with no clinical data.
• Email: InMotion Hosting, which also hosts our mailboxes, and later Brevo. They send invitations, codes, security and account notices, export links and, on completing the medical history, a PDF copy of the health history to the patient's email, which also stays with that person's email provider.
• Have I Been Pwned: to check whether a password has leaked, it receives only the first characters of its hash, never the password.

Apart from the main hosting, these services process data mainly in the United States. Before real patient data is processed, these transfers rely on agreements with each provider, with the safeguards required by article 19 of Law No. 7593/2025.

Security and incidents

Connections to this site and to the software are encrypted. For patients, the ID number, tax ID, phone, email, address, guardian's phone, allergies, medical background, medication, health and comfort notes, alerts, administrative notes and form answers and signatures are stored encrypted field by field. The name, date of birth, clinical notes, tooth chart, periodontal chart and files do not have this additional encryption. Access depends on each user's role; writes, opening the chart and reads of its clinical data and documents are recorded in an audit log; and the daily database backups are encrypted.

No system is infallible. If an incident occurs, we notify the affected clinic without delay and, together with it, the supervisory authority and the people affected where applicable. The law sets a maximum of 72 hours to notify the authority from the moment the incident becomes known.

How long we keep data

In the software, during the contract and, afterwards, as explained below. The daily database copy in the United States is kept for 35 days and the monthly one for a year; the database copies in Google Cloud, for up to 30 days; earlier versions of files, for 90 days; and the audit log, for 10 years.

When a clinic closes its account, we generate an export of its data and documents. Data is not deleted automatically. With the account closed and the export already downloaded, the clinic's key can be destroyed by hand: the encrypted fields become unreadable, and this is final once the last backup holding that key expires, up to a year later. What is not encrypted is kept, such as the name, date of birth, clinical notes, tooth chart, transactions, files and audit log, because the medical record must be preserved for the legal period.

Your rights

Paraguay's Law No. 7593/2025 on Personal Data Protection gives you these rights:

• Information: knowing how your data is handled.
• Access: obtaining a copy of your data.
• Rectification: correcting what is wrong or out of date.
• Erasure: asking for it to be deleted, unless it must be kept by law, like the medical record.
• Objection: asking for it to stop being processed, on grounds relating to your particular situation.
• Portability: asking for it to move to another controller, electronically.
• Review of automated decisions.
• Withdrawing your consent at any time, when that is the basis for processing.

To exercise them, write to us at hola@klintdental.com. It is free, we will ask you to prove your identity and we reply within 30 calendar days at most. The medical record and transactions are not deleted; other data is reviewed case by case and corrected or deleted by hand.

If we do not reply or the answer is not enough, you can turn to the Agencia Nacional de Protección de Datos Personales (Paraguay's data protection agency) or file a habeas data action.

The law comes into force 24 months after its publication on November 27, 2025. We apply these criteria from now on.

Minors

This site is not directed at minors. In the software, a minor's data is entered by their clinic, which must have the consent the law requires: from whoever holds parental authority, custody or guardianship if the minor is under 16 and, for sensitive data of an adolescent aged 16 or older, also the adolescent's own.

Changes

If we change this policy, we publish the new version with its date. If the change is significant, we tell clinics before it takes effect.