Privacy Policy
Effective Date: February 10, 2026
Last Updated: February 10, 2026
1. Who We Are
This Privacy Policy applies to Dentour Group S.R.L., a company registered in the Republic of Moldova under IDNO 1026023141581, with its registered office at str. Constantin Stere 16, MD-2009, Chișinău, Republica Moldova, operating the dental services marketplace under the brand "Dentour" through the following websites and applications:
- dentour.eu (European Union)
- dentour.md (Republic of Moldova)
- dentour.co.il (State of Israel)
(collectively, the "Platform")
Throughout this Policy, "Dentour," "we," "us," or "our" refers to Dentour Group S.R.L.
Contact details:
- Email: privacy@dentour.eu
- Data protection inquiries: dpo@dentour.eu
We act as the data controller for the personal data we collect through the Platform, except where this Policy states otherwise (see Section 6 — Sharing with Clinics).
2. What This Policy Covers
This Policy describes how we collect, use, share, and protect personal data when you:
- Visit any of our websites
- Create a patient or clinic account
- Submit a quote request or upload dental records
- Communicate with us or with clinics through the Platform
- Receive marketing communications from us
This Policy applies to patients, clinic staff, dental professionals, and visitors to our Platform.
3. Data We Collect
3.1 Data You Provide Directly
| Category | Examples | When Collected |
|---|---|---|
| Identity data | Full name, date of birth, gender | Account creation, profile setup |
| Contact data | Email address, phone number | Registration, onboarding |
| Account credentials | Email/phone used for login (we do not store plaintext passwords) | Registration |
| Health and dental data | Dental procedures of interest, symptoms, dental history, medical conditions, uploaded dental X-rays, treatment preferences | Patient onboarding, quote requests |
| Communication data | Messages sent through the Platform, notes on quote requests, communication preferences | Ongoing use |
| Clinic and professional data | Clinic name, address, specializations, pricing, photos, staff profiles | Clinic onboarding |
| Payment data | We do not directly collect or store payment card numbers. Payment processing is handled by Stripe, Inc. | Booking and payment |
| Feedback and reviews | Clinic reviews, ratings, review replies | Post-treatment |
3.2 Data Collected Automatically
| Category | Examples | Technology |
|---|---|---|
| Device and browser data | IP address, browser type and version, operating system | Server logs, analytics |
| Usage data | Pages visited, time on page, click patterns, referral source | Analytics cookies (with consent) |
| Cookie and tracking data | Session identifiers, language preference, consent state | Cookies (see Section 12) |
| Location data | Country and city derived from IP address (no GPS tracking) | Server-side geolocation |
3.3 Data from Third Parties
We may receive data from:
- Authentication provider: Authentication events, email/phone verification status
- Clinics: Treatment plans, price quotes, and clinical notes provided in response to your requests
- Public sources: Clinic business registration data used for verification
- Review platforms: Where a clinic's Google Business listing is linked to its Dentour profile, we receive from Google Maps the reviewer's display name, public profile photo and profile link, their star rating, the review text, and its publication time. We do not receive their email address or any account identifier. We display this content unchanged, alongside Google's attribution, so that people comparing clinics can see what patients have said publicly. We refresh it daily and delete it within 30 days of the last refresh. If you wrote such a review and do not want it shown on Dentour, email privacy@dentour.eu — we will remove it and stop importing it again. We cannot change or remove anything on Google itself.
4. How and Why We Use Your Data
| Purpose | Data Categories | Lawful Basis (GDPR) |
|---|---|---|
| Create and manage your account | Identity, contact, credentials | Performance of contract (Art. 6(1)(b)) |
| Facilitate quote requests | Health data, identity, contact | Explicit consent (Art. 9(2)(a)) for health data; contract for account-level data |
| Enable clinics to respond with treatment plans | Health data, identity | Explicit consent (Art. 9(2)(a)) |
| Process payments and bookings | Identity, contact, transaction references | Performance of contract (Art. 6(1)(b)) |
| Communicate with you | Contact, communication | Performance of contract (Art. 6(1)(b)) |
| Send marketing communications | Contact, preferences | Consent (Art. 6(1)(a)) |
| Operate and improve the Platform | Device/browser, usage, cookies | Consent for analytics cookies; legitimate interest for server-side diagnostics |
| AI-assisted features | Health-adjacent input, text you provide | Explicit consent (Art. 9(2)(a)) when input includes health data |
| Comply with legal obligations | Identity, contact, transaction | Legal obligation (Art. 6(1)(c)) |
| Prevent fraud and enforce terms | Identity, device, usage | Legitimate interest (Art. 6(1)(f)) |
Where We Rely on Consent
When we process your data based on consent (including explicit consent for health data), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal. To withdraw consent:
- For marketing: click "unsubscribe" in any email, or update preferences in your account settings
- For health data processing: contact us at privacy@dentour.eu — note that withdrawal may prevent us from facilitating quote requests on your behalf
- For cookies: use the cookie preference panel on our websites
Where We Rely on Legitimate Interest
Where we rely on legitimate interest, we have conducted a balancing test to ensure our interests do not override your fundamental rights. You may object to processing based on legitimate interest at any time (see Section 9).
Whether You Must Provide Data
Some personal data is required to use our services; other data is optional:
- Required for account creation: Email address or phone number. Without this, we cannot create your account or authenticate you.
- Required for quote requests: At minimum, the dental service(s) you are interested in and your contact details.
- Optional: Date of birth, gender, medical conditions, dental history, X-ray uploads, marketing preferences. You may use the Platform without providing these, though the quality or relevance of responses from clinics may be reduced.
- Consequences of not providing data: If you choose not to provide required data, we may be unable to provide the specific service that requires it. We will inform you at the point of collection which fields are mandatory.
5. Health Data and Special Category Data
5.1 What Constitutes Health Data
Under applicable data protection laws, the following data we process qualifies as health-related or "special category" data:
- Dental procedures you are seeking (e.g., implants, crowns, orthodontics)
- Symptoms you report during onboarding
- Medical conditions disclosed in your patient profile
- Dental history information
- Dental X-ray images (radiographs) you upload
- Treatment plans and clinical notes provided by clinics through the Platform
5.2 How We Protect Health Data
- Explicit consent: We only collect and process health data after you provide explicit, informed consent — separately from general terms acceptance.
- Purpose limitation: Health data is used only to facilitate your dental care inquiry.
- Minimization: We collect only the dental/health information necessary to process your request.
- Access controls: Health data is accessible only to authorized personnel and the specific clinics you choose to share with.
- Encryption: Health data is encrypted in transit (TLS 1.2+) and at rest using industry-standard encryption provided by our infrastructure providers.
- No sale: We never sell your health data. We never use health data for advertising or profiling.
5.3 What We Do NOT Do
- We do not provide medical diagnoses. Dentour is a marketplace connecting patients with clinics. Nothing on the Platform constitutes medical advice.
- We do not make treatment decisions. All treatment decisions are between you and your chosen dental clinic.
- We are not a healthcare provider.
6. Who We Share Your Data With
6.1 Dental Clinics
When you submit a quote request, we share your relevant data with the clinics you selected (or that match your request). Each clinic is an independent data controller for the data it receives. Clinics are bound by their own data protection obligations and by our Platform terms, which require them to:
- Use patient data only for responding to quote requests and subsequent treatment
- Implement appropriate security measures
- Not share your data with third parties without your consent
- Delete your data if you withdraw consent, unless they are independently required by law to retain certain records
6.2 Service Providers (Sub-Processors)
We share data with categories of service providers who process data on our behalf under written data processing agreements, including: cloud infrastructure, hosting and CDN, API infrastructure, payment processing, email delivery, SMS/messaging, and analytics providers.
6.3 Other Disclosures
We may disclose your data:
- To comply with law: When required by applicable law, regulation, legal process, or governmental request
- To protect rights: When necessary to enforce our terms, protect our rights or safety, or protect others
- In corporate transactions: In connection with a merger, acquisition, or sale of assets — you will be notified
- With your consent: For any other purpose, with your explicit consent
6.4 No Sale of Personal Data
We do not sell your personal data to third parties. We do not share your personal data with third parties for their own direct marketing purposes without your explicit consent.
7. International Data Transfers
We operate across multiple countries and transfer your data internationally. In particular, dental care is delivered by clinics in Moldova, which does not benefit from a European Commission adequacy decision. Because health data is a special category of personal data, we apply supplementary measures to protect it — including encryption at rest and access logging on the records concerned.
We are putting the appropriate Article 46 transfer safeguards in place (Standard Contractual Clauses together with a transfer impact assessment). Until those safeguards are executed we do not rely on them, and this notice will be updated to describe the transfer mechanism actually in force.
You may request the current status and a copy of any applicable transfer safeguards by contacting us at privacy@dentour.eu.
8. How Long We Keep Your Data
We retain personal data only as long as necessary for the purposes described in this Policy, or as required by law.
Retention principles:
- We keep data for the minimum period necessary to fulfill the purpose for which it was collected.
- Where a legal obligation requires longer retention, that obligation takes precedence.
- Health and dental data receives the shortest defensible retention consistent with the service you requested.
- When the retention period ends, data is securely deleted or irreversibly anonymized.
| Data Category | Retention Period | Reason |
|---|---|---|
| Active patient account data | Duration of account + 3 years after deletion | Contractual necessity, dispute resolution |
| Health data (X-rays, treatment requests) | 2 years after last related quote activity, or until deletion request | Purpose limitation |
| Completed quote/treatment data | 5 years from completion | Legal obligation, dispute resolution |
| Third-party review content (Google Maps) | Refreshed daily; deleted 30 days after the last refresh | Google Maps Platform caching limits — we may not keep this content beyond 30 days — and purpose limitation. This is a shorter period than anything else in this table for that reason. |
| Marketing consent records | Duration of consent + 3 years | Accountability |
| Communication logs | 3 years | Dispute resolution, compliance |
| Analytics / cookie data | 13 months maximum (where consent-based) | Regulatory guidance |
| Payment transaction records | 7 years | Tax and accounting obligations |
Patient-initiated deletion: You may request deletion of your account and associated data at any time (see Section 9). We will comply within 30 days, except where we are legally required to retain certain records.
9. Your Rights
Depending on your location, you have the following rights regarding your personal data:
| Right | Description |
|---|---|
| Access | Request a copy of the personal data we hold about you |
| Rectification | Request correction of inaccurate or incomplete data |
| Erasure | Request deletion of your personal data |
| Restriction | Request that we limit how we process your data |
| Portability | Receive your data in a structured, machine-readable format |
| Objection | Object to processing based on legitimate interest or for direct marketing |
| Withdraw consent | Withdraw previously given consent at any time |
| Automated decisions | Not be subject to decisions based solely on automated processing that produce legal effects. We do not currently make any such decisions. |
| Lodge a complaint | Complain to a supervisory authority |
How to Exercise Your Rights
- Online: Use the "Privacy" section in your account settings (where available)
- Email: Send your request to privacy@dentour.eu
- Response time: We will respond within 30 days. If we need more time, we will inform you within the initial period.
Supervisory Authorities
You have the right to lodge a complaint with a data protection authority:
- EU: Your local data protection authority
- Moldova: National Centre for Personal Data Protection (NCPDP) — datepersonale.md
- Israel: Privacy Protection Authority (PPA) — gov.il
10. Security
We implement technical and organizational measures appropriate to the risk, including:
- Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher
- Encryption at rest: Database and file storage are encrypted at rest using industry-standard encryption
- Access controls: Role-based access control (RBAC) with principle of least privilege
- Logging and monitoring: Access to personal data is subject to logging and monitoring for audit and security purposes
- Regular updates: Dependencies and infrastructure regularly patched
We do not guarantee absolute security. If you believe your account has been compromised, contact us immediately at security@dentour.eu.
11. AI Features
11.1 How We Use AI
Dentour may use artificial intelligence and automated tools to:
- Help you categorize your request: Our system may suggest relevant service categories to help you choose the right type of care
- Structure and format quote requests: AI may help organize and present your request clearly for clinics
- Generate and translate clinic descriptions: AI may assist in creating or translating clinic profile content
These features are designed as user-experience assistants — they help you navigate the platform and articulate your needs. They are not clinical or diagnostic tools.
11.2 What AI Does NOT Do
- AI does not diagnose medical or dental conditions. Any suggestions are purely informational. They are not medical advice and should not be relied upon for any health-related decision.
- AI does not make treatment decisions. Always consult a licensed dentist before making decisions about dental care.
- AI does not autonomously decide which clinics receive your data, what price to quote, or whether to approve or deny any request.
11.3 Your Data and AI
- We do not use your personal data to train general-purpose AI models.
- Where AI features are enabled, we may use third-party AI service providers as sub-processors. These providers are contractually prohibited from using your data for their own training purposes.
- We do not make solely automated decisions that produce legal effects or similarly significant effects on you without meaningful human involvement.
11.4 Opting Out
You may choose not to use AI-assisted features. Core platform functionality (manual clinic browsing, direct quote requests) is available without AI features.
12. Cookies and Tracking Technologies
12.1 Types of Cookies We Use
| Cookie Type | Purpose | Consent Required? |
|---|---|---|
| Strictly necessary | Authentication, session management, security, language preference | No (exempt) |
| Analytics | Understanding how visitors use our site | Yes |
| Marketing | Measuring advertising effectiveness | Yes |
| Personalization | Remembering your preferences | Yes |
12.2 Managing Cookies
When you first visit our site, a cookie consent banner allows you to accept all cookies, accept only strictly necessary cookies, or customize your preferences by category.
You may change your cookie preferences at any time through the cookie settings link in the website footer or by clearing your browser cookies.
13. Marketing and Communications
13.1 Your Choices
- Opt-in: We ask for your marketing consent separately from terms acceptance. Pre-checked boxes are not used.
- Opt-out at any time: Every marketing message includes an unsubscribe mechanism.
- Transactional messages: Even after opting out of marketing, you will continue to receive essential service communications.
- Granularity: You may opt in or out per channel (email, SMS, WhatsApp) through your notification preferences.
14. Children and Minors
Our Platform is intended for users aged 18 and older. We do not knowingly collect personal data from individuals under 18. If you believe that a person under 18 has provided us with personal data, please contact us at privacy@dentour.eu and we will promptly delete the data.
15. Jurisdiction-Specific Information
15.1 For Users in the European Economic Area (EEA)
You have all rights under Chapters III and VIII of the GDPR. If required under GDPR Art. 27, we will appoint an EU representative before launch. Details will be published here once confirmed.
15.2 For Users in the Republic of Moldova
You have all rights under Chapter III of Law 133/2011. We will complete any required registrations with the NCPDP prior to large-scale processing of health data of Moldovan users. Response time for data subject requests: 15 calendar days.
15.3 For Users in Israel
Your rights are governed by the Protection of Privacy Law, 5741-1981, and the Data Security Regulations, 5777-2017. We will complete any required database registrations prior to launch of services directed at Israeli users.
15.4 For Users Outside These Jurisdictions
If you access our Platform from a country not specifically addressed above, we apply the highest applicable standard of data protection described in this Policy.
16. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will post the updated Policy with a new "Last Updated" date and notify registered users at least 14 days before changes take effect.
17. Contact Us
- General privacy inquiries: privacy@dentour.eu
- Data protection contact: dpo@dentour.eu
- Security concerns: security@dentour.eu
We aim to respond to all inquiries within 5 business days and resolve data subject requests within the applicable statutory period.
This Privacy Policy is available in English. Translations are provided for convenience. In the event of any conflict between the English version and a translated version, the English version shall prevail.