Privacy Policy

Last updated: July 13, 2026

This Privacy Policy explains how CaseFlow AI ("CaseFlow," "we," "us") collects, uses, and protects information when dental practices use our service and when patients view treatment plan summary pages.

1. Information We Collect

• Account information — name, email address, practice name, role, and login credentials for practice users.
• Practice content — treatment plan documents, X-ray and other clinical images, practice branding (logos, team photos), and financing options that practices upload.
• Patient information within practice content — uploaded documents may contain patient names, treatment details, and cost information. Practices control what they upload; we process it on the practice's behalf.
• Summary page analytics — when a summary page is viewed, we record the time of view, IP address, browser user agent, referrer, and an anonymous visitor cookie (cf_visitor_id) used to distinguish unique and returning visits. We do not ask patients for their identity.

2. How We Use Information

• To provide the service: extracting treatments from uploaded documents, generating patient-friendly summaries, and hosting shareable summary pages.
• To show practices engagement analytics for their own plans.
• To secure, maintain, and improve the service.
• We do not sell personal information, and we do not use patient information for advertising.

3. AI Processing

Uploaded documents and images are processed using Anthropic's Claude API to extract treatment information and generate summaries. We configure our AI providers under commercial terms that prohibit them from training models on our customers' content.

4. Service Providers

We use a small number of infrastructure providers to operate the service, including Supabase (database and file storage), Railway (application hosting), Anthropic (AI processing), and our email delivery provider. Each processes data only as needed to provide their service to us.

5. HIPAA

Where CaseFlow acts as a business associate to a dental practice under HIPAA, our handling of protected health information is governed by an executed Business Associate Agreement, which controls in the event of any conflict with this policy.

6. Data Retention and Deletion

Practice content is retained while the practice's account is active. Practices may delete individual plans at any time, and may request deletion of their account and all associated data by contacting us. We delete or de-identify data within 30 days of a verified request unless retention is required by law.

7. Security

We use encryption in transit (HTTPS), access controls including row-level security on our database, secure session management, and rate limiting. No system is perfectly secure; we will notify affected practices of any breach as required by law.

8. Cookies

We use strictly necessary cookies for login sessions and CSRF protection, and an anonymous visitor cookie on summary pages for view analytics. We do not use third-party advertising cookies.

9. Your Rights

Depending on your location, you may have rights to access, correct, or delete your personal information. Practice users can exercise these rights by contacting us. Patients should direct requests to their dental practice, which controls their treatment information; we will assist the practice in fulfilling such requests.

10. Changes

We may update this policy from time to time. Material changes will be communicated via the service or email.

11. Contact

Privacy questions or requests: [email protected]