Privacy policy

This policy explains which personal data is processed when you use the dental-connect.fr website, the Dental Connect web app and the Dental Connect mobile app (iOS and Android), why, and what your rights are.

1. Who we are

Dental Connect is published by Levupp (French SARL, 847 918 810 R.C.S. Marseille, 16 rue Grignan, 13001 Marseille, France) for the New Image dental laboratory. For any question about your data: hello@levupp.com.

For your account data and use of the service, Levupp is the data controller. For patient data you enter in a prescription, the practitioner remains the controller of their patient records: Levupp and the laboratory process it on their behalf, solely to manufacture, deliver and invoice the requested prostheses.

2. Data we process

Your account

• First and last name, email address, phone number, practice and role.
• Password, stored only in hashed form (irreversible).
• Preferences: language, theme, notification settings.

Your activity with the laboratory

• Prescriptions, pickup requests, deliveries, date change requests.
• Messages and comments exchanged with the laboratory.
• Delivery notes, invoices, credit notes and payments.

Patient data

A prescription contains the patient's identity and the information needed for the prosthesis (teeth, shade, instructions) and, where applicable, photos of the teeth and digital impression files. This is health data: it is only accessible to authorised users of your practice and of the laboratory, and to partner laboratories that manufacture part of the work, to the extent they need it.

Technical data

• Your device's notification token and related technical information (operating system, app version), to send you notifications.
• Login and security logs (date, IP address), to protect accounts and the service.

3. Mobile app permissions

The app only asks for a permission when you use the related feature:

• Camera: scan a prescription's QR code and take photos of a patient's teeth.
• Photos: attach an existing photo to a case. Only the photos you pick are sent.
• Notifications: keep you informed about your cases. A notification never contains a patient's name, only the case number and the event.
• Face ID or fingerprint: unlock the app. Verification is done by your device; no biometric data is ever sent to us.

The app does not access your location, your contacts or the microphone.

4. Why we process it

• To provide the service (performance of the contract between your practice and the laboratory): prescriptions, production, pickups, deliveries, messages and notifications.
• To invoice and meet our legal obligations (accounting, traceability of custom-made medical devices).
• To secure accounts and the service (legitimate interest): authentication, logs, abuse prevention.

We do not sell any data, we do not advertise, and we use no advertising trackers or audience measurement tools, neither on the website nor in the app.

5. Cookies

The dental-connect.fr website only sets one technical cookie, which remembers your language. The web app uses a session cookie, required to keep you logged in. These strictly necessary cookies do not require consent.

6. Who receives the data

• Authorised users of your practice and of the New Image laboratory, according to their role.
• Partner laboratories that manufacture part of the work, for the cases that concern them.
• Our technical providers, acting on our instructions: hosting (OVH, in France), email delivery, push notifications (Expo, Apple, Google), accounting software for invoices.

Data is hosted in the European Union. Push notifications go through Apple, Google and Expo services, which may be located outside the European Union: this is why they contain no patient data. These transfers are covered by the safeguards provided by the GDPR (standard contractual clauses or adequacy decision).

7. How long we keep it

• Account: while it is active, then deleted or anonymised when closed.
• Prescriptions, patient data and manufacturing history: for the duration of the relationship with the laboratory, then archived for the period required by the regulations on custom-made medical devices.
• Invoices and accounting records: 10 years.
• Security logs: 12 months at most.
• Notification token: deleted when no longer valid or when the account is closed.

8. Security

All traffic is encrypted (HTTPS). Each laboratory's data is isolated and each user only accesses what their role allows. Passwords are never stored in plain text, mobile app sessions are kept in the device's secure keychain and data is backed up daily.

9. Your rights

You can access, rectify or erase your data, restrict or object to its processing, and request its portability by writing to hello@levupp.com. Requests about a patient's data are handled with the practitioner who prescribed.

Delete your account: email hello@levupp.com from your account's address. We delete your account and personal data within 30 days, except for what the law requires us to keep (invoices, prosthesis traceability). The detailed procedure is on the Account deletion page.

If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

10. Audience

Dental Connect is a professional service for dental practices and the laboratory. It is not directed at children.

11. Changes

We may update this policy, for example when a feature is added. The last update date is shown at the top of the page; for significant changes, we will let you know in the app.