Privacy Policy

Effective date: October 5, 2026

Pre-production: synthetic test data only. Do not upload real patient or practice records. Privacy review, retention and deletion procedures, and recovery acceptance must be completed before real practices use the Service. Features described below may still be staged; their description is not confirmation that they are enabled on this project.

MolarOps (“we”, “us”, or “our”) is committed to protecting the privacy of the dental practices and professionals who use The IPAC Manual and Compliance OS (the “Service”). This Privacy Policy explains how we collect, use, store, and share your personal information.

1. Information we collect

We collect the following types of information:

  • Account information: email address, practice name, and any information you provide when creating or managing your account.
  • Manual content: the chapters, customizations, edits, and compliance logs you create or upload to the Service. While your practice’s owner is signed in, the manual is also saved with your practice’s account (its chapters and their history, the details you typed into it and the figures you pasted there) so that another browser can open it. We can read that copy, and only your practice’s owner reads or changes it.
  • A patient reference, if you enter one: the compliance record has one field made to identify a patient, the patient reference on a recall (a chart number or initials), which a practice fills in only when a failed sterilizer load has to be traced to the people who received instruments from it. It is optional. There is no patient roster and no demographics anywhere in the Service. The logs of an emergency or an injury (the medical emergency, opioid response, sharps exposure and first-aid records) never ask who it was: each gives the event a case number, which your staff write in the patient’s chart or the worker’s incident report, and keeps what happened and what was done under that number. They take no photographs. Logs that keep a reference, such as an outbreak’s line list or a lab case, ask for a code, never a name or chart number. Section 4a says how the record reaches us and who can read it.
  • Payment information: processed by our third-party payment provider. We do not store complete payment card details.
  • Usage data: device type, browser, IP address, pages visited, and error logs, used only to operate and improve the Service.

2. How we use your information

We use your information to:

  • generate, deliver, and back up your manual;
  • provide and maintain the Service, including support and security;
  • process payments and send billing-related notices;
  • communicate updates, legal notices, and relevant product information;
  • improve the Service and detect or prevent abuse.

3. Where we store your data

Data is stored with cloud service providers located in Canada, the United States, and other jurisdictions. By using the Service, you consent to this transfer, storage, and processing. We use reasonable technical and organizational measures to protect your data.

4. Patient health information

The Service is an infection-control record, not a patient-records system. It is designed to hold as little identifying information as possible. The patient reference on a recall, described in section 1, identifies a person in the hands of the practice that assigned it and relates to their care, so we treat it as personal health information under PHIPA. With Cloud Sync it is kept on our servers apart from the rest of the record, and your practice’s owner sees it on the website only after two-step sign-in and typing a reason; every look is logged (section 4a).

The emergency and injury records described in section 1 keep what happened and what was done, such as the signs, the times and the care given, under a case number and never a name: only your practice’s chart or incident report links that number to a person. They are an ordinary part of the record, which we can read with Cloud Sync. They do not have the recall patient reference’s separate, reason-required access control; a code linked to a person can still be health information. Beyond those, please do not enter patient names, health card numbers, chart numbers or clinical details anywhere in the Service, including in notes, reasons, manual text, or photographs of log sheets: every note box says not to type patient names or chart numbers there. You are responsible for any such information you choose to include.

4a. Cloud Sync

Cloud Sync keeps your practice’s compliance record on our servers in Canada, so that your iPad and your website work from the same record. It is on for every practice: your iPad signs in with your practice’s account, with two-step sign-in, before it records anything, and then sends each entry once it is saved there. There is no setting that turns it off. It is not end-to-end encrypted: we can read it. It travels over an encrypted connection and our hosting provider encrypts its storage, but it is not sealed under a key only your practice holds. That is how the Service checks each change as it arrives and shows the record on your website.

  • What we hold and can read: your logs and everything recorded in them, with who recorded each and when; corrections, issues, recalls and closed days; your setup, including staff names and roles; the notes and reasons your staff type; the emergency and injury records, under their case numbers (section 1); photographs of completed sheets and the spreadsheets you bring in; and each patient reference on a recall, with the load it was on.
  • How patient references are kept: apart from the rest of the record, each checked as it arrives against the record’s own fingerprint for it. Your practice’s owner sees one on the website only after two-step sign-in and typing a reason, and every look is logged, by us and as a security event. Photographs are shown to the owner after two-step sign-in, each checked against its fingerprint first.
  • What never leaves your iPad: staff PINs, and the iPad’s own log of who revealed a patient reference there, and why.
  • Your website keeps no copy of the record. It reads the record from our servers and shows it while the page is open. Logging stays on your iPad; the website changes your setup, with your practice’s management PIN. A record a browser kept for you before Cloud Sync stays in that browser until you remove it.
  • If your practice leaves, it cancels its subscription. What is already on our servers remains readable and exportable while your account retains access. Account closure removes that access, so export first. A written erasure request is assessed against the approved retention schedule, legal holds and provider-backup limits; it is not an immediate or automatic deletion of every copy.

5. Sharing your information

We do not sell your information. We share it only with service providers who help us operate the Service, hosting and authentication, payment processing, email delivery, the AI provider described immediately below, and a password-breach screening service that receives only the first five characters of a hash of a password you choose (never the password, and never your address), and only to the extent necessary. We may also disclose information if required by law or to protect our rights.

5a. AI features and what they send

Several optional features send content to an AI provider to draft text on your behalf. None of them runs on its own: each is behind a button you press, and the Service works without any of them.

Practice-content AI requests use configured Canadian endpoints. We route them to Google Cloud (Vertex AI) in a Canadian region. They reach it through Supabase, which relays them and does not store them, and which we require to run in Canada as well. Vercel, which serves these pages, is no longer in that path at all.

These regional routes are not a guarantee that every provider support, logging or optional search-grounding operation stays in Canada. The applicable provider terms, features and account settings must be reviewed before real practice content is used.

One feature is different, and it is the one that sends nothing of yours. When the Service checks a public regulator page — the College’s standard, Public Health Ontario’s guidance — and summarises what changed since the last check, that comparison is sent to xAI (Grok), in the United States. What it receives is the difference between two versions of a document anyone can read on the regulator’s own website. Your manual, your records, your answers and your uploads are never part of it.

  • Revise, tailor, clean up, or update a chapter: sends that chapter’s text — for “Clean up with AI”, the text you pasted — and, where you typed one, your instruction. Your practice details — the name, principal dentist, IPAC lead, operatory and staff counts — are not sent. The draft comes back with blanks like[IPAC Lead] and this device fills them in afterwards.
  • Research a topic: sends your question to Vertex AI in Canada. When the official sources do not answer it, Google also searches the web on its own servers, so your question reaches search results through them. No separate search company is involved.
  • Build a log from a sheet: if you upload a photo or image, that image is sent. If you upload a PDF, the PDF is read on our server and only the text it contains is sent. Upload a blank template only. A filled-in sheet routinely carries staff initials and can carry chart identifiers, and nothing in the Service can detect that for you.
  • Read a photographed sheet: only if the practice owner has turned this on under Manage. A photo of a completed paper log — with staff initials and results on it — is sent to Vertex AI in Canada so the rows can be read back for a person to check against the photo before anything is saved. The copy sent has the phone’s location and device details removed. Never use it for a sheet carrying patient information.
  • Map spreadsheet columns: sends the column headings from the file you are importing. No row of your spreadsheet is sent.
  • Summarise a regulator update: sends the difference between two fetches of a public page — the only feature whose request goes to xAI rather than to Vertex AI, and the only one that contains nothing of yours. Reading the regulator’s PDF sends nothing at all: it is fetched and read on our own server.

Your stored compliance record is never sent to any AI provider — with the one exception listed above, and it is worth repeating beside this sentence rather than leaving it several paragraphs up: if the practice owner has turned on “Read a photographed sheet”, a photograph of a completed paper log is sent to Vertex AI in Canada so its rows can be read back for a person to confirm. Nothing is saved until they do. That is a page of the record, photographed on purpose; the record in this app’s database is never sent.

Neither is your password or your patient reference. Neither are the setup answers you typed when you first configured the manual: your practice name, principal dentist and IPAC lead. Those stay in your browser and in your manual’s copy with your account (section 1), and are never sent to an AI provider.

6. Data retention

Our not saving an AI request in our database does not guarantee that the AI provider retains nothing. Provider retention can depend on the service, features and account settings, including abuse monitoring and caching. Those terms and settings must be verified before real practice content is used; this policy does not promise zero provider retention.

We keep your account and manual data for as long as your account is active or as needed to provide the Service.

Closing your account also leaves any manual copies already saved with the practice, including their chapter history and pasted figures, on our servers. They become inaccessible through that account but remain readable by MolarOps. There is currently no automatic expiry or deletion process for these retained manual copies. Their retention and deletion schedule, including provider backups, must be established and verified before real-data use.

Deleting your account does not delete your practice’s compliance record, and that is deliberate. An infection-control record is a document a regulator can ask a practice to produce years later. Deleting the account detaches it from the record and makes the record unreachable through the Service. With Cloud Sync, the record we hold for your practice then stays on our servers, readable by us as section 4a describes. There is currently no automatic expiry-and-destruction process for that record. Before real-data use, we must establish and verify a retention and deletion schedule with the practice, including legal holds and copies in provider backups.

If you need your practice’s record erased from our servers rather than detached, write to us at the address in section 12 and say so. We will verify your authority, assess retention duties and legal holds, and explain the approved scope and outcome. A completion notice must distinguish verified removal from retained records and backup expiry. We may retain limited records where required for legal, billing, or security purposes. We cannot erase copies you or others have exported to devices outside our control.

7. Your choices and rights

You can view and update your account information, and change your password, in the Service. You can also close your account yourself, from the account screen: it deletes your sign-in, your sessions and your profile. It asks for a second step first, and it refuses while a subscription is still being billed, so that nobody is left paying for an account that no longer exists. Contact us at the address in section 12 to request access to or correction of your personal information, and we will respond within the time PHIPA and applicable privacy law allow.

Closing your account does not delete the practice’s compliance record, and that is deliberate: it is a regulatory record with its own retention period, it lives on the practice’s iPad and, with Cloud Sync, on our servers, and one person leaving should not erase it. Section 6 describes how long it is kept.

The website keeps no copy of your practice’s record. “Reset this device” on its account screen erases what the website keeps in that browser, such as a manual written there; it does not touch what we hold. The iPad app has no such control: its database is encrypted with a key held in the device’s keychain, and the way to remove the record from an iPad is to delete the app.

If your free trial ends, or your subscription does, the Service keeps working for 30 days: recording log entries, changing setup, sending your record to us and revealing a patient reference all carry on, and what the iPad recorded in that time is sent to us as everything else is. After those 30 days it stops accepting new work. Nothing is deleted, nothing is hidden, and the part that lets you get your record out keeps working: your inspection binder still opens and still exports, on the iPad and on the website, and that does not require an active subscription and is not switched off when one lapses.

8. Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the Service is used. You can control cookies through your browser settings.

9. Security

Cloud Sync is not end-to-end encrypted (section 4a). Your practice’s record travels to our servers over an encrypted connection and our hosting provider encrypts its storage, but we can read it, as we can your manual’s copy with your account. Reaching either needs your account’s sign-in, and the owner’s look at a patient reference needs two-step sign-in and a reason, every time.

The iPad exports no copy of the whole record. What it exports is the binder, your log sheets and your recall record as documents, and the binder carries no recall’s patient reference. Each export is written to the record. A replacement iPad receives the record from Cloud Sync.

Two-factor authentication is required before your practice’s iPad records. Our database refuses to turn on Cloud Sync without a verified authenticator, so the off-device copy of a ten-year record is never behind a password alone. A replacement iPad receives the record only after two-step sign-in, and checks every entry against the record’s own fingerprints before it keeps it.

On the iPad itself, revealing or adding a patient reference, and every change to your practice’s setup, ask for a practice owner’s PIN. ⚠️ If no owner has set a PIN, those confirmations degrade to an ordinary “are you sure?”. Setting an owner PIN is what makes them mean something on a shared tablet.

No method of transmission or storage is completely secure, and you are responsible for safeguarding your account password and your authenticator.

10. Third-party links

The Service may contain links to third-party websites or resources. We are not responsible for the privacy practices of those third parties.

11. Changes to this Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a notice on the Service. Your continued use of the Service after the effective date of the revised Policy constitutes acceptance.

12. Contact us

For privacy questions or data requests, contact us at info@molarops.com.