Privacy Policy

Version 2026-11 · Effective November 1, 2026 · Print or save as PDF

This Privacy Policy explains how Software Solution LA ("we", "us", "our") handles information in connection with Dentrova, our cloud dental practice management service (the "Service"), the website at qa.softwaresolutionla.com and our sales, onboarding and support activities. It applies to dental practices, dental groups and hospitals that subscribe to the Service ("Customers"), the people who use it on their behalf ("Users"), and visitors to our website.

1. Our two roles

We handle two very different kinds of information, under different rules:

Customer Data, including Protected Health Information (PHI). Patient records, appointments, clinical notes, images, insurance details, claims and everything else a practice stores in the Service belong to that practice. For this information the practice is the HIPAA covered entity and we are its business associate. We use and disclose PHI only as our Business Associate Agreement (BAA) with the practice and the HIPAA Privacy, Security and Breach Notification Rules (45 CFR Parts 160 and 164) allow. Patients should contact their dental practice about their records; the practice's own Notice of Privacy Practices governs how it uses their information.
Account and business information. Information about our Customers and Users as our business contacts (names, work emails, phone numbers, billing details, how the Service is used) and about website visitors. For this information we decide how it is used, as described in this policy.

2. Information we collect

2.1 You give us

Registration details: practice name and type, practice phone and state, the practice owner's name, title and work email, the chosen web address (subdomain), plan and billing cycle, and a password (stored only as a one-way bcrypt hash).
Billing details: billing contact, legal name and address. Card details are entered directly with our payment processor (Stripe) and never reach our servers; we keep only the card brand, last four digits and payment status.
Practice setup details: organization and provider NPIs, tax ID (stored encrypted; only the last four digits are shown), locations, fee schedules and payer list.
Support and sales communications: what you tell us by email, phone, the contact form or a demo. Please never send patient information through these channels; use the secure workflows inside the Service.

2.2 Collected automatically

Security and audit logs: sign-ins, two-step verification events, IP address, browser type, and which records were viewed or changed. These logs are required by the HIPAA Security Rule (45 CFR 164.312(b)) and are kept append-only.
Operational telemetry: performance and error information (request timings, error codes). Our telemetry is configured never to capture request bodies, form contents or database query text, so it does not contain PHI.
Cookies: only strictly necessary cookies — a session cookie, a sign-in cookie and an anti-forgery cookie. We do not use advertising cookies, third-party trackers or cross-site analytics on the Service or on clinic websites.

2.3 Customer Data (PHI)

Customer Data is whatever the practice and its patients enter or upload: patient demographics, medical and dental history, appointments, clinical notes, tooth charts, prescriptions, images and documents, insurance and eligibility responses, claims and remittances, and patient portal messages. We process it only to provide the Service to that practice.

3. How we use information

3.1 Customer Data (PHI)

We use and disclose PHI only:

to provide, secure, maintain and support the Service for the practice, as the practice directs;
to transmit eligibility requests, claims and other transactions the practice initiates to the clearinghouse or payer the practice has chosen;
for our proper management and administration and to carry out our legal responsibilities, as 45 CFR 164.504(e)(4) allows;
as required by law.

We do not sell PHI, use it for marketing or advertising, use it to build profiles of patients, or use it to train artificial-intelligence models. We do not access a practice's records except when needed to provide support the practice asks for, to keep the Service secure, or as required by law; every such access is logged.

3.2 Account and business information

to create and run the account, verify the owner's email address and provision the practice's environment;
to bill the subscription, send invoices and receipts and handle failed payments;
to provide support, onboarding and training;
to send service notices (trial ending, security notices, changes to these terms) — these are not optional while you have an account;
to send product news, only to business contacts and with an unsubscribe link in every message;
to protect the Service, detect fraud and abuse, and meet legal obligations.

We do not sell personal information and we do not share it for cross-context behavioral advertising. We share information only with:

Subprocessors that host or operate parts of the Service, listed on our Subprocessors page. Every subprocessor that may handle PHI has signed a business associate agreement with us that is at least as protective as ours with the practice.
Our insurance clearinghouse (Stedi), a subprocessor under a Business Associate Agreement, when the practice sends an eligibility check or claim.
Services the practice connects, such as its payers and laboratories, when the practice initiates the transaction. The practice has its own agreements with those parties.
Our payment processor (Stripe), for subscription billing only. Stripe receives practice billing details, never patient information.
Authorities, when the law requires it (for example a valid subpoena or the U.S. Department of Health and Human Services in a compliance review). Where we are allowed to, we tell the practice first.
A buyer or successor in a merger or acquisition, who must keep honoring our BAAs and this policy.

5. How we protect information

We maintain administrative, physical and technical safeguards that meet the HIPAA Security Rule, including:

Isolation: each practice has its own database with its own database login, and its own private file storage containers; no practice can query another practice's data.
Encryption: TLS 1.2 or higher for all traffic; data encrypted at rest by Microsoft Azure (AES-256); the most sensitive fields (Social Security numbers, two-step verification secrets, API keys, tax IDs) are additionally encrypted by the application with a key unique to each practice, held under a master key in Azure Key Vault.
Access control: role-based permissions inside each practice, mandatory two-step verification for administrators (and optionally all staff), automatic sign-out after inactivity, account lockout after repeated failed sign-ins, and unique logins (no shared accounts).
Audit: append-only audit logs of access to and changes of patient records.
Resilience: automated, encrypted, geo-redundant database backups with point-in-time restore, and file versioning with soft delete.
People: workforce HIPAA training, least-privilege access for our staff, background checks for staff with production access, and a documented incident response plan.
Location: Customer Data is stored and processed in Microsoft Azure data centers in the United States.

No system is perfectly secure. If you believe you have found a vulnerability, please write to security@softwaresolutionla.com.

6. Security incidents and breach notification

If we discover a breach of unsecured PHI, we notify the affected practice without unreasonable delay, as set out in our BAA, so that the practice can meet its own notification duties to patients, HHS and, where required, the media under 45 CFR 164.404–164.408. We give the practice the information we have about the incident and keep updating it as our investigation continues. We notify affected business contacts about incidents involving their account information as required by applicable state law.

7. Retention and deletion

While a subscription is active, Customer Data is kept for as long as the practice keeps it. The Service includes record-retention tools the practice configures to its state's dental record retention rules.
After cancellation, the practice keeps read-only access to export its data for 90 days. After that period we destroy the practice's database, files and encryption key. Backups age out on their normal schedule (no more than 35 days) and are never restored except to recover the Service. Where return or destruction is not feasible, the protections of the BAA continue for as long as the information exists.
Account and billing records are kept for as long as needed for tax, accounting and legal purposes (normally seven years).
Security audit logs are kept for at least six years, consistent with HIPAA documentation requirements.

8. Your choices and rights

Patients: to see, copy, correct or ask about your dental records, contact your dental practice. If you contact us, we will pass your request to the practice, which decides how to respond under HIPAA.
Customers and Users: you can view and update your account details in the Service, download your practice's data at any time, and unsubscribe from product news. Depending on where you live (for example California, Colorado, Virginia or Texas), you may have rights to access, correct, delete or obtain a copy of personal information we hold about you as a business contact, and to appeal our decision. Email privacy@softwaresolutionla.com; we will verify your request and answer within the time the law requires. We will not treat you differently for using these rights.

9. Children

Our website and the Service's administrative features are not directed to children. A practice may hold records of minor patients; a parent or guardian manages the minor's portal access, and the practice's own policies apply.

10. Changes to this policy

We will post any change here with a new effective date, and we will email Customers at least 30 days before a material change takes effect. A change never reduces the protections in a signed BAA.

11. Contact us

Software Solution LA, Arizona, USA. Privacy questions: privacy@softwaresolutionla.com. Security reports: security@softwaresolutionla.com. Support: support@softwaresolutionla.com.