Privacy policy

1. Who we are

Edento (إيدنتو) is a Libyan service that builds websites and a booking and practice-management platform for dentists and dental clinics, with a clinic dashboard and an internal back office for the Edento team.

Edento is being registered as a Libyan company. We will publish its legal name, registration number and address on this page once registration is complete.

2. Our role

• Data of edento.ly visitors, demo requesters, and clinics and their staff held by Edento: Edento is responsible.
• Patient data: each clinic is responsible for its patients' data, and that data belongs to the clinic. Edento processes it only on the clinic's behalf and only to provide the service; we never sell it or use it for anything else. If you are a patient, your clinic is your first contact for questions and requests about your data.

3. What data we collect and why

edento.ly visitors and demo requests:

• Demo request form: your name, practice name, whether you are a dentist or a clinic, number of dentists, city, phone number and an optional message, with the page you sent it from and any campaign (UTM) tags in the link. Purpose: to contact you about your request and follow it up, and to learn which channels bring requests.
• To stop spam we keep a one-way hash of your IP address — not the address itself — for one day.
• edento.ly uses no third-party trackers or advertising tools and sets no cookies for visitors.

Clinics and their staff:

• Clinic and subscription data: clinic name, contact person's name and phone, plan and add-ons, invoices and payments, and bank-transfer receipts. Purpose: providing the service, billing and contacting you.
• Staff accounts: name, phone number and roles. Sign-in is by phone number and a one-time code, with no passwords; we never store the code, only a hash that expires within minutes.
• Security log: sign-ins and sensitive actions are logged with a masked phone number and a hashed IP address to protect accounts.
• Operational reports from clinic sites to Edento: message counts, usage and system health — no patient personal data.
• The clinic dashboard as a phone web app: if you turn on notifications we store the subscription address your browser's push service gives the device, and send generic alerts such as "New booking request" — never a patient's name or medical detail. The browser also keeps a copy of the "Today" page for offline use on the same day. Both are removed when you sign out on that device.

Clinic patients (processed on the clinic's behalf) — depending on what the clinic turns on:

• Contact and file data: name, phone number, file number, date of birth and address, and email if given. The phone number is verified with a code sent by WhatsApp (or SMS if the clinic has that add-on).
• Appointments: date and time, doctor, visit type and an optional short reason (never included in messages or calendar files).
• Online consultations: case description, photos or videos and patient–doctor messages. Only the responsible doctor sees them, and every view is logged.
• The clinic's clinical record: reason for visit and complaint, medical history (conditions, allergies, medicines), dental chart with problems found and the treatment plan with prices, X-rays and dental photos, and doctor's notes. These are for doctors only; reception sees a summary of the treatment plan (procedures, sessions, cost) to organise visits and payments. Patients see their own chart, plan and images in their account, without doctor's notes.
• Treatments, sessions and payments at the clinic: amounts, payment method and receipt numbers.
• WhatsApp, Messenger or Instagram conversations with the clinic, if the clinic connects them.
• Consents: the consent text, its version and time.
• Aggregate visit statistics for the clinic website, with no personal or medical data.

4. Consents

The platform asks for separate consents, none of them pre-ticked: booking terms, consultation review, marketing messages (optional), check-up recalls (optional and separate) and publishing a patient's testimonial. Every consent and withdrawal is recorded, and marketing messages go only to people who agreed.

5. Who we share data with

We do not sell personal data. We use only these providers, and only as far as the service needs:

• Vercel: hosting of the website and platform, and private file storage such as X-rays.
• Neon: databases.
• Meta (WhatsApp Business, Messenger, Instagram): sending sign-in codes and reminders and receiving patient messages. Whatever is sent on these channels passes through Meta's servers.
• Twilio: for SMS only, if the clinic buys that add-on.
• Browser push services (Apple, Google, Mozilla): to deliver generic, encrypted notifications to staff devices that allowed them.
• Vercel AI Gateway and the AI model provider: only if the clinic buys an AI add-on. A patient's name, number, file, appointments and consultations are never sent; medical messages are handed to the clinic team without being sent to the model.
• Public authorities: where the law requires it.

Online payments are not active yet. When they are, this policy will name the payment gateway.

6. Where data is stored

Our hosting, databases and file storage are outside Libya — currently in the United States. Meta and the AI provider process data on their own servers.

7. How long we keep data

• Sign-in codes (hash only): expire within minutes, deleted after 2 days.
• IP hash from the demo form: 1 day.
• Unsubmitted consultation drafts and their files: 24 hours.
• Non-clinical WhatsApp conversations and AI-assistant conversations: 90 days after the last message.
• AI usage logs (metadata only, no texts): 180 days.
• Demo requests: while we follow up your request; you can ask us to delete them at any time.
• Patient, appointment and medical records: set by each clinic according to its professional and legal obligations. When a clinic's agreement ends, its data is handed over to it and then deleted as set in the service agreement.

8. How we protect data

• Encrypted connections (HTTPS); one-time codes instead of passwords, with attempt limits and temporary account lockout.
• Short sessions: 12 hours for clinic staff and the Edento team, 24 hours for patients.
• Role-based access: clinical data for doctors only, and every consultation view is logged.
• Uploaded images are re-encoded and stripped of location data (EXIF/GPS), stored privately and shown only to authorised users.
• WhatsApp notices are generic: reference, date, time and link — never symptoms, images or medical replies.
• No system is perfectly secure; if a breach happens we will notify the clinics and people affected and the authorities as the law requires.

9. Your rights

You may ask to access, correct or delete your data (subject to what the clinic must keep in the medical record), and withdraw consent at any time.

• Patients: from the "Privacy" page in your account on the clinic website, or by contacting the clinic directly. To stop marketing messages and check-up recalls at once, reply «إيقاف» or "STOP" to a WhatsApp message.
• Visitors, clinics and staff: contact us using the details below and we will reply as soon as possible.

10. Cookies

• edento.ly: no cookies for visitors. The Edento team's back office uses strictly necessary sign-in cookies only.
• Clinic websites: strictly necessary cookies for the sign-in session and the site language, and a clinic_utm cookie (30 days) that remembers which campaign you came from, with no personal data.
• No third-party trackers, advertising pixels or session recording.

11. Children

Edento's services are aimed at clinics and adults. A clinic may keep records of child patients as the party responsible for their data, through a parent or guardian.

12. Changes to this policy

We may update this policy when the service or the law changes. We will publish the new version here with its date and tell clinics about significant changes.

13. Contact us

Email

info@edento.ly

WhatsApp

+218 91 000 0000

Phone

+218 91 000 0000

City

Tripoli, Libya