Privacy Policy

Our two roles

32Desk plays two different roles, and your rights depend on which one applies.

If you are a patient of a clinic and want to see, correct or delete your records, contact the clinic directly — it is the clinic that controls that data. We help clinics answer such requests.

Patient data we process for clinics

On the instruction of a clinic, the service stores and processes:

• identity and contact details: name, phone number, email address, date of birth, gender, address;
• clinical records: appointments and visits, treatment plans, the dental chart, diagnoses (including ICD-10 codes), notes and files the clinic attaches;
• financial records: price list items applied, payments, discounts, outstanding balances;
• communication records: reminders and notifications sent to the patient and the channel used.

Clinical records describe a person's health. Where the EU General Data Protection Regulation applies, this is a special category of personal data and the clinic must have a lawful basis for processing it. We process it only to provide the service to the clinic, and never for our own purposes, advertising or profiling.

Data we process about our own users

As a controller we process:

• account data of clinic staff: name, work email, phone number, role and access rights;
• authentication and security data: login events, IP address, device and browser information;
• billing data: the clinic's plan, number of doctors, invoices and payment status;
• support correspondence: messages you send us by phone, email, the website form or Telegram;
• technical diagnostics: crash and error reports, which may include the page or screen you were on.

We use this to give you access to the service, keep it secure, bill correctly, provide support and fix faults. TODO: whether a data protection officer / EU representative is appointed

Legal bases

Where the GDPR applies, we rely on:

• contract — to provide the service to a clinic and to administer accounts and billing;
• legitimate interests — to keep the service secure, prevent abuse and diagnose faults;
• legal obligation — to keep accounting records and answer lawful requests;
• consent — where we ask for it explicitly, for example for optional messages. You can withdraw consent at any time.

For patient records the clinic determines the legal basis, normally the provision of health care under Article 9(2)(h) GDPR or equivalent national law.

Service providers we use

We share data only with providers that help us run the service, under contract and only as far as needed. At present these are:

Hosting and infrastructure

Operation of the servers on which the service and clinic data run.

Sentry

Error and crash reporting for the web and mobile applications.

Google reCAPTCHA and Google Tag Manager

Used on our public website to block automated form abuse and to measure site usage. Not used inside the clinic workspace.

Messaging providers

Delivery of SMS, email, Telegram and WhatsApp notifications a clinic chooses to send.

Apple

Distribution of the iPhone app and delivery of push notifications.

We do not sell personal data and do not share it for advertising.

Where data is stored

Clinic data is stored strictly within the country where the clinic operates. We do not move it outside that country and do not transfer it to other jurisdictions.

If a clinic operates in more than one country, each branch's data stays in its own country.

How long data is kept

• Patient records — kept for as long as the clinic uses the service. The clinic decides what to delete and when, subject to the record-keeping periods its own law imposes on medical documentation.
• After a subscription ends — data is retained for 30 calendar days to allow export at the Clinic’s request, then deleted from live systems unless further retention is required by law. Deletion may take place sooner on the Clinic’s instructions.
• Backups — a daily backup is taken; copies are rotated and overwritten. Each backup is retained for no more than 30 calendar days. After deletion from live systems, remaining copies are used only for disaster recovery and expire within that period; if a backup is restored, previously received deletion instructions are reapplied.
• Accounting records — kept for the period required by law.
• Support correspondence — up to 24 months after a request is closed, then deleted or anonymised. Where correspondence is needed to resolve a dispute or meet a legal requirement, the relevant records are retained until the dispute ends or the required period expires.

How we protect data

• traffic between your device and the service is encrypted in transit (HTTPS);
• access inside a clinic workspace is limited by role and access rights the clinic sets;
• a backup is taken daily so data can be restored after a failure;
• access to production systems by our staff is limited to those who need it for support and maintenance.

No service can promise absolute security. If a breach affects your data and the law requires it, we will notify the clinic and the competent authority within the required time.

Your rights

Depending on where you live you may ask us to give you a copy of your data, correct it, delete it, restrict or object to its use, or receive it in a portable form. You can also complain to your national data protection authority.

Requesting account deletion

If you created an account to use the 32Desk app, you can ask for the account and the personal data we hold about you as a user to be deleted. To request deletion, email hello@32desk.com from the address linked to your account, use the subject “Delete 32Desk account” and name your clinic. Do not send passwords or medical records. We may request the minimum information needed to verify your identity and authority. We will confirm the outcome or explain any legal basis for retaining specific records.

Deleting a staff account does not delete the clinic's patient records: those belong to the clinic, which must decide on them separately.

To exercise any right, write to hello@32desk.com or use the contacts at the end of this policy. We answer within one month.

Children

The service is a professional tool and is not directed at children. Clinics do treat children, and a clinic may record a child patient's data in 32Desk on the basis and with the consent its own law requires. We do not knowingly collect data directly from children.

Changes to this policy

If we change this policy we will update the date at the top of the page. For changes that materially affect how data is handled, we will also inform the clinics that use the service.

Contact us

Questions about this policy or about how your data is handled:

• Email: hello@32desk.com
• Phone: +998 97 006 32 32
• Telegram: t.me/supp32desk
• Legal entity and address: APPS FOR DENTISTS, MCHJ
  26,6, Khumayun MFY, Khumayun district
  Tashkent 100142
  Uzbekistan