GDPR and data protection

1. Our role

JDD Dental ApS (CVR 43896342) is the controller for data about the people who use ArgusMesh and visit this website.

For patient and client data that a laboratory, clinic or denturist enters into ArgusMesh, that customer is the controller and we are its processor. Patient names, dates of birth and scans can be health data (GDPR Art. 9), so the customer needs a lawful basis and is responsible for its own impact assessment (DPIA). We supply the information it needs for that.

2. Where your data is

The application, database and uploaded files are hosted by Hetzner Online GmbH in Nuremberg, Germany. The AI suggestions run on our own servers; scans are not sent to an outside AI provider.

3. Sub-processors

These companies process personal data on our behalf. We list a company here only when we send it data.

• Hetzner Online GmbH: Hosts the application, the database and uploaded files. Nuremberg, Germany (EU).
• Stripe: Payment and subscription billing; sends payment receipts. Ireland (EU); may process data outside the EU/EEA.
• Google (Gmail): Receives the emails you send to our contact address. May process data outside the EU/EEA.

4. Data processing agreement

Customers that enter patient or client data need a data processing agreement under GDPR Art. 28. Ask for it at argusmesh@gmail.com before you enter patient data.

5. Safeguards

• Traffic between your browser and ArgusMesh is encrypted with TLS.
• Each organisation's data is separated on the server: a user can only read and change records of their own organisation.
• The sign-in cookie cannot be read by scripts on the page and is sent only to our own site.
• Our logging rules forbid patient data and personal identifiers in logs.
• We are confirming with our hosting provider how stored data is encrypted and make no claim about it until that is confirmed in writing.

6. Your rights

• Right of access to your data
• Right to rectification
• Right to erasure
• Right to restrict processing
• Right to data portability
• Right to object

To use a right, write to argusmesh@gmail.com. We answer within one month. If you are an end customer of a laboratory or clinic, contact them first, because they decide how your patient data is used. You can also complain to the Danish Data Protection Agency (Datatilsynet), datatilsynet.dk.