Privacy Policy

1. Who is responsible

JDD Dental ApS, CVR 43896342, Fredericiagade 42, 6000 Kolding, Denmark ("we") runs ArgusMesh.

For data about the people who use ArgusMesh and visit this website, we are the data controller. For patient and client data that a laboratory or clinic enters into ArgusMesh, that laboratory or clinic is the controller and we are its processor (see "Customer content" below).

You can reach us at argusmesh@gmail.com.

2. What we collect

• Account data: the name and email address of each user, their role in the organisation, and what is needed to sign them in. For an invited user, the invited email address and an invitation token.
• Organisation and billing data: the organisation name, company address, VAT number and country, the plan and number of seats, and a record of when, by whom and under which version of our Terms the organisation accepted them. Payment card details are entered on Stripe's pages; we do not receive or store card numbers.
• Customer content: the scans, patient, client and project information your organisation enters into ArgusMesh (see below).
• Technical data: like any web service, our servers receive your IP address and browser details with every request, which we need to deliver the service and keep it secure.
• Messages: if you email us, we keep your message and address so we can answer.

We do not sell personal data and we do not use it for advertising.

3. Why we use it, and on what basis

• To provide the service you or your organisation signed up for, including accounts, sign-in, invitations, billing and support (GDPR Art. 6(1)(b), performance of a contract).
• To keep the service secure and working, and to prevent misuse (Art. 6(1)(f), our legitimate interest in a safe service).
• To keep the accounting records the law requires (Art. 6(1)(c), legal obligation).
• To store your cookie choice and, if you allow it, your light/dark preference (your consent, Art. 6(1)(a), where it is not strictly necessary).

4. Customer content (patients, clients and scans)

Laboratories and clinics use ArgusMesh to upload 3D scans and to enter patient names and dates of birth, client details and project information. We do not ask for diagnoses or treatment records. A scan of a person's teeth or jaw, together with their name and date of birth, can still reveal information about their health, so we treat patient data with the care that GDPR Art. 9 requires for health data.

We process this content only to provide ArgusMesh to the organisation that uploaded it, on that organisation's instructions. The organisation is the controller and is responsible for having a legal basis to enter the data. A data processing agreement under GDPR Art. 28 governs our role; ask us at the address above to receive it.

Each organisation's data is kept separate: users of one organisation cannot see the data of another.

5. Automatic suggestions and "Help improve suggestions"

ArgusMesh suggests tooth positions, cut loops and thickness lines. These suggestions are produced by software we run ourselves as part of the service; scans are not sent to a third-party AI provider. You review every suggestion before it is applied.

When you accept, edit or reject a suggestion, ArgusMesh can record the outcome to measure and improve suggestion quality and to train models. This is switched on by default for every organisation, and an organisation admin can switch it off under Billing ("Help improve suggestions"). A recorded sample contains:

• which suggestion it was (for example the thickest line) and the tooth number
• the suggested line and the line you ended with, as positions relative to the tooth
• whether you accepted, edited or rejected it, and the version of the suggester that made it

A recorded sample never contains:

• scan or mesh files, or the shape of the rest of your model
• patient, client or project names
• who you are: no user name, email or account
• anything you typed into the app

Switching the setting off stops new samples. Samples already recorded are kept, because they hold no names, files or account details. They stay linked to your organisation, and only its admins can read or download them.

6. Cookies and similar technologies

• jwt: keeps you signed in. Strictly necessary. It cannot be read by scripts on the page and is sent only to our own site.
• cc_cookie: remembers your cookie choice. Strictly necessary.
• Theme preference (light or dark): saved in a cookie and in your browser's local storage only if you accept preference cookies. If you reject them, or later withdraw your choice, it is removed.

Your browser also keeps a few settings in local storage that never leave your device and are not used to identify you: whether you have seen a guided tour, and your last export settings.

We do not use analytics, advertising, session-recording or chat tools, and we load no scripts, fonts or images from other companies. Fonts and icons are served from our own site, so visiting a page sends nothing to a third party. If that changes we will ask for your consent first and update this policy.

7. Who we share data with

• Hetzner Online GmbH: Hosts the application, the database and uploaded files. Nuremberg, Germany (EU).
• Stripe: Payment and subscription billing; sends payment receipts. Ireland (EU); may process data outside the EU/EEA.
• Google (Gmail): Receives the emails you send to our contact address. May process data outside the EU/EEA.
• Authorities, when the law requires it.

Our own servers are in the EU. Stripe and Google are international companies and may process data outside the EU/EEA; where they do, the transfer relies on an EU Commission adequacy decision or the EU standard contractual clauses.

8. How long we keep it

• Account and organisation data: while the organisation has an account. When the account is closed we delete or anonymise it, except what we must keep by law.
• Billing records: as long as Danish accounting law requires, currently five years.
• Customer content: until your organisation deletes it or the account is closed.
• Recorded suggestion samples: see the section on suggestions above.

9. How we protect it

• Connections between your browser and our servers are encrypted (TLS).
• Every request is checked against the organisation the data belongs to, so users only reach their own organisation's data.
• The sign-in cookie cannot be read by scripts on the page.
• Our servers are hosted in the EU.

No system is perfectly secure, so we cannot promise absolute security. If a personal data breach affects you, we will notify you and the authorities as the law requires.

10. Your rights

You can ask us for access to the data we hold about you, and to correct it, delete it, restrict its use or hand it to you in a portable format. You can object to processing based on our legitimate interest, and withdraw consent at any time.

If your data is in ArgusMesh because a laboratory or clinic entered it, contact that laboratory or clinic first; we help them answer. Otherwise write to argusmesh@gmail.com.

You may complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk) or to the data protection authority in your own country.

11. Children

ArgusMesh is for professional use by adults. It is not meant for children: you must be at least 18 to create an account, and you confirm this when you sign up. We do not knowingly collect personal data from anyone under 18, and never from a child under 13. If you believe a child has given us data, contact us and we will delete it.

12. Email

We use email only to answer your messages and for messages about your account and payments (for example receipts sent by Stripe). We send no newsletters or marketing email. If we ever start, we will ask for your opt-in first, name us as the sender with our postal address, include an unsubscribe link that works without signing in, and stop within 10 business days of an opt-out.

13. Changes to this policy

We will update this page when our practices change and show the date at the top. For material changes we will also tell account holders in the app.