Skip to content
ClinicDent

Security and legislation

Health data plays by different rules than invoices

A dental clinic keeps medical records with everything that entails — traceability, immutability and strict access. ClinicDent has this built in, not bolted on.

Principles

Six things the system does regardless of anyone’s settings

Audit of access to medical records

Every opening and change of a patient record is logged: who, when, which patient, and whether it was a view or an edit. Entries are never deleted or rewritten. This meets the requirements of Czech Decree No. 98/2012 Coll. on medical records.

Tamper-proof clinical notes

A clinical record locks once signed. Corrections are made not by rewriting but by a new addendum. The history stays complete and traceable — exactly what inspectors and courts ask about.

Passwordless sign-in to the app

Staff sign in with a Google or Microsoft account, passkeys or a one-time code sent by e-mail — the app stores no passwords. New users join by invitation; when someone leaves, their account is deactivated rather than passwords being changed.

Data in the EU, encrypted transfer

The application, database and attachments run in Microsoft Azure data centres in the European Union. Communication with the app is always encrypted, and the system’s access keys are never stored in the app or its code.

Attachments in encrypted storage

X-rays, photos and documents are kept in encrypted storage, separately for each clinic. Only signed-in staff of that clinic can access the files.

Signatures without a third party

Documents are signed with an SMS code right in the clinic’s system — they are never sent to an external signing service. A clause with the document fingerprint (SHA-256) is appended to the signed PDF, so you can always prove it hasn’t changed since signing.

GDPR

Patients’ personal data

  • The clinic processes patient data as the controller and the system supplier as the processor — the relationship is covered by a data processing agreement.
  • When several clinics run on one installation, their data is strictly separated. Without a specified clinic the system refuses the operation — it never silently touches another clinic’s data.
  • Processing takes place in Microsoft Azure data centres in the European Union.
  • Access to records is limited to accounts the clinic explicitly allows.
  • Data subject rights built into the system: export of the patient’s data (PDF and JSON including access history) and controlled erasure or anonymisation that respects medical record retention periods — with a log of requests.
  • The access audit lets you prove who has accessed specific records.
  • Internal notes are kept separate from the medical records.
  • The patient booking portal creates no accounts and stores no passwords — identity is verified with a one-time code sent by e-mail.
  • AI skills receive only instructions and templates with placeholders — real data is filled in by ClinicDent at the clinic. The optional AI assistance for clinical notes in the app runs solely on the clinic’s API key and only when the clinic explicitly switches it on; otherwise the system sends nothing to AI.
  • This website uses anonymous, cookie-free visitor analytics (Cloudflare Web Analytics). Neither the ClinicDent app nor the booking portal uses any third-party analytics.

For IT and data protection officers

We provide technical documentation — architecture, encryption, access control and deployment — on request during vendor selection or for an audit. We deliberately don’t publish infrastructure details on the public website.

Request technical documentation

The specific scope of processing, retention periods and cooperation in handling data subject requests are agreed according to how your clinic works — they are part of the data processing agreement, not an app setting.

Guarantee

You can always take your data with you

If you ever leave, you get your complete data from us — patient register, medical records, attachments and templates — in documented formats, within 14 days and free of charge.

No negotiation and no “export fees”. Clinic data isn’t our leverage — it’s yours. The same commitment is in the contract, not just on the website.

  • Patient register and contacts — CSV
  • Medical records — structured export + PDF
  • Attachments (X-rays, photos, documents) — original files
  • Document and message templates — JSON
  • Invoices and cash desk — XLSX

Honestly

What ClinicDent is not

So it’s clear what to expect from the system and what not to.

Not a certified medical device

ClinicDent is a clinic operations and records system. It doesn’t diagnose or decide on treatment — that stays with the dentist.

Doesn’t replace the clinic’s responsibility

The healthcare provider remains the controller of personal data. The system gives you the tools to demonstrate compliance, not to take over responsibility.

Doesn’t promise what it can’t do yet

Features that are in preparation or in their first iteration are labelled as such on the website. We say the same in demos.

Need details for your compliance?

We’re happy to go through specific questions — the data processing agreement, data location, access audit and how data erasure and export work.

Book a demo Explore features