This policy explains how [legal entity name] ("Sonty", "we", "us") handles information through our website and the Sonty service. The service is used by dental, medical, med spa, chiropractic, veterinary and other appointment-based practices ("practices" or "customers") to track supplies, see financials, compare fees and text their patients.

Whose information this covers

We handle two kinds of information, under different rules:

• Information about our customers and website visitors: the practice owners, staff and other people who visit our site, request a demo or create an account. We decide how this information is used, and this policy covers it fully.
• Information about a practice's patients: names, mobile numbers, appointments, procedures and text messages that a practice connects to Sonty. We process this on behalf of the practice, only to provide the service to that practice, under HIPAA and our Business Associate Agreement with them. If you are a patient, your practice controls your information. Please contact the practice directly about access, corrections or other requests, and we will help them respond.

What we collect

When you visit the website or request a demo

• What you type into the demo request form: name, email, practice name, phone number and your message.
• Standard server logs, such as IP address, browser type, pages requested and the time of the request, kept for security and troubleshooting.

When you create an account

• Your name, practice name, email address, phone number and which practice management software you use.
• Your password, which we store only as a one-way cryptographic hash. We cannot see it.

When a practice connects its systems

Once a practice is onboarded, it can connect the following. We only access what each connection is needed for.

We never ask for or store your QuickBooks, Google or Open Dental password. You sign in on their own pages, and they give Sonty limited access that you can revoke at any time.

Cookies

We use one cookie, which keeps you signed in. Scripts on the page can't read it, and it expires after 14 days. We do not use advertising cookies, analytics trackers or tracking pixels. Our pages load fonts from Google Fonts, so Google receives your IP address and browser details when you view the site.

How we use information

• To provide, maintain and support the Sonty service for the practice that uses it.
• To send the texts a practice has turned on: appointment reminders, recall reminders, review requests and scheduling replies.
• To send checkup reminder emails that a practice chooses to send to patients it hasn't seen in a while. Every email has an unsubscribe link.
• To create and secure accounts, prevent abuse and keep the service working.
• To answer demo requests and contact you about your account, billing and changes to the service.
• To improve the service using aggregated supply and pricing figures that contain no patient information and do not identify any practice.

We do not sell or rent personal information. We do not use patient information for marketing, advertising or any purpose other than providing the service to the practice it came from.

Who we share it with

We share information only with the service providers below, and only what each one needs to do its job for us. Providers that handle patient information do so under a Business Associate Agreement or equivalent HIPAA obligations.

We may also disclose information if required by law, subpoena or court order; to protect the rights, safety or property of Sonty, our customers or others; or to a successor in a merger or acquisition, which would remain bound by this policy and any Business Associate Agreements in place.

Text messages

Sonty sends text messages on behalf of practices, to patients who have given the practice their mobile number and agreed to receive texts from it. These include appointment reminders and confirmations, recall reminders, review requests and replies when a patient books by text.

• Message frequency varies with your appointments. Message and data rates may apply.
• Reply STOP to stop receiving texts, or HELP for help. Reply START to opt back in.
• Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are not shared with any third party, except the providers that deliver the messages.

See the text message terms for details.

How we protect information

• All connections to Sonty use HTTPS encryption.
• Passwords and sign-in session tokens are stored only as one-way hashes.
• Accounts see live practice data only after we verify and link them to that practice. New accounts see sample data.
• Messages sent to our texting webhook are verified as genuinely coming from Twilio.
• Access to production systems is limited to the people who need it to run and support the service.

No system is perfectly secure. If a breach affects patient information, we will notify the affected practice as required by HIPAA and our Business Associate Agreement, so it can meet its own notification duties.

How long we keep it

We keep account and practice information while the practice's account is active. When a practice closes its account, or sends a written request, we delete or return its practice data within 60 days. Copies in backups are overwritten on their normal schedule. We may keep limited records longer when the law requires it, such as billing records, or to resolve disputes. Demo requests are kept for up to two years unless you ask us to delete them sooner.

Your choices and rights

• Customers and website visitors can ask us to access, correct, export or delete their personal information by emailing [legal contact email]. We will respond within 30 days.
• Practices can disconnect QuickBooks, Google or Open Dental at any time, from Sonty or from those services directly.
• Patients can reply STOP to any text. For anything else about your records, contact your practice.

Depending on where you live, you may have additional rights under state privacy laws. We will honor those requests as the law requires.

Children

Our website and accounts are for business and healthcare professionals, not children, and we do not knowingly collect information from children through them. A practice's patient records may include minors. We handle those records only on the practice's behalf, under HIPAA.

Changes to this policy

We will post any changes on this page and update the date at the top. If a change materially affects how we handle your information, we will notify account holders by email before it takes effect.

Contact us

[legal entity name]
[mailing address]
[legal contact email]