Privacy Policy

Controller and legal roles

Axotia Operations LLC is the data controller for website-visit data, contact data, account data and billing data. For clinic-controlled patient data (including messages and images), Axotia Operations LLC acts as a data processor, while the practice is the controller. Axotia Inc. is the parent company and the owner of the AXOTIA software and intellectual property.

• ▸Controller: Axotia Operations LLC (Delaware limited liability company)
• ▸Delaware file number: 10692063
• ▸Place of registration: Delaware, USA
• ▸Contact: hello@axotia.com
• ▸Phone: +381 65 383 6172

1. Categories of data we process

• ▸Practice data: the names of dentists and staff, email address, telephone number, and the practice's name and tax identification number.
• ▸Payment data: payments may be processed securely via our partner Paddle (Merchant of Record) — Axotia Operations LLC does not store payment-card data.
• ▸Administrative patient data: name and telephone number, solely for the automatic entry of appointments.
• ▸Multimedia content: text messages and images that patients send to the AI agent.

2. Legal treatment and security of images (GDPR Article 9)

• ▸Administrative intake without diagnostics: all messages and photographs are treated solely as incoming administrative material. The system performs no autonomous medical analysis and makes no clinical decisions.
• ▸Isolated AWS cloud storage: received images are automatically stored in an encrypted AWS S3 object (Frankfurt, Germany), accessible only to the practice's authorized staff.
• ▸No AI training: Axotia Operations LLC guarantees that patient data and images are never used to train AI models or sold to third parties. Data may be disclosed only to authorized sub-processors that process it under contract and on our instructions.

3. Technical data-protection measures

• ▸Encryption in transit: all data is encrypted with the TLS 1.3 protocol during transmission.
• ▸Encryption at rest: production platform data is stored under AES-256-GCM encryption.
• ▸Logical isolation: your practice's data is fully separated from the data of other practices on the platform, eliminating the risk of cross-tenant data leakage.

4. Engaged sub-processors and service providers

• ▸AWS Frankfurt, Germany: database hosting and image storage.
• ▸Paddle group (contracting entity depends on the buyer's location): transaction processing and invoice management.
• ▸Twilio / Infobip (EU servers): automated sending of SMS confirmations and appointment reminders.
• ▸Vercel: hosting of the public website.

5. Retention periods and data deletion

• ▸The practice's administrative panel allows the immediate deletion of communication history and patient images.
• ▸After cancellation of the subscription or at your request, all data is permanently removed from servers and backup archives within 30 days using cryptographic erasure (crypto-shredding).

6. Your rights (GDPR Articles 15–22)

As a customer of the platform or a patient whose data is processed, you have the following rights:

• ▸Right of access (Article 15): you can request a copy of all your data that we process.
• ▸Right to rectification (Article 16): you can request correction of inaccurate or incomplete data.
• ▸Right to erasure (Article 17): you can request permanent deletion of your data (see Section 5).
• ▸Right to data portability (Article 20): data is available for export in a structured, machine-readable format.
• ▸Right to object (Article 21): you can object to certain kinds of data processing.

7. Visitor analytics (cookie-free)

We use Vercel Web Analytics and Vercel Speed Insights to measure the total number of visits and the site's technical performance (Core Web Vitals) at an aggregate level.

• ▸No cookies. These tools do not set or read any cookies in your browser.
• ▸Temporary session measurement. Vercel derives a hash from the incoming request to recognize a visit and calculate aggregate statistics. The hash cannot be used to track a visitor across different sites or applications and is discarded after 24 hours; the IP address is not linked to a persistent visitor profile.
• ▸Purpose of processing: solely to measure the total number of visits and page-loading speed in order to improve the site technically.
• ▸Service provider: Vercel Inc., 340 Pine Street, Suite 701, San Francisco, CA 94104, USA. Data is processed in accordance with the Vercel Privacy Policy and the EU–US Data Privacy Framework.

In this configuration, analytics sets no cookies and uses no persistent browser storage. If we change the configuration or introduce technology that requires consent under applicable law, we will obtain consent before activating it.

8. Cookies and functional storage

AXOTIA does not set non-essential cookies, use advertising tools or track visitors across different sites. We use the cookie-free analytics described in Section 7.

9. Privacy contact

For any questions, requests or complaints regarding privacy, contact us at: hello@axotia.com

You have the right to lodge a complaint with the competent data-protection supervisory authority in your country. For Bosnia and Herzegovina, this is the Personal Data Protection Agency (AZLP).