Privacy
1. Who we are
RootOS makes software for dental practices. Questions about privacy, and requests about your information, go to hello@rootos.to. In this page "we" means RootOS and "the practice" means a dental practice that has an account with us.
2. This website
This website sets no cookies and runs no analytics, advertising or tracking scripts. It has no forms. Our hosting provider, Vercel, keeps ordinary web-server logs (network address, page requested, time) for security and operations, and nothing else is collected from a visit.
3. Email we send
Every message from RootOS is sent from an address ending in
@notify.rootos.to, through Amazon Web Services in its Canada
Central region. We send only transactional messages, meaning messages a person
caused by using the product, and no marketing email of any kind.
| Message | Who receives it | How it stops |
|---|---|---|
| Sign-up confirmation and password reset | The person who asked for it | It is sent once per request. Nothing follows. |
| Invitation to join a practice | A colleague whose address a practice administrator typed | The link expires in 14 days. Ignore it and nothing happens; reply to reach the person who sent it. |
| Front-desk notice | The front-desk address a practice saved in its settings | The practice changes or removes the address in its settings, at any time. |
No message contains patient information. A front-desk notice says how many items are waiting and links to a sign-in; it never names a patient or says anything about their care. Replies to an invitation or an alert go to a person at the practice, not to an unattended mailbox.
We keep a record of each message we send, and of every bounce and complaint returned to us, so that "the email never came" has an answer. An address that bounces permanently or reports a message as unwanted is not sent to again, and a practice whose alert address has bounced is told so in the product.
4. Practice accounts
When a practice creates an account and invites its team, we hold:
- each user's name, email address and role, and the practice's name, address and specialty;
- billing details for the practice; card numbers are held by our payment processor, Stripe, not by us;
- a sign-in session in the browser, until sign-out or the practice's idle timeout;
- a record of who created, edited, approved or deleted what in the product, and when, which practices rely on and which is part of the service.
We use this to provide and secure the service, to bill the practice and to answer support requests. We do not sell it and do not use it for advertising. It is kept while the account exists and for as long afterwards as billing and legal record-keeping require.
5. Patient information
RootOS holds patient information only on behalf of a practice, as the practice's service provider, and only once the practice has signed a written agreement with us that sets out our duties for it. Until then a practice uses test patients only. That information is stored in Canada, is isolated per practice, is used for nothing but providing the service to that practice, and is never used to train machine-learning models. RootOS is designed to support HIPAA-, PHIPA- and PIPEDA-compliant deployment; whether a given deployment is compliant depends on the agreements in place and on how the practice uses it.
The full description of what is held for a practice, the providers that process parts of it, and the safeguards around it is part of that agreement, and a patient's rights of access and correction are exercised through their practice, which holds the record.
6. Your rights and complaints
You may ask what we hold about you, ask for corrections, and ask for your account to be deleted, subject to a practice's need to keep its audit records. Write to hello@rootos.to. You may also complain to the privacy regulator for your jurisdiction: in Ontario, the Information and Privacy Commissioner of Ontario; in Canada federally, the Office of the Privacy Commissioner of Canada.
7. Changes
When this page changes we post the new version here with a new date. Practices under agreement with us are told before a change that affects them takes effect.