PrivacyPolicy.

1Who is responsible for your data

TrazaLab is a software platform for coordinating cases between dental clinics and dental labs. Its role depends on the type of data:

For any privacy matter: [email protected].

2What data we process

Only the data needed to operate the platform.

3How we use it

To provide the service

• Create and manage your account.
• Manage work orders between dental labs and clinics.
• Enable communication between users in TrazaChat.
• Store, organize and version the files for each case.
• Send operational notifications by email and WhatsApp Business.
• Verify your identity and manage invitations and connections between dental labs and clinics.
• Comply with applicable legal obligations.

Only if you agree

• Send you updates about new features.
• Run aggregated statistical analysis to improve the product.
• Invite you to satisfaction surveys.

You can withdraw this consent at any time by writing to [email protected]. Withdrawing it does not affect your use of the platform.

4Clinical and patient data

• You are the controller.The clinic or lab decides what it uploads and who sees it. TrazaLab processes that data on your behalf.DPA · GDPR Art. 28
• Patient consent.Obtaining it before uploading clinical data is the professionals' responsibility. By sharing files, you represent that you have that authorization.
• It remains yours.You keep all rights to the clinical data. TrazaLab is its custodian, not its owner.
• Patients in the US.For protected health information (PHI) covered by HIPAA, the BAA also applies.HIPAA

5Where it is stored and how it is protected

Data is stored in Cloudflare R2. Encryption is applied at the infrastructure level: it is neither optional nor configurable.

• Encryption in transit.TLS 1.2 or higher for the browser, the API, file uploads and notifications.
• Encryption at rest.AES-256 GCM in Cloudflare R2, including replicated copies.
• Role-based access.Technicians, clinic admins and doctors see only what corresponds to their role. Isolation is enforced in the database, not on the screen.
• Immediate revocation.Removing access takes effect instantly. Data is never stored on the user's device.
• Audit log.Every action is logged with the user, IP address and UTC time. No one can modify or delete it.
• Incident notification.If we detect a breach, we notify affected users within 72 hours at most.

Full details are in Platform security.

6Who else is involved

We use these providers to deliver the service. They receive your data only for the purposes this policy requires.

International transfers

Some providers process data outside the European Economic Area, for example in the United States. In those cases we apply the safeguards the GDPR requires, such as standard contractual clauses or other valid measures.

7How long we keep it

While your account is active

Your files are kept with no expiration date for as long as the account is active.

When you close your account

You can export all of your data. It is then deleted from every storage location. We do not keep clinical data for analytics, training or any other purpose.

Legal obligations

Some data may be kept longer when the law requires it, for example health-related records.

8Your rights

You can exercise these rights over your personal data at any time:

• Access.Know what data we hold about you and how we process it.GDPR Art. 15
• Rectification.Correct inaccurate or incomplete data.GDPR Art. 16
• Erasure.Ask us to delete your data when it should no longer be processed.GDPR Art. 17
• Objection and restriction.Object to a specific purpose or restrict the use of your data.GDPR Arts. 18 and 21
• Portability.Export your cases, files and history in a structured format, whenever you want.GDPR Art. 20
• Withdraw consent.For the optional purposes, without affecting the service.GDPR Art. 7(3)

Write to [email protected] with your name, your account email and the right you want to exercise. If a clinic or lab uploaded your data to a case, send your request to them: they are the controller, and TrazaLab helps them respond.

If you believe we have not handled your data properly, you can file a complaint with the data protection authority in your country. The next section lists which one applies based on where you are.

9Depending on where you are

This policy applies to all TrazaLab users, wherever they are. In addition, depending on your country:

• Spain and EUGDPRLOPDGDD

  The General Data Protection Regulation (GDPR) and Spain's Organic Law 3/2018 (LOPDGDD) apply. We respond to your request within one month, extendable in the cases the GDPR provides for.

  You can file a complaint with the Spanish Data Protection Agency (aepd.es). The site owner's details are in the Legal Notice.

• United StatesHIPAAState privacy laws

  If your clinic or lab handles protected health information (PHI) subject to HIPAA, the Business Associate Agreement (BAA) also applies.

  We do not sell personal data or share it for advertising. If your state's privacy law gives you rights to access, correct or delete your data, exercise them by writing to [email protected]; you will not be treated differently for doing so.

• Latin AmericaLGPDLaw 25,326Law 1581Law 19,628Law 29733

  The rights in the previous section are also yours under your country's law, such as Brazil's LGPD, Argentina's Law 25,326, Colombia's Law 1581 of 2012, Chile's Law 19,628 as amended, Peru's Law 29733, Uruguay's Law 18,331, Ecuador's LOPDP and Costa Rica's Law 8968, among others. We respond within the period that law sets.

  If you are not satisfied, you can contact the data protection authority in your country. In Brazil, the LGPD Privacy Notice also applies.

10Cookies

We use cookies that are necessary for the site to work and, only with your permission, analytics cookies to improve it. There is no advertising. Each one is listed in the Cookie Policy.

Cookie settings

11Changes to this policy

If we change this policy, we will publish the new version on this page with its date. If the changes are substantial, we will also notify you within the platform or by email.

12Contact