DentoraMedia CRM Privacy Policy

This Policy applies to DentoraMedia CRM, dentoramedia.com, our clinic CRM, campaign tools, forms, integrations, and related services (the “Services”).

For clinic account and business data, DentoraMedia CRM generally acts as a controller. When we process patient or lead data on behalf of a clinic, the clinic is the controller and DentoraMedia CRM acts as its service provider or processor. Clinics are responsible for their notices, lawful basis, permissions, and instructions.

• Account and clinic data: name, business name, email, phone, address, role, login information, preferences, and account status.
• CRM data: patient or lead name, age, phone number, city, notes or stated dental problem, appointments, treatments, payments, follow-ups, and pipeline activity entered by an authorized clinic user.
• Campaign data: campaign settings, form identifiers, lead source, advertiser identifiers, event timestamps, delivery status, and performance information.
• Communications: messages, support requests, form submissions, email, and WhatsApp correspondence.
• Technical data: IP address, browser and device details, security events, diagnostic logs, and usage information needed to operate and protect the Services.

When an authorized clinic user connects TikTok, we use TikTok Login Kit to request the user.info.basic permission and may receive an account identifier, display name, authorization code, access token, refresh token, granted scope, and token expiry information. OAuth credentials and tokens are processed server-side and are not intentionally exposed in the browser.

For TikTok Lead Generation, we may receive webhook events and lead-form answers, including a lead’s name, age, phone number, city, note or dental concern, form ID, lead ID, advertiser ID, submission time, and campaign attribution. We use this information only to deliver the lead to the clinic’s isolated CRM workspace, prevent duplicates, support follow-up, and diagnose delivery.

We do not sell TikTok user data. We do not use TikTok data for unrelated advertising profiles. Access is limited to the applicable clinic and authorized Dentora personnel who need it to provide or secure the Services. TikTok’s own processing is governed by TikTok’s policies.

• Provide, maintain, personalize, and secure the Services.
• Create and administer clinic accounts and permissions.
• Deliver leads, manage campaigns, appointments, workflows, and communications.
• Authenticate integrations, exchange and refresh tokens, and maintain requested webhook subscriptions.
• Respond to requests, provide support, send transactional messages, and prevent fraud or abuse.
• Meet legal obligations and enforce our agreements.

Where applicable, we process information to perform a contract, follow clinic instructions, pursue legitimate interests such as security and service improvement, comply with law, or act with consent. A clinic must establish its own lawful basis before adding patient or lead information to the Services.

We may share information with infrastructure, hosting, database, authentication, email, communications, analytics, and security providers solely as needed to operate the Services. We may also disclose information when required by law, to protect rights and safety, during a business transaction subject to appropriate safeguards, or at the direction of the relevant clinic or user.

We do not sell personal information. We do not share clinic CRM data with other clinics. Each clinic’s records are logically isolated through account permissions and database access controls.

Information may be processed in countries where DentoraMedia CRM or its service providers operate. Where required, we use appropriate contractual and organizational safeguards for international transfers.

We apply access controls, encrypted transport, tenant isolation, restricted server-side secrets, monitoring, and other reasonable safeguards. No system is completely secure, and users must protect their credentials and promptly report suspected unauthorized access.

We retain information while an account is active and as needed to provide the Services, meet legal or contractual requirements, resolve disputes, maintain security records, and enforce agreements. OAuth state values are short-lived and single-use. Integration tokens are retained until disconnected, replaced, expired, or no longer needed. Clinic data may be deleted or returned according to the clinic agreement, legal obligations, and backup schedules.

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or receive a copy of your personal information, and to withdraw consent. Clinic patients and leads should first contact the clinic that collected their information. We support clinics in responding to valid requests.

You may disconnect TikTok from the Ads & Campaigns area. You may also revoke access through TikTok where available. Disconnecting stops future access but does not automatically remove information lawfully retained in the CRM; contact us or the relevant clinic to request deletion.

The Services are intended for businesses and authorized adult users, not children. Clinics must not submit children’s data without appropriate authority and safeguards. CRM notes should contain only information reasonably necessary for clinic operations and must not be used as a substitute for a regulated medical record system unless separately agreed.

We may update this Policy as the Services or legal requirements change. We will post the revised version here and update the date above.

Privacy questions or requests: dentoraagency@gmail.com or +961 81 333 962. DentoraMedia CRM operates from Lebanon and serves dental clinics through its online platform.