Privacy policy for the roaadent patient app

1. What this policy covers

This privacy policy applies to the app «roaadent» for iPhone, iPad and Android phones and tablets (the «App») and to the roaadent servers with which the App exchanges data (together the «Service»). The App is the patient portal of your dental practice. You can use it only if your practice has invited you. In it you see your appointments, recalls, invoices and quotes, read messages from your practice and can book, reschedule or cancel appointments.

This policy is based on the Swiss Federal Act on Data Protection (FADP, revFADP) and, where it applies to you, on the EU General Data Protection Regulation (GDPR).

2. Who is responsible

Two parties are involved.

Your dental practice is the controller for your patient data in the Service (master data, appointments, recalls, invoices, quotes and messages). The practice decides for what purposes and how this data is used. The practice that invited you is shown to you in the App at login and on the home screen with its address and contact details. Your practice is subject to professional secrecy.

Schweizerpunkt GmbH, Gotthelfstrasse 41, 8172 Niederglatt, Switzerland ([email protected]) publishes the App and operates the roaadent servers. For your patient data it acts as processor on behalf of the practice and only on its instructions.

Schweizerpunkt GmbH is the controller for the App itself (distribution in the App Store and in Google Play, demo mode, content of this policy).

You can exercise your rights (section 10) with your practice or with us. If you write to us about your patient data, we forward the request to your practice, because only the practice can decide on it.

3. The key points in brief

• The App contains no tracking, no advertising and no analytics components.
• We do not sell your data and do not pass it on for advertising.
• You log in by scanning a QR code with the App at your practice. This pairs your phone with your access. There is no password, and no code is sent by SMS or push message. You also enter your date of birth.
• The data you see comes from your practice's file on you. The App never shows diagnoses, findings, X-ray images or treatment notes. The PDF files of invoices and quotes, however, list treatments and tariff items and can therefore contain health information. We therefore treat all data in the App as sensitive personal data.
• The roaadent servers are located in Switzerland (Infomaniak).
• The App uses neither your location nor your contacts, photos, camera or microphone.

4. Which data we process and why

4.1 Login

• QR code. Your practice shows you a QR code that contains your invitation code. You scan it with the App; this pairs your phone with your access (section 4.2).
• Invitation code. You receive it from your practice. It is valid for 14 days and can be used only once. On our servers only a fingerprint (hash) of the code is stored.
• Date of birth. You enter it in the App. The server compares it with the file at your practice. After five wrong attempts the invitation is blocked. The App does not store your date of birth on your phone.
• Acknowledgement of this privacy policy. When you first set up the App, you confirm with «Yes» that you have taken note of this privacy policy. Only then does the App show your data. We store the time and version of your confirmation as proof.
• Purpose: to ensure that only you gain access to your data.

4.2 Registering your phone

At the first login the App generates a key pair on your phone. The private key stays on your phone. The server stores only the public key, the device type («iOS» or «Android»), a general model designation and the time of creation and of last use, so that you and your practice can recognise the device and block it if necessary. Each time the login is renewed, the App proves with the private key that it is still your phone.

4.3 Your data from the practice

After login, the App loads the following data about you from your practice's system over an encrypted connection:

• Personal data: first name, last name, date of birth, address, email address, mobile phone number with masked digits and your preferred language.
• Practice data: name, address, telephone number and email address of your practice.
• Appointments: date, time, duration, treating person, location and status (for example confirmed or cancelled).
• Recalls: type of check-up (for example dental check-up or dental hygiene), due month and whether open or booked.
• Invoices: number, date, due date, amount, outstanding amount, status, reminder level and, for paid invoices, the payment date.
• Quotes: number, date, validity, total amount and status.
• Messages from the practice: for example appointment confirmations and reminders, with the link to the related appointment or document.

Appointments, recalls, invoices and quotes show that you are a patient of a dental practice and when you are treated there. This is information about your health. Purpose: to provide you with the self-service portal and to reduce paperwork and phone calls for you and the practice.

The loaded data stays in the App's working memory for as long as you use it. The App does not store it on your phone, except the PDF documents under section 4.4. When you log out or the session ends, the data disappears from the App's working memory.

4.4 PDF documents

When you open an invoice or quote, the App loads the official PDF from the server. The PDF of an invoice also contains the Swiss payment slip with QR code (QR-bill). The PDF lists treatments and tariff items and therefore contains health information. The PDF is placed in the App's private cache on your phone, which other apps cannot read. The operating system can empty this storage at any time. If you uninstall the App, it is removed.

If you choose «Pay with banking app» or share a document, the App hands the PDF to the app you select in the share menu of your phone, for example your banking app. From then on that app is responsible for the file, under its own privacy policy.

4.5 Booking, rescheduling and cancelling appointments

When you book, reschedule or cancel an appointment in the App, the App sends your selection to the server: the service, the treating person, date and time or the appointment you wish to change. The server enters the appointment in the practice's calendar. Your practice sees that the change came from the App. You receive a confirmation as a message in the App. Cancelling is possible up to 24 hours before the appointment; later you must call the practice.

4.6 Technical data and logs

When the App communicates with the server, the server writes a log line for each request and each security event (for example a wrong code). It contains: time, type of event (for example «invoice list opened»), path requested, number of the document concerned, result, number of your account and device, your IP address and the identifier text of the App's network library (user agent). It contains no content such as amounts, names or codes. The servers also count requests per IP address and per account to prevent misuse and attacks by trial and error.

Purpose: security, error analysis, protection against misuse and proof of who accessed which data (access log). Your practice can view the access history of your App access.

4.7 Data on your phone

• In the phone's secure storage (iOS keychain, this device only; on Android the encrypted storage based on the Android Keystore): the login token for renewing your session, the device number, the private key of your phone and the name of your practice. This data is deleted when you log out.
• In the App's settings (not secret): language, appearance (light/dark), whether the app lock is active and the lock time, and the marker that you are in demo mode.
• In working memory only: the short-lived access token (valid for 10 minutes) and the data under section 4.3.
• In the App's private cache: the downloaded PDF documents (section 4.4).

Backups of your phone's operating system (for example iCloud or Google backup) can contain the App's settings. The secure storage is not transferred to a new phone; after a restore you therefore have to log in again.

4.8 Functions of your phone

• Add to calendar. The App hands the details of an appointment to the «New appointment» screen of your calendar app. You decide whether to save it. The App cannot read your calendar.
• Call, email, route. When you tap the telephone number, email address or address of your practice, the matching app on your phone opens. For the route, the name and address of the practice are handed to the map service.
• App lock. You can protect the App with your phone's unlock method. The operating system performs the check. The App neither receives nor stores any biometric data.

4.9 Demo mode

«View with sample data» shows invented data. In this mode the App does not connect to our servers and no personal data is processed.

4.10 What the App does not do

The App uses neither your location nor your contacts, camera, microphone or photos. It contains no advertising, no analytics tools and no tracking. It does not read your calendar.

5. Legal bases

Switzerland (FADP). Your practice processes your data to perform the treatment contract and the related administration (appointments, invoicing). The processing is lawful, proportionate and transparent. Where the use of the App goes beyond this, it is based on your free decision to use the App and to stop using it at any time, and on the legitimate interest of the practice and of us in secure, efficient communication and in the security of the Service.

EU/EEA (GDPR). Your practice relies on Art. 6 para. 1 lit. b GDPR (contract, handling of the treatment), Art. 6 para. 1 lit. c (legal obligations, for example bookkeeping) and, for security and access logs, on Art. 6 para. 1 lit. f (legitimate interest in the security of the Service). For health data it relies on Art. 9 para. 2 lit. h GDPR (health care and administration under professional secrecy) in conjunction with Art. 9 para. 3 GDPR.

For the App itself (distribution through the stores, demo mode, requests you send to us), Schweizerpunkt GmbH relies on its legitimate interest in providing the App and answering you (Art. 6 para. 1 lit. f GDPR).

6. Who receives data

• Your practice sees everything that is in its own file. It also sees that and when you used the App.
• Schweizerpunkt GmbH operates the roaadent servers as processor of your practice. We access patient data only to the extent necessary for operation, support and security, and only on the practice's instructions.
• The current version of the App does not use push notifications. You see new messages from your practice in the App. If we introduce push notifications via Apple (APNs) and Google (FCM), we will amend this policy before the function is released (section 12).
• Apple and Google operate the App Store and Google Play, the operating system, backups and, if you have allowed it in your phone's settings, crash reports. They process data under their own privacy policies and as their own controllers.
• Apps that you choose yourself (PDF viewer, banking app, calendar app, map service) receive the data that you hand to them.
• We do not sell data. We do not pass on data for advertising. We do not create profiles and do not make decisions based solely on automated processing.

7. Disclosure abroad

The roaadent servers are located in Switzerland.

Where personal data is transferred to a country without an adequate level of data protection, we ensure appropriate protection, in particular through the Swiss-US and the EU-US Data Privacy Framework if the recipient is certified for it, and otherwise through the standard contractual clauses recognised by the Swiss and European authorities, where necessary with additional measures. You can obtain information on this on request (section 13).

8. How long we keep data

If your practice withdraws your App access, all sessions and devices are blocked immediately. Data that the practice must keep by law remains in the practice's system.

9. Security

• All communication between the App and the servers is encrypted (TLS/HTTPS).
• There are no passwords that could be stolen. Login takes place by scanning a QR code at your practice.
• Your phone is bound to your access by a key pair. The renewal of the login must be signed with your phone's private key. The refresh token changes with each use. If an old token is used again, the entire session is blocked immediately.
• Invitation codes and refresh tokens are stored on the server only as protected fingerprints.
• The access token lives only 10 minutes and only in the App's working memory.
• The servers keep the practices separate from one another. The App can query only your own data. Practice and patient result from your login, not from the App's request.
• The number of attempts is limited at every step of the login and for requests in general.
• Every access is logged (section 4.6). Your practice can block devices or your entire access at any time.
• You can protect the App with your phone's unlock method and should secure your phone itself with a screen lock.
• No system is completely secure. If your phone is lost, report this to your practice so that it can block the device.

10. Your rights

Under the FADP and, where it applies, the GDPR, you have the right to:

• information on the data we process about you (right of access), and a copy;
• rectification of incorrect data (the App shows your master data for reading only; for changes contact your practice);
• erasure of your data, where there is no statutory retention obligation;
• restriction of processing;
• data portability (handover and transfer of data) in a common electronic format;
• objection to processing that is based on legitimate interests.

How to proceed. Contact your practice first. It is the controller and decides on your request. You can also write to [email protected]; we forward requests about patient data to your practice and support it in answering. You can have your App access deleted at any time: ask your practice to withdraw your access. Details can be found at https://www.schweizerpunkt.ch/roaadent/#delete-data. You can also log out in the App, which removes the login data from your phone and ends the session on the server, and then uninstall the App.

We answer requests within 30 days. We may need to verify your identity first.

Complaint. You have the right to lodge a complaint with a data protection authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch. In the EU/EEA you may contact the supervisory authority of the country where you live or work or where the alleged infringement took place.

11. Children

The App is aimed at adults. Parents or legal guardians manage children's data with the practice and do not use the App for them. If you suspect that a child has logged in to the App, please report this to your practice or to us.

12. Changes

We amend this policy when the App, the Service or the law change. The current version is always available at https://www.schweizerpunkt.ch/roaadent/privacy/en/index.html and in the App. If we add a function that processes new types of data, we amend this policy before the function is released.

13. Contact

Schweizerpunkt GmbH, Gotthelfstrasse 41, 8172 Niederglatt, Switzerland
Email: [email protected]
Emails to this address are processed by an email provider in Germany, which has an adequate level of data protection (Annex 1 DPO).

Please direct questions about your appointments, invoices or treatment directly to your dental practice.