Privacy Policy

PatientStars limits its data collection strictly to what is necessary to operate our dental reputation and Google 3-Pack local SEO platform:

• Practice Account Data: Authorized representative name, professional email address, dental practice name, public business address, office telephone number, and login credentials.
• Google Business Profile Data: Public reviews, reviewer display names, star ratings, review timestamps, and existing published responses retrieved via official Google APIs upon authorized OAuth connection.
• Billing Information: Payment transactions are handled directly by Stripe. PatientStars does not store unencrypted credit card numbers, CVVs, or cardholder banking credentials on our servers.
• Technical Telemetry: Anonymized server logs, browser user-agent strings, IP addresses, and feature interaction timestamps collected strictly for security monitoring, rate limiting, and fraud prevention.

We process collected information solely for legitimate operational purposes, including:

• Generating customized, clinical reputation diagnostic scorecards for dental practices.
• Drafting professional, HIPAA-compliant response drafts for incoming patient reviews under doctor-defined directives.
• Dispatching transactional administrative notifications and review alerts via email and SMS (for opted-in work phone numbers).
• Maintaining platform security, mitigating malicious crawling, and verifying OAuth session validity.

We do not sell, license, or monetize your practice data, and we do not compile behavioral advertising profiles from your practice records.

In accordance with Google's API User Data Policy, PatientStars strictly enforces the following standards:

• Permitted Scopes: We request access only to the Google Business Profile management scopes necessary to sync reviews, verify listing details, and post authorized replies on behalf of your dental practice.
• No AI Training on Google Data: We do not use data obtained through Google APIs to train, fine-tune, or improve generalized artificial intelligence or machine learning models.
• Restricted Data Transfer: Google user data is never transferred to third parties unless strictly necessary to provide or improve user-facing features that are prominent in the PatientStars user interface, to comply with applicable law, or as part of a formal corporate merger or acquisition with explicit user notification.
• No Advertising Use: Google user data is never used or transferred to serve advertisements, including personalized, re-targeted, or interest-based ads.
• Revocation of Google Access:You can revoke PatientStars' access to your Google account at any time through your Google Security Settings at https://myaccount.google.com/permissions. Upon disconnection, stored OAuth access tokens are purged from our database immediately.

Our AI response generator operates strictly on public review text and applies the HIPAA De-Identification Safe Harbor standard (45 CFR § 164.514). Response drafts are engineered to de-identify clinical context and avoid confirming patient status. Because PatientStars does not handle or store Protected Health Information, the platform operates strictly on public communications and authorized office contact details.

PatientStars complies with all CTIA guidelines and U.S. mobile carrier A2P 10DLC registration requirements. When you opt in to receive SMS alerts regarding your practice account:

• Absolute Non-Sharing: Mobile numbers and SMS consent data are excluded from all data sharing. We will never share, sell, rent, trade, or transfer your mobile phone number or messaging opt-in consent to any third party, affiliate, or marketing partner for promotional or advertising purposes.
• Twilio Infrastructure: Twilio serves exclusively as our telecommunications routing vendor. Twilio processes numbers solely to deliver messages you requested and does not have permission to contact you or utilize your information independently.
• Opt-Out Protocol: You may cancel SMS notifications at any time by replying STOP to any message received from us. For assistance, reply HELP or contact support@patientstars.com.

We engage select enterprise cloud sub-processors to deliver core infrastructure. All sub-processors are contractually bound by strict data processing agreements and confidentiality standards:

• Supabase Inc.: Primary database and authentication services (SOC2 Type II certified, encrypted in transit and at rest).
• Google Cloud Platform: Business Profile API synchronization and OAuth infrastructure.
• Stripe Inc.: PCI-DSS Level 1 certified billing and payment infrastructure.
• Twilio Inc.: Verified A2P 10DLC telephony and SMS routing gateway.
• Resend Inc.: Transactional email delivery infrastructure.
• Vercel Inc.: SOC2 certified secure edge hosting and serverless compute.

We retain practice account information only as long as your practice maintains an active account. If your practice elects to close its account:

• OAuth tokens connecting your Google Business Profile are instantly revoked and deleted.
• Practice administrative profiles and user contact records are permanently erased within thirty (30) days.
• Anonymized transaction ledgers are retained solely to comply with statutory tax and accounting regulations.

PatientStars deploys defense-in-depth administrative, technical, and physical safeguards designed to protect practice data against unauthorized access, loss, or alteration:

• Encryption Standards: All data transmitted between your browser and our servers is encrypted using modern Transport Layer Security (TLS 1.3). Database records are encrypted at rest using AES-256.
• Access Controls: Production environments require multi-factor authentication, cryptographic SSH keys, and role-based least-privilege administrative access.
• Breach Notification: In the event of a confirmed security breach affecting your practice credentials, PatientStars will notify affected practice administrators via email without unreasonable delay in accordance with applicable law.

Depending on your jurisdiction (including rights under the California Consumer Privacy Act / CCPA), your practice has specific rights regarding stored information:

• Access & Portability: You may request a machine-readable export of your stored practice records.
• Correction: You may correct inaccurate practice contact details directly within your dashboard settings.
• Erasure: You may request the permanent deletion of your practice profile by emailing support@patientstars.com.

PatientStars utilizes strictly necessary first-party cookies for cryptographic session maintenance, user authentication, and CSRF protection. We do not deploy third-party advertising cookies or cross-site tracking beacons. You can configure your browser to reject cookies, though doing so may prevent authentication and dashboard access.

We may periodically update this Privacy Policy to reflect evolving regulatory standards or service enhancements. When material modifications occur, we will revise the Effective Date at the top of this page and deliver prior written notification via email or an administrative dashboard banner. Continued use of the Services after the effective date of an update constitutes acceptance of the revised policy.

For regulatory inquiries, data subject access requests, or questions regarding our Google API compliance: