1. Identity of the Data Controller
Your personal data is processed by Farvex Labs LLC ("Dentexa AI") as data controller within the scope described below.
- Legal name
- Farvex Labs LLC
- Address
- 30 N Gould St #57914, Sheridan, WY 82801, Sheridan, Wyoming, United States
- support@dentexa.co
- Phone
- +1 (210) 996-5020
Who is this notice for?
This notice addresses clinic representatives subscribing to Dentexa AI, their team members, website visitors, job applicants and persons submitting support requests. For patients contacting a clinic's WhatsApp line, the controller is that clinic; see our Consent and Patient Notice page for the applicable text.
2. Categories of Personal Data Processed
| Category | Data processed |
|---|---|
| Identity | Name, surname; authorised representative for legal entities |
| Contact | Email address, phone number, clinic name and address |
| Customer transaction | Subscription plan, order and invoice records, payment status, support requests |
| Transaction security | IP address, session records, password hash, sign-in times, audit logs, cookie data |
| Financial | Invoice details, payment reference numbers (no card data is processed) |
| Professional experience | CV and education details where a job application is made |
| Marketing | Newsletter preferences, campaign communication permissions |
3. Purposes of Processing
- Creating a membership record and managing the account,
- Providing the Service and monitoring subscription and usage limits,
- Managing contractual processes, invoicing and collection,
- Handling requests and complaints and providing support,
- Ensuring information security and preventing unauthorised access and abuse,
- Measuring and improving service quality and statistical analysis,
- Fulfilling legal obligations under tax, commercial and e-commerce legislation,
- Exercising the right of defence in disputes and responding to requests from public authorities,
- Sending commercial electronic messages and marketing where you have given explicit consent.
4. Method of Collection and Legal Basis
Your personal data is collected electronically, by wholly or partly automated means, through forms on the website and dashboard, email correspondence, cookies, notifications from the payment provider and system logs.
| Legal basis (Art. 6 GDPR) | Related processing |
|---|---|
| Art. 6(1)(c) — compliance with a legal obligation | Records under tax, commercial and e-commerce legislation |
| Art. 6(1)(b) — necessary for the performance of a contract | Membership, subscription management, provision of the Service, support |
| Art. 6(1)(c) — compliance with a legal obligation | Issuing invoices, responding to official requests |
| Art. 6(1)(f) — legitimate interest | Evidence in disputes, audit logs |
| Art. 6(1)(f) — legitimate interest | Information security, fraud prevention, service improvement |
| Art. 6(1)(a) and Art. 9(2)(a) — consent and explicit consent | Commercial electronic messages, non-essential cookies, consent-based international transfers, and processing of special category (health) data |
5. Transfer of Personal Data
Limited to the purposes above, your data may be transferred to our service providers, to legally authorised public authorities, and to our legal and financial advisers. Your data is not sold to third parties for marketing purposes.
International transfers: some of our providers are established outside the EEA/UK. Transfers are carried out under Chapter V GDPR (Articles 44-49), primarily on the basis of the European Commission's Standard Contractual Clauses (SCCs) under the 2021 SCC framework, together with supplementary technical measures such as encryption and pseudonymisation where required. Where a provider is located in a country not covered by an adequacy decision or the SCCs, we rely on your explicit consent.
| Recipient group | Purpose of transfer | Location |
|---|---|---|
| Supabase Inc. | Database, authentication and file storage | UK (London) |
| Meta Platforms, Inc. (WhatsApp Business Platform) | Message delivery over WhatsApp | USA / EU |
| OpenRouter, Inc. and affiliated model providers | Generation of AI (LLM) responses | USA |
| Google LLC (Google Calendar API) | Appointment calendar synchronization | EU / USA |
| Open Dental Software, Inc. (only for clinics connecting this PMS) | Writing the approved appointment into the practice management software | USA |
| Dentally Ltd. (only for clinics connecting this PMS) | Writing the approved appointment into the practice management software | United Kingdom / EU |
| DodoPayments Ltd. | Payment processing and subscription management | United Kingdom |
| Railway Inc. | Application hosting and infrastructure | USA / EU |
6. Retention Period
Your data is retained for as long as the processing purpose requires and for the statutory limitation periods. Once these expire, data is deleted, destroyed or anonymised under our Retention and Destruction Policy. See section 8 of the Privacy Policy for the detailed schedule.
7. Your Rights under the GDPR
By applying to the data controller you have the right to:
- Confirm whether your personal data is being processed and access it (Art. 15),
- Request rectification of inaccurate or incomplete data (Art. 16),
- Request erasure of your data — the 'right to be forgotten' — in the circumstances set out in Art. 17,
- Request restriction of processing in certain circumstances (Art. 18),
- Receive your data in a structured, commonly used, machine-readable format and transmit it to another controller — data portability (Art. 20),
- Object to processing based on legitimate interest or carried out for direct marketing purposes (Art. 21),
- Not be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects concerning you (Art. 22),
- Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3)),
- Lodge a complaint with a supervisory authority — such as the data protection authority in your EU member state or, in the United Kingdom, the Information Commissioner's Office (ICO) (Art. 77).
8. How to Exercise Your Rights
You may submit your requests in the following ways:
- By email: support@dentexa.co
- In writing to: 30 N Gould St #57914, Sheridan, WY 82801, Sheridan, Wyoming, United States
Your request should state your full name, an address or email for our reply, and the subject of your request, together with any information that helps us verify your identity.
We respond without undue delay and, in any event, within one month of receipt. Where a request is complex or we have received a number of requests from you, this period may be extended by a further two months; we will inform you of any such extension and the reasons for the delay within the first month (Art. 12(3) GDPR).
Identity verification
Requests made on behalf of another person require appropriate proof of authority. We may request additional information to verify that the request comes from the genuine data subject; this is a security measure to protect your personal data.