What we collect, why, and what never leaves your practice.

Who we are

OperatoryView makes the Board, in-office messaging and analytics for dental practices, in an app on each office PC.

Write to us at support@operatoryview.com.

This page covers our website, the accounts practices open on it, the downloadable demo, our emails and support, and what the installed software sends us. Your patients' information is handled under the Business Associate Agreement we sign with your practice; the section "What the software does with patient information" below describes it.

What this website collects

When you create an account we ask for your name, your practice name, your email address and a password. The password is stored only as a hash by the sign-in library we use; nobody here can read it. The form also asks how you heard about us, which is optional and can be left blank.

When your practice accepts our Business Associate Agreement, we record the practice, the name and title of the person who accepts it, the agreement's version, the date and time, and the network address and browser description it was accepted from. We keep that record as the record of the agreement.

Signing in creates a session, and that session record holds the network address your browser connected from and the description your browser sends of itself. Signing in from a browser we do not recognize sends a six-digit code to your email address.

We use the connecting network address to limit how often anyone can sign in or call our services; those records hold the address only in a scrambled form that changes every day, and we delete each record when its limit period ends (at most three days) and each day's scrambling key after four days. We also record it when someone opens our own staff screens.

When you first arrive we note which page you landed on, the campaign labels in the link if it has any, and which site sent you (its name only, not the full address), in a cookie that lasts 90 days, and we keep those facts with your account if you sign up. That is how we learn which pages bring practices to us.

If you leave your email address to hear from us, we keep it in a list on our own database and use it for that. Every such email has a one-click unsubscribe. Emails about your account (sign-in codes, your license key, a payment that did not go through) are not optional while you have an account.

Payments

Payments are handled by Stripe. We store the identifiers Stripe gives us for your customer record, your subscription and your checkout, together with the plan you chose and whether you are billed monthly or annually. We never see or store your card number. Stripe's privacy policy is at stripe.com/privacy.

The downloadable demo

The demo runs a made-up practice. It makes a random identifier for itself when it first starts. If you use its AI features, we count your questions by that identifier and by your network address, which we store only in a scrambled form, so we can apply the demo's limit; the count is kept for 72 hours. What you type to the demo's AI, and the demo's made-up figures, are sent to Claude, the AI model that powers it, in our cloud on Amazon Web Services, to answer you, and we do not keep the conversation. Please do not type real patient information into the demo.

When you download the demo, and the first time it starts, we also record your network address, the description your browser or computer sends, the rough location and network that address belongs to, an identifier the demo makes for itself, its version, your screen size, and a fingerprint made from those details, to count how many people download and install it. We keep these records for 12 months.

What the installed software sends us

The software you install in the practice talks to one service of ours, to keep your license and your Board's certificate current. This is the whole of what it sends: your license key, your practice identifier, a one-way fingerprint of the Open Dental key your practice uses (never the key itself), an installation identifier, the software version, how many operatories are on the Board, the date your certificate expires, the Board's address on your own network, a certificate request, the Board address you chose, the username of the Board's Administrator account (never a password), a short list of coded words about the software's own health, such as that it cannot reach your practice software, and the time the message was sent.

That list is not a summary. The software refuses to send a field that is not on it, and the list is part of the contract between the software and our service.

The update check carries the software version. If you use the AI report, it sends office, provider and room totals; never patient names, identifiers or clinical details. If you use the AI assistant, it sends the question and what it looks up to answer it, which can include patient details the PC asking is allowed to see. Both go to Claude, the AI model that powers them, in our cloud on HIPAA-eligible services under a Business Associate Agreement; nothing they send is stored by the AI service or used to train AI models. If you schedule report emails, they go out through our own email relay, and an address receives them only after the person it belongs to confirms once.

Setup and usage diagnostics: the OperatoryView app sends us which setup steps and checks ran, their results and failure reason codes, how long they took, daily counts of features used, and the version numbers of the app, the server, Windows and your practice software; it never sends patient data, we do not store your internet address with it, and it is on by default and stops when you turn off Share setup diagnostics in the app's settings.

If you send us a support file from the Server Manager, it holds diagnostics and recent log lines, designed to carry no patient information, and never your database or backups. If you write to us, we receive whatever you put in the email.

What the software does with patient information

OperatoryView reads your practice software read-only. So your PCs can show patients quickly, the server in your office keeps an encrypted copy of the patient details it reads: names, birth date, phone numbers, email, address, patient status, provider, recall date, estimated balance, and visits from two years back to eighteen months ahead. It refreshes that copy every two minutes, removes patients your practice software deletes, archives or merges, and keeps it in the server's encrypted backups. It is never sent to us. The notes your team writes for each visit (kept for the time your practice sets, 2 years by default) and the patients you add to lists are kept on that server too, and are in its encrypted backups. The history behind your analytics holds no patient name, initials or chart number.

The messages your PCs send each other, the office chat included, and the files attached to them stay on the server in your practice for the time your admin sets (1 year by default, anywhere from 30 days to 7 years), then are deleted, and reach us only when someone asks the AI assistant about the day's messages. Your own patient alerts and your team notes are kept on that server until someone removes them, and are in its encrypted backups; assistant chats are kept there for 30 days after the last message. Messages and their files are in those backups too; assistant chats are left out of them. Every time a patient's record is opened, or looked up by the assistant, the audit log records who, from which PC, and when, without the patient's name.

The hosted edition

If your practice uses OperatoryView's hosted edition, for cloud practice software such as Open Dental Cloud, OperatoryView runs for your practice on Amazon Web Services in the United States instead of on a computer in your office. A patient a PC opens is read live from your practice software through its official API, held in memory and never saved. What your team enters in OperatoryView is stored for your practice in an encrypted database in our cloud, and some of it can name a patient: patient alerts, team notes, messages and their attached files (kept for the time your admin sets, 1 year by default) and assistant chats (kept 30 days after the last message), along with your rooms, settings, accounts and history. It is encrypted with our own keys, its backups are kept for 35 days, and we use it only to run OperatoryView for your practice. The analytics keep practice-level totals only. It is deleted when you ask us to delete your account.

Your Board's address is public

Your Board is reachable at an address you choose, and a certificate is issued for it so the app on your office's PCs connects without a warning. Certificates are published to a public record that cannot be edited afterwards, so the address you choose is public. Your account page says so at the point where you choose it.

Why we collect it

To run your account and sign you in. To bill you. To issue and renew your license and your Board's certificate. To keep the software updated. To run the AI features you use. To answer you when you write to us. To email you about the account: your sign-in codes, your license key, a payment that did not go through, and changes to your installation. To keep the website and our service safe from abuse. And, for "How did you hear about us?" and the first page you visited, to know which channels bring practices to us.

We do not sell data, and we do not share it for advertising.

Cookies

The website sets three cookies, all its own: one that keeps you signed in (it lasts 30 days, or until you sign out), one that keeps our own staff signed in to our staff screens, and the 90-day cookie that remembers which page you arrived on. There are no advertising trackers and no cookies from anyone else. We count visits to our marketing pages with Cloudflare Web Analytics, which sets no cookie and does not follow you to other sites; it records the page, the site that sent you, your country, your device type, browser and operating system, and how fast the page loaded. It does not run on account pages. You can block or delete cookies in your browser; blocking the first one stops you signing in, and blocking the last one changes nothing about how the site works.

Where it lives

The website, its database and the installer downloads run on Cloudflare, in the United States. The hosted edition runs on Amazon Web Services, in Oregon, in the United States, under a Business Associate Agreement with Amazon. Email is sent through Resend. Our own email, including support, runs on Google Workspace under a Business Associate Agreement, because a practice may send us patient information. Payments are handled by Stripe. Your Board's certificate is issued by a public certificate authority. The AI features, the downloadable demo's included, and emailed reports run on Amazon Web Services. The demo's AI sees made-up data only. No one else holds any of it.

Keeping it, and deleting it

We keep your account and what is on it while your account exists. Email support@operatoryview.com to have it deleted and we will delete it. The record of license and billing events on an account is kept for the security of that account.

Children

OperatoryView is made for dental practices and their staff. The website is not meant for children.

Changes to this page

When this page changes, the date at the top changes with it.

Your choices, and reaching us

Email support@operatoryview.com with any question about this page, about what we hold, or to ask us to delete it. We reply within one business day.