Privacy Policy

Scope and responsibility

This notice covers the AQORIO Dental website and its test prototype, not a live dental service. The practice and patient examples are fictional. Do not submit patient names, health information, clinical recordings or real patient records anywhere in the prototype.

AQORIO operates this site and determines how website enquiries and prototype accounts are used: this is the controller role. The company's official legal identity and registered-office details are awaiting source confirmation before public launch; no registration or legal approval is asserted here.

A future service might process practice data on a practice's documented instructions, with that practice as controller and AQORIO as processor. That arrangement is not active. It requires a separate processing agreement, security and transfer review and clinical release approval.

Information, sources and purposes

• Sign-in: the email address and password you provide to the authentication service, account identifier and session information. Google or Lovable sign-in can supply identity information from the provider you choose. These support sign-in, account security and access to your practice account. Do not put a password in any other form.
• Practice registration: the practice name and country you supply, linked account identifier, owner membership, approval status and associated review decisions. These support administration of a test account, access control and approval review. Your account is separate from the shared fictional demo.
• Test subscriptions: account email and practice/user identifiers may be supplied to Stripe through the Lovable payment gateway. Customer, subscription, price, event and billing-period identifiers and status are stored for test reconciliation and cancellation. Only test details may be used. Card entry takes place in Stripe checkout, not in our practice-account tables.
• UAE interest previously submitted: practice name, contact name, email, emirate, plan interest, optional marketing choice and submission time. These were collected directly to respond to interest; new submissions are paused during privacy and retention review. No account, trial or charge is created by an interest enquiry. Marketing is separate from answering an enquiry.
• Founder pilot interest: if you use the pilot form on the demo page, we store your work email, optional practice name, your pilot-contact request and any separate optional updates choice, with the consent wording version, source and submission time. This is used to contact you about the pilot; product/marketing updates are sent only if you separately opt in, and you can withdraw via hello@aqorio.com. Registering interest is not a purchase and creates no account, trial or guaranteed access. We propose a manual review of these records after 90 days; no automatic deletion is currently implemented.
• Support: Dot opens an email draft containing your reply address, description, practice name, country and page. You decide whether to send it using your email service. Automatic support-email delivery is not active. Information actually emailed to us is used to respond and investigate.
• Browser preferences: role, practice name, country, practice type, appearance, accessibility, menu and voice choices; connected-tool preferences; template text, competitor entries and practice-story memories that you choose to save. These stay in your browser storage, but may appear in the page or in an email draft you choose to send. They are not authorisation for live connections. Use fictional, non-sensitive text only. See the Cookie Policy for names and lifetimes.
• Demo activity: synthetic invoices, follow-up runs and feature requests can include persisted descriptions, decisions and audit history in the shared demo. New shared free-text writes are paused because demo roles are not verified staff identities. Do not treat this space as a private workspace or enter real names.
• Technical operation: hosting and authentication services receive connection information such as IP addresses and request metadata to deliver and secure the site. Server error handling can write error messages and stacks to operational logs. Infrastructure log access and retention still require confirmation. App-triggered optional usage tracking and remote browser exception reporting are disabled.

Legal grounds

We must identify an appropriate UK GDPR lawful basis for each operation before public launch. Account and enquiry administration may involve steps requested before a contract, or legitimate interests in operating a secure prototype, depending on the circumstances; security logs may involve legitimate interests. Optional marketing requires a separate permission where applicable, and you can withdraw it by emailing hello@aqorio.com. These grounds are under founder review, not a claim that a commercial contract exists.

Reading this notice is not consent to all processing. No mandatory “consent to privacy” checkbox is used for account administration. Health data must not be entered: this prototype does not establish a special-category basis for clinical processing.

AI, audio and human oversight

Local Audio Bridge recording/import and mock transcription can be used only with non-clinical sample material and the necessary recording permission. Audio, transcripts and notes are held in page memory until cleared or the page closes; downloaded reports and clipboard copies remain under your control. The Heidi notes demonstration is simulated locally, not a live Heidi connection.

External AI answers, workflow recommendations and AI drafts would send questions and context to Lovable AI Gateway. Audio transcription would send a recording to that gateway; Dot voice playback would send answer text and a voice identifier to ElevenLabs. These transfers are currently paused while provider retention, processing terms and access arrangements are reviewed. The AI request's “store: false” option does not prove that providers keep no logs or use no data for other purposes.

AI output is not a diagnosis, treatment recommendation, regulatory decision or reliable financial calculation. Any future outputs require human review before action. Demo approval does not send patient messages or activate clinical access. No decision giving clinical access or live payment authorisation is made solely by AI here.

Services and international processing

The implementation uses Lovable for hosting, authentication and database services, and a Stripe test-payment connection through the Lovable gateway. Google and Lovable are optional sign-in routes. Public image assets may be served from the Lovable asset CDN. Fonts are now served locally, not requested from Google Fonts. Your chosen email service handles drafts that you send.

ElevenLabs and Lovable AI Gateway are implemented connections but external speech and AI submissions are paused. Calendar preferences, Paddle, Heidi and supplier demonstrations do not establish a live provider connection, partnership or processing contract.

Hosting/database regions, subprocessors, supplier contract terms, backup locations and international-transfer safeguards have not been verified. We do not promise UK-only, UAE-local or any other residency. These are public-launch review items; any future transfers requiring safeguards need the applicable adequacy assessment or contractual safeguards and transfer assessment before activation.

Retention and deletion

Browser preferences have no app-set expiry; they remain until you clear them or use the controls described in the Cookie Policy. Page-memory chat/audio and local mock notes are not intentionally saved as account records. Clearing the page does not remove downloads, emails, clipboard copies or provider logs.

Account, membership, subscription, review, enquiry and persistent demo records currently have no implemented automatic deletion schedule. They may remain until manually removed. Server error capture holds one error in process memory for up to five seconds, but operational log and backup lifetimes are not confirmed. We will not claim automatic erasure or a fixed provider retention period without evidence.

A record-by-record retention schedule and manual deletion procedure are pending approval before public launch. New UAE collection and external AI/audio transfers are paused in the meantime. Contact us for access or deletion requests; we will assess what can be removed, what must lawfully be retained and any provider or backup limitations rather than promise immediate deletion everywhere.

Your rights

Depending on the circumstances, UK data protection law gives you rights to access, correct, erase, restrict or object to processing, receive portable data and withdraw consent where it is used. There are also safeguards concerning solely automated decisions with legal or similarly significant effects. Rights have conditions and exceptions; withdrawing marketing permission does not require deleting your account.

Contact hello@aqorio.com with your request. We may need proportionate identity verification. UK GDPR requests normally require a response within one month, with lawful extensions explained where applicable. You can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint; you do not have to contact us first. Other local rights may apply; no UAE or US compliance approval is claimed.

Changes

This notice will be updated when the actual operations or confirmed facts change. Material new collection or provider use requires fresh review and notice before activation. This version is dated 19 October 2026 and is not legal sign-off.