Privacy Policy

Introduction

Dental Spaces LLC ("Dental Spaces," "we," "us," or "our") operates the Ayla dental practice management platform ("Platform"). This Privacy Policy explains how we collect, use, disclose, and safeguard information when you interact with our services, including our practice management software, patient portal, online booking, and electronic communications.

We are committed to protecting the privacy and security of all information processed through our Platform in compliance with the Health Insurance Portability and Accountability Act (HIPAA), state privacy laws, and applicable regulations.

Information We Collect

Patient Information

Through the dental practices that use our Platform, we process the following patient information:

• Name, date of birth, gender, and contact information (phone, email, address)
• Dental and medical health history
• Insurance information and policy details
• Clinical records, treatment plans, and dental charting
• X-rays, photographs, and diagnostic images
• Billing records and payment information
• Signed consent forms and intake documents
• Appointment history and communication preferences

Practice & Staff Information

• Practice name, address, NPI, Tax ID
• Staff names, roles, and login credentials
• Provider license numbers and specialties
• Practice billing and subscription information

Technical Information

• IP addresses, browser type, and device information
• Usage logs and access timestamps
• Error logs for troubleshooting

How We Use Information

We use the information we process to:

• Provide and maintain the Platform and its features
• Facilitate patient scheduling, charting, and treatment planning
• Process insurance claims and electronic remittance advice (ERA)
• Send appointment reminders, confirmations, and recall notifications via SMS and email
• Process payments and generate billing statements
• Deliver intake forms and collect patient consent
• Provide patient portal access
• Generate reports and analytics for practice management
• Maintain audit logs for HIPAA compliance
• Provide customer support and troubleshooting

How We Share Information

We do not sell, rent, or trade patient information. We share information only as follows:

Service Providers

We use third-party service providers to operate the Platform. All service providers that process protected health information (PHI) have signed Business Associate Agreements (BAAs) with us. Our service providers include:

• Amazon Web Services (AWS) — Cloud infrastructure, database hosting, and SMS messaging
• Google Workspace — Email communications
• Stripe — Payment processing
• Stedi — Insurance claims clearinghouse

Insurance Companies

Patient information is shared with dental insurance carriers as necessary to process claims, verify eligibility, and facilitate payment. This sharing is authorized by patient consent and permitted under HIPAA for treatment, payment, and healthcare operations.

As Required by Law

We may disclose information when required by law, regulation, legal process, or governmental request.

HIPAA Compliance

Dental Spaces operates as a Business Associate under HIPAA. We implement administrative, physical, and technical safeguards to protect PHI, including:

• Encryption of data in transit (TLS) and at rest (AES-256)
• Role-based access controls with individual user authentication
• Audit logging of all access to patient records
• Regular security assessments and risk analysis
• Business Associate Agreements with all service providers handling PHI
• Workforce training on privacy and security practices
• Incident response and breach notification procedures

Data Security

We employ industry-standard security measures to protect your information:

• All data is hosted on AWS infrastructure in the United States
• Database connections are encrypted and access-controlled
• Passwords are hashed using bcrypt (never stored in plain text)
• Multi-factor authentication available for all user accounts
• Automated daily backups with 7-year HIPAA retention
• Session management with automatic timeout

Patient Rights

Patients have the right to:

• Access their dental records and request copies
• Request corrections to inaccurate information
• Request restrictions on how their information is used or disclosed
• Receive an accounting of disclosures of their PHI
• Opt out of SMS and email communications at any time
• File a complaint with their dental practice or the U.S. Department of Health and Human Services

To exercise these rights, patients should contact their dental practice directly.

SMS & Email Communications

Dental practices using our Platform may send SMS and email communications to patients for appointment reminders, confirmations, recalls, billing statements, and other practice-related notifications. Patients provide consent for these communications through intake forms or the patient portal.

To opt out of SMS messages, reply STOP to any message. To opt out of email communications, contact your dental practice directly. Standard message and data rates may apply for SMS.

Mobile Application

The Ayla mobile app (available on the Apple App Store and Google Play) provides practice staff with a subset of the Platform's features on iOS and Android devices. In addition to the information described above, the mobile app may access or store the following with your permission.

Device Permissions Requested

• Camera and Photo Library — used only when a staff member attaches a photo to a patient message. Images are uploaded to the same secure storage as the Platform's web uploads; images are not saved to the device's camera roll by the app.
• Face ID / Touch ID (Biometrics) — used optionally to unlock the app after a session timeout. Biometric data is processed entirely on the device by Apple's Secure Enclave or Android's equivalent hardware. The mobile app never receives or stores biometric data.
• Notifications — used to deliver practice-related alerts such as new message indicators and appointment reminders. Notification content is intentionally generic; protected health information is never included in notification previews.

Local Device Storage

• Session tokens are stored in the device's hardware-backed secure storage (Apple Keychain / Android Keystore) and are deleted when you sign out.
• A short-lived queue of audit events may be held locally when the device is offline and is transmitted to our servers on reconnect.
• No patient clinical data is persisted to device storage.

Audit Logging

Staff access to patient records through the mobile app is logged the same way as web access, per HIPAA § 164.312(b). The source of the access (web or mobile) is recorded in the audit trail.

Screen Privacy

When the app is active, iOS and Android screenshot and screen recording functions are blocked on screens containing PHI. When the app is sent to the background, a privacy overlay hides on-screen content from the device's app switcher.

App Store Privacy Disclosures

The data types collected by the mobile app and disclosed to Apple and Google are available on the app's App Store and Google Play listings.

Data Retention

Patient records are retained in accordance with HIPAA requirements and applicable state laws. Dental records are typically retained for a minimum of 7 years from the date of last treatment, or until a minor patient reaches the age of majority plus 7 years, whichever is longer. Practices may request data export or deletion upon termination of service, subject to legal retention requirements.

Children's Privacy

Our Platform processes information about minor patients as part of dental care provided by subscribing practices. All information about minors is handled with the same level of protection as adult patient information and in compliance with HIPAA. Parental or guardian consent is obtained through intake forms before any information about a minor is processed.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify subscribing practices of any material changes via email. The "Last updated" date at the top of this page indicates when the policy was last revised. Continued use of the Platform after changes constitutes acceptance of the updated policy.

Contact Information

If you have questions about this Privacy Policy or our privacy practices, please contact us:

Dental Spaces LLC
1240 S Westlake Blvd Ste 127
Westlake Village, CA 91361
Email: support@ayladental.com
Website: ayladental.com