ClearFlow is an internal patient workflow management application used exclusively by staff at our dental clinic. It is not a public-facing application and is not accessible to patients.

This Privacy Policy applies to all personal data processed through the ClearFlow application, including data about patients and data about clinic staff who use the system.

For the purposes of GDPR, the dental clinic operating this system is the Data Controller. Google LLC (Firebase) is a Data Processor acting on our behalf.

We collect the minimum data necessary to operate the clinic workflow. All data collected has a clear, documented purpose.

Patient Data

Staff Data

As a dental clinic, we are legally required to retain patient records for a minimum of 6 years from the date of the last treatment, in accordance with the Dental Council of Ireland guidelines, the Health Service Executive (HSE) records management policy, and the Statute of Limitations. For patients who were minors at the time of treatment, records must be kept until the patient's 25th birthday (or 26th if the patient was 17 at the time of treatment).

ClearFlow is the daily operational workflow tool for the clinic. The detailed long-term patient records (clinical notes, X-rays, treatment histories) are maintained in the clinic's primary patient management system, not in ClearFlow. The data held in ClearFlow is limited to the scheduling and workflow information described in Section 2.

Access to ClearFlow data is controlled through a strict role-based permission system. Each staff member only sees and can act upon data relevant to their role.

All data is transmitted over HTTPS (TLS encryption) provided by Netlify. All data is stored in Google Firebase (europe-west1 region — within the EU).

No patient data is shared with any third parties outside the clinic other than Google Firebase as our data processor (see Section 5).

We use the following third-party services to operate ClearFlow. All are GDPR-compliant and operate within or provide appropriate safeguards for EU data.

Under GDPR, individuals whose data we hold have the following rights. These apply to both patients whose records appear in ClearFlow and staff members with accounts on the system.

To exercise any of these rights, contact the clinic's data controller using the details in Section 10. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with your national data protection authority.

We have implemented the following technical and organisational measures to protect personal data:

Technical Measures

• HTTPS / TLS encryption — all data in transit is encrypted by Netlify's SSL certificate
• Firebase Authentication — passwords are hashed using bcrypt by Google. We never store passwords in our database.
• Firebase Security Rules — only authenticated (logged-in) users can read or write any data. The database is not publicly accessible.
• Role-based access control — each staff member can only access and modify data appropriate to their role
• Data stored in EU — Firebase database is in europe-west1 (Belgium), within the EU
• Strong password policy — minimum 8 characters, uppercase, number, and special character required
• Session management — Firebase Auth handles secure session tokens with automatic expiry

Organisational Measures

• Access to the system is restricted to employed clinic staff only
• Staff accounts are created and managed by the clinic administrator
• Staff accounts must be deactivated immediately upon leaving employment
• Patient records are cleared at the end of each working day
• The system must not be used on shared or public computers
• Staff must not share login credentials with anyone

In the event of a personal data breach, we will follow the procedure below in accordance with Article 33 of GDPR.

What counts as a data breach

• Unauthorised access to the ClearFlow system
• Loss of a device with an active ClearFlow login session
• Accidental sharing of patient data outside the clinic
• Ransomware or malware attack affecting clinic systems
• A staff member accessing data beyond their role permissions

Response procedure

1. Contain: Immediately revoke access for the affected account(s) in Firebase Console → Authentication → Users → Disable account
2. Assess: Determine what data was affected and how many individuals are impacted
3. Notify supervisory authority: Report to your national data protection authority within 72 hours if the breach is likely to result in a risk to individuals' rights and freedoms
4. Notify individuals: If the breach is likely to result in a high risk to individuals, notify them without undue delay
5. Document: Record the breach, its effects, and the remedial action taken regardless of whether notification is required

ClearFlow uses browser localStorage (not cookies) to store the following information on your device:

Firebase Authentication stores a secure session token in your browser's IndexedDB to keep you logged in. This is managed entirely by Google Firebase and is cleared when you sign out.

No advertising cookies, tracking scripts, or analytics are used in this application. ClearFlow does not use Google Analytics or any third-party tracking.

To exercise your data rights, report a concern, or make a data subject access request, please contact the clinic's Data Controller:

When making a data subject access request, please include your full name and enough information for us to identify your records. We may need to verify your identity before processing the request.