Who is responsible for this notice
Ziel Practice and Ziel Inventory are software products operated independently by ns ea, with service contact address Beirut, Lebanon. “Ziel Corporations” is a proposed brand and not a registered company. The operator can be contacted about personal data at [email protected]. This notice covers the Ziel Practice website and applications and describes the operator’s and clinics’ different responsibilities.
Clinic data versus account data
For patient records, the treating clinic normally determines the purposes and lawful basis of processing. The Service operator may process clinic information on the clinic’s lawful instructions; a separately executed data-processing agreement may be needed before processing sensitive healthcare data. For account registration, authentication, security, customer support and website operations, the operator may determine processing purposes and related legal grounds, subject to applicable law.
Information used for registration
We may process your name, email address, verified account identity, clinic or practice association, role, authentication events, and settings to create and protect your account. If you sign in with Google, the identity information supplied within the authorized login scopes may be processed for authentication. Passwords should be handled by the identity provider, not collected through email or support.
Clinic and patient information
The software may store and synchronize identifiers, patient contact details, clinical history, notes, dental charts, treatment plans, appointments, documents, radiographs, photographs, financial records, and communications entered by clinic staff. Patient information may be health data that requires enhanced legal protections. Clinics should only upload information for which they have the necessary legal authority.
Payments, support, and operational records
Subscription tier, transaction identifiers, billing status, support correspondence, diagnostic data, device metadata, IP addresses, login events, and security-audit records may be processed to operate and protect the Service. Where Paddle is merchant of record, it handles payment card processing; do not send payment-card numbers in support messages.
Why information is used
Information is used to provide the requested service, manage sign-in and clinic access, synchronize records under clinic instructions, support customers, administer subscriptions, investigate potential abuse, meet legal obligations, and maintain security and integrity. The applicable legal basis may be contractual necessity, a legal obligation, legitimate interest, or another basis required by local law. Patient-data processing follows the clinic’s lawful instructions and applicable requirements.
Secure login and account safeguards
User identities and permissions are intended to restrict access to authorized accounts and clinics. Authentication and access requests are handled using configured account-security controls; audit and suspicious-activity records support incident investigation. Staff should use strong unique passwords and MFA when available, secure their computers, and immediately report suspected compromise. Avoid public or shared devices for sensitive records. We will not claim an unverified certification or security feature.
Protecting patient records
Controls appropriate to the deployment can include authorization checks, restricted storage access, protected network connections, logging, backups, and recovery safeguards. The precise measures and security responsibilities should be documented and verified in the service’s Security & Patient Data overview and applicable DPA. Local copies, exported documents, printed records, and devices remain the clinic’s responsibility unless agreed otherwise. No online or offline storage can be guaranteed risk-free.
Service providers and international locations
Depending on enabled features, the Service may involve Supabase (authentication, database and storage), Cloudflare (website delivery), Paddle (checkout and subscription handling), Resend (transactional email) and Google (optional authentication or calendar access). Not every provider is enabled for every customer. Where relevant, cross-border access and transfer arrangements depend on provider configuration and the clinic’s location; customers may request current applicable vendor and region information at [email protected]. Clinics should not upload patient data until their applicable legal and contractual arrangements are in place.
Communications and connected services
Clinics choose which patient notifications, calendar connections, booking features, or other integrations to enable. Contact details or appointment information may be sent to the selected provider as required for that feature. Clinic administrators must ensure patient messaging is appropriate, recipient details are correct, and required consent or notices have been obtained. Google account access can be disconnected through the relevant account/provider settings where supported.
Cookies, device storage and analytics
The site and apps may use technically necessary cookies or local storage for authentication, safety, preferences, and service operation. Optional analytics or advertising technologies require a separate assessment, notice, and consent controls where required; the signup checkbox is not consent to optional tracking or marketing. See the Cookie Policy.
Retention, backups and deletion
Retention depends on the information category, the purpose of use, documented clinic instructions and legal preservation requirements. Account and security records are retained only for as long as needed for legitimate account operations, security investigations or legal obligations. Clinic records are handled under the clinic’s instructions and applicable clinical retention requirements; termination does not automatically erase clinical records. Backups may persist during normal rotation and required preservation periods. There is no single guaranteed deletion or backup-expiry deadline across all categories; where a fixed interval is required, it must be set out in a separately agreed service or processing arrangement. Contact [email protected] for the applicable retention procedure before uploading regulated data or terminating a clinic account.
Patient rights and clinic requests
For corrections, access requests, or disclosure questions relating to a clinic’s patient record, the patient should normally contact the treating clinic first. We will cooperate with authorized clinics on rights requests as required by applicable law and contract. Account holders can ask about their own registration information at [email protected]. Available rights, identity verification, complaint mechanisms, and response periods depend on the person’s jurisdiction.
Security incidents
Report suspected compromise or unauthorized exposure to [email protected]. Credible reports will be assessed, evidence preserved where appropriate and affected customers or authorities notified as applicable law requires. Any additional contractual notification deadline requires a separately agreed arrangement; this notice does not assert an unverified fixed response time.
Children, changes and contact
The Service is intended for professional clinic users, not children creating their own clinic accounts. Clinics may process data relating to child patients where lawfully authorized. Material privacy changes will be dated and communicated where required. Acknowledging this notice does not constitute blanket consent to optional marketing, tracking or all processing of patient data. Enquiries and requests: [email protected].