01 · Scope and identity
Who this policy covers
This Privacy Policy explains how Rashtan Soft collects, uses, stores and shares personal data when individuals visit the Dental Lab Guru website, use the Application, communicate with us, manage a business subscription or make a payment.
“Rashtan Soft”, “we”, “us” and “our” mean Agencija za racunarsko programiranje Rashtan Soft Gavrilo Mumovic s.p. Trebinje, with its registered address at Republike Srpske 4a, floor 4, apartment 22, Trebinje, Bosnia and Herzegovina, unique identification number 4512925880006.
Dental Lab Guru is a B2B service. This policy may apply to Customer representatives, authorised Users, Billing Contacts, professional collaborators and people whose information is included in case data.
02 · Responsibility
Our role when processing data
Rashtan Soft acts as a controller for personal data used to manage its website, customer relationships, user accounts, subscriptions, invoices, support, security and legal obligations.
The Customer determines the authorised purposes for patient, dentist, case and other third-party information entered into Dental Lab Guru, including audio, transcripts and extracted fields. Depending on its relationship with a clinic, laboratory or other organisation, the Customer may act as controller or as a processor for another controller. Rashtan Soft acts as processor or subprocessor, as applicable, to provide the Service on documented instructions.
Where a processing agreement is required, the applicable Data Processing Agreement or contractual processing schedule governs the parties’ responsibilities. This public policy does not replace that agreement or any required Business Associate Agreement.
03 · Data categories
Information we collect
Account, identity and professional data
- name, username, email address, telephone number and login or authentication identifiers;
- Customer name, laboratory or practice information, professional role and assigned permissions;
- support messages, feedback and other communications with Rashtan Soft; and
- security events and records associated with access to the Service.
Application, case and third-party data
Depending on how a Customer uses the Service, data may include dentist and collaborator details, patient references, case instructions, production stages, dates, messages, images, attachments, delivery information, laboratory invoices, payment tracking and related operational records.
Audio transcription and case-entry data
- audio recorded through the microphone or uploaded by an authorised User;
- information spoken or mentioned, including patient names or references, professional details, tooth identifiers, products, materials, shades, quantities, dates and case instructions;
- the complete transcript, proposed fields, extracted information, unresolved matches and conflicts;
- relevant laboratory product and extras catalogue identifiers and names, terminology, product types and dental numbering context supplied for transcription or extraction; and
- recording date and time, timezone, language, job and attachment identifiers, processing status, timestamps, attempts and limited error information.
The speaker may be a dentist or technician while the patient is only mentioned. Uploaded recordings may contain other people’s voices or information. Health information may require additional safeguards. This feature transcribes speech; it does not use voiceprints to identify a person. A patient code reduces direct identification but does not make linkable data anonymous.
Billing and subscription data
- billing name, address, country, email and tax information provided for PayPal checkout or received from Lemon Squeezy where available;
- trial start and end dates, trial status and, where a paid subscription is selected, plan, billing interval, price and currency;
- internal subscription records and PayPal or Lemon Squeezy customer, subscription and transaction identifiers;
- payment date and status, renewal date, cancellation or suspension status;
- refund, reversal and dispute status; and
- invoice number and applicable tax treatment.
Technical and usage data
We may collect IP address, browser and device characteristics, operating system, language and time zone, referring URLs, session and authentication data, device or push-notification identifiers, timestamps, feature interactions, error information and other technical data needed to operate, secure and understand the Service.
04 · Use of data
Why we process information
- create accounts, authenticate Users and provide the Service;
- support case workflows, collaboration, notifications and Customer-requested functions;
- verify B2B eligibility and Customer business information;
- determine applicable BiH PDV treatment;
- create and manage free trials and paid subscriptions, including automatically activating a trial when a laboratory workspace is created, confirming payments and activating paid access;
- issue invoices and credit notes and manage renewals and cancellations;
- process refunds and reconcile payment-provider transactions and fees;
- prevent fraud, payment abuse and unauthorised access;
- respond to disputes, chargebacks, support requests and legal claims;
- maintain, troubleshoot, analyse and improve the Service; and
- comply with PDV, tax, accounting, regulatory and other legal obligations.
Optional audio transcription and case entry
An authorised User can choose to record dictation or upload audio to prepare a case draft. The audio is stored as a private case attachment and sent to Google’s Gemini Developer API for transcription, with language hints and relevant laboratory product vocabulary.
In a separate extraction request, the same provider receives the complete transcript, relevant product and extras catalogue identifiers and names, product types, recording date and time, timezone, language and dental numbering context. Patient names and other information in the transcript are not automatically removed before this request. The purpose is to extract stated information, match catalogue entries and prepare case fields for review, without clinical analysis or recommendations.
The transcript and extraction result are saved with the case. Proposed fields are applied to a draft; the User reviews warnings and conflicts, corrects the information and intentionally submits the case. Audio and the full transcript remain available with the case after processing. The Terms require verification before operational use.
Rashtan Soft does not reuse patient recordings, transcripts or extracted case information for unrelated model training, advertising or research. Operational measurements, such as processing time and failure status, are used to operate, secure and troubleshoot the feature with the minimum information needed. Provider processing and retention are described below.
05 · Lawful processing
Main legal bases
The applicable legal basis depends on the data, purpose and law that applies. We generally rely on:
| Processing | Main legal basis |
|---|---|
| Account creation and administration of the Customer relationship | Performance of contract |
| Subscription and payment management | Performance of contract |
| Invoices, PDV and accounting records | Legal obligation |
| Security and fraud prevention | Legitimate interests |
| Payment disputes and legal claims | Legitimate interests and legal obligations |
| Product analytics | Legitimate interests or consent, depending on implementation and applicable law |
| Optional marketing emails | Consent or another applicable lawful basis |
For Customer-controlled case data, including audio, transcripts and extracted information, the Customer must establish the applicable lawful basis and any additional condition required for health information, and provide lawful instructions to Rashtan Soft. The Customer’s subscription contract is not by itself a legal basis for processing a patient’s health information. Where GDPR applies, this includes an Article 6 basis and an applicable Article 9 condition. Explicit consent is one possible condition, rather than a requirement for every case.
Authorising the feature, accepting the Terms and allowing browser microphone access are separate from any patient or speaker consent, recording permission or privacy notice required by law. HIPAA-regulated information may be submitted only under the agreements and expressly approved services and configurations described in the Terms.
07 · Payments
Payment-provider processing
Lemon Squeezy
Subscription checkout is hosted by Lemon Squeezy, which acts as Merchant of Record for transactions completed through its checkout. Lemon Squeezy may collect and process identity, contact, billing, payment, tax, device, transaction, security and fraud-prevention information.
Customers enter billing and payment information directly on Lemon Squeezy’s hosted checkout. Dental Lab Guru does not require a separate subscription billing profile and Rashtan Soft does not control all information that a Customer provides directly to Lemon Squeezy.
Rashtan Soft may send Lemon Squeezy information required to create or manage a transaction, such as the subscription plan, billing interval and internal Customer reference. Rashtan Soft may receive limited billing and subscription information from Lemon Squeezy, including the customer’s name and email, customer, subscription and transaction identifiers, amount, currency, payment status, renewal information, cancellation status, refund status and dispute status.
Read the Lemon Squeezy Privacy Policy for more information about Lemon Squeezy’s processing.
PayPal
PayPal remains available as an alternative subscription checkout. Dental Lab Guru collects the business billing profile required for this option and sends PayPal the information needed to create and manage the selected subscription. PayPal may collect and process identity, contact, payment, device, transaction, security, authentication and fraud-prevention information.
Rashtan Soft may receive limited information from PayPal, including the payer’s name and email, payer, subscription and transaction identifiers, amount, currency, payment status, renewal, cancellation, refund and dispute information. Rashtan Soft does not receive or store the Customer’s PayPal password, complete payment-card number or complete bank-account credentials.
Read the PayPal Privacy Statement for more information about PayPal’s processing.
08 · Locations
International data transfers
Rashtan Soft is established in Bosnia and Herzegovina. Customers, Users and service providers may be located in other countries. PayPal, Lemon Squeezy, cloud, authentication, analytics and AI providers may process data internationally, including outside the Customer’s country. This includes audio, transcripts, extraction context and outputs sent to Google, as well as support or administrative access by Rashtan Soft in Bosnia and Herzegovina and by its providers.
Where required, Rashtan Soft uses appropriate contractual or legal safeguards for international transfers and assesses providers’ data-protection commitments. Customers may contact us for additional information about safeguards relevant to their data.
An infrastructure hosting region does not establish the location of every AI-processing stage, provider copy or support access. We do not describe this feature as restricted to EU processing or as having a guaranteed country of processing. The applicable processing agreement and provider arrangements determine any agreed location restrictions and transfer safeguards.
09 · Storage periods
How long information is kept
We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including contractual, tax, accounting, security, dispute and legal requirements.
| Data | Retention approach |
|---|---|
| Active account data | While the account remains active and as needed for account closure |
| Case and application data | For the active Customer relationship and the defined post-closure period under the Customer agreement or deletion process |
| Original case audio, including uploaded audio for failed or cancelled processing | Retained as a case attachment under the case-data rules until attachment or case deletion; not automatically deleted when transcription, extraction or review finishes |
| Full transcripts, extraction results and draft-processing records | Retained with the case under the case-data rules, including failed or cancelled jobs where information was saved; deleting the audio attachment does not automatically delete these records |
| Confirmed case fields | Ordinary case-data retention, correction and deletion rules apply after submission |
| Unfinished uploads and temporary upload storage | Upload sessions expire after 24 hours; abandoned staging files are scheduled for storage lifecycle expiry after two days and incomplete multipart uploads for removal after seven days. Storage cleanup may complete later; completed audio attachments follow the case-data rules |
| Temporary Google files and stored processing interactions | DLG requests cleanup of known files and interactions when no longer needed for processing or retry; failures or an unknown request outcome can delay cleanup. Separate Google retention rules also apply |
| Audio-processing operational logs | Production application logs are configured for 30-day retention and contain limited identifiers, status, timing and sanitised diagnostics; recordings, transcripts and provider request/response bodies are excluded. Separately retained incident or legal records follow the applicable requirements above |
| Invoices and tax records | For the period required by applicable BiH tax and accounting law |
| Payment and subscription records | For accounting, reconciliation, fraud-prevention and dispute requirements |
| Dispute evidence | Until the dispute and relevant legal limitation periods expire |
| Support communications | For the operational need and a reasonable legal-protection period |
| Backups | Until removed through the normal backup-rotation process |
Data may be retained longer where required by law, a legal hold or the establishment, exercise or defence of legal claims.
Stopping processing, cancelling an AI plan or editing an extracted field does not erase the recording or retained transcript. Deleting the case removes its dictation records through the case-deletion process; related provider cleanup and backup rotation may complete separately. We do not promise immediate deletion of every copy or zero provider retention.
Google’s Files API documentation describes automatic file expiry after 48 hours. Its Interactions documentation describes storage of processing interactions, and its abuse-monitoring policy describes separate retention of inputs and outputs for 55 days, subject to the applicable arrangements and legal obligations. Those periods concern provider-held data and do not set a deletion deadline for the original audio or transcript retained by DLG with the case.
10 · Individual choices
Privacy rights and deletion
Depending on applicable law, individuals may have rights to request access, correction, deletion, restriction, objection or portability and to withdraw consent where processing relies on consent. A request may be subject to identity verification, legal exceptions and the Customer’s role as controller for case data.
Patients and other people mentioned in recordings should normally contact the clinic, laboratory or organisation responsible for their information first. Rashtan Soft assists the relevant Customer with requests concerning audio, transcripts and case fields under the applicable processing agreement. Customers can also contact us for assistance with retained dictation information. Removing an audio attachment and deleting the transcript or case are separate actions; correcting a case field does not automatically change the original transcript.
A request to delete a Dental Lab Guru account does not necessarily result in deletion of invoices, payment records, tax records, security records or dispute evidence that Rashtan Soft must retain.
Deleting a Dental Lab Guru account does not delete a Customer’s PayPal account or information independently retained by PayPal or Lemon Squeezy. Provider-related privacy requests may need to be submitted directly to the applicable provider.
12 · Protection
Data security
Rashtan Soft uses technical and organisational safeguards designed to protect personal data, including access controls, authentication, encrypted network transport, monitoring and provider security measures appropriate to the Service. No internet transmission or storage system can be guaranteed to be completely secure.
Case audio uses private attachment storage and authorised, time-limited upload and download links. Access to dictation and transcripts is restricted by case scope and patient-data permissions. Background processing uses limited job identifiers and sanitised diagnostics in application logs. Audio and text must be readable by the backend and selected provider to perform transcription and extraction; this processing is not described as end-to-end encrypted.
13 · Age
Children’s privacy
Dental Lab Guru is a professional B2B service and is not intended for individuals under 18. We do not knowingly invite children to create accounts. Patient data entered by professional Customers is processed as Customer-controlled case data, including where mentioned in authorised audio, not as a child-directed service.
14 · Updates
Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated through email, the Application or a prominent website notice where reasonably practicable. The updated policy will show its effective date and last-updated date.
15 · Contact
Privacy questions or requests
Republike Srpske 4a, floor 4, apartment 22
Trebinje, Bosnia and Herzegovina [email protected]