Privacy Policy

Version 2.0.0 — Effective 2026-10-17

Do not email patient information (names, dates of birth, clinical details or images) to any Dental Refer address. Send patient information only through Dental Refer itself, after signing in.

Last updated: October 17, 2026

This Privacy Policy (this "Policy") explains how Dentist Owners LLC, an Oregon limited liability company doing business as Dental Refer ("Dental Refer," "we," "us," or "our"), collects, uses, shares, and protects personal information when you visit our website or use our service. Please read it carefully. Section 17 explains how to contact us. Section 18 is our consumer health data privacy policy for Washington and Nevada.

1. Who We Are

1.1 Dentist Owners LLC is an Oregon limited liability company that does business as Dental Refer. We operate the website at dentalrefer.com and the Dental Refer referral coordination service for dental practices.

1.2 You can reach us at: Dentist Owners LLC, PO Box 2007, Beaverton, OR 97075. Phone: (503) 662-8088. Fax: (888) 268-4785. Email: info@dentalrefer.com.

1.3 Our Privacy Officer is Merat Ostovar. The Privacy Officer is responsible for this Policy and answers privacy questions and requests at privacy@dentalrefer.com.

2. What This Policy Covers

2.1 In this Policy, these words have the following meanings:

(a) "Service" means the dentalrefer.com website, the Dental Refer web application, and the emails, faxes, and other features we provide through them.

(b) "Practice" means a dental practice, specialty practice, dental support organization, clinic, or other organization that has an account on the Service. The Terms and the BAA call a Practice the "Customer."

(c) "User" means a person who has an account on the Service, such as a dentist or a member of a Practice's staff.

(d) "Visitor" means a person who uses our website without signing in.

(e) "Personal information" means information that identifies, relates to, or can reasonably be linked to a particular person.

(f) "HIPAA" means the Health Insurance Portability and Accountability Act of 1996 and the regulations issued under it, as amended.

(g) "PHI" means protected health information, as HIPAA defines that term, that we create, receive, maintain, or transmit on behalf of a Practice.

(h) "BAA" means the business associate agreement between us and a Practice, as in effect from time to time.

(i) "Terms" means our Terms of Service, available at dentalrefer.com/terms.

2.2 This Policy covers personal information about Users and Visitors, about dental professionals listed in our directory, and about other people we communicate with, such as dental offices that a User invites or sends a referral to.

2.3 PHI is governed by the BAA and HIPAA, not by the rest of this Policy. Section 3 summarizes how we handle PHI and what patients should do.

2.4 This Policy does not describe how Practices handle information. It also does not cover other companies' websites or services, even if the Service links to them. Their own notices and policies apply.

2.5 This Policy is part of each Practice's agreement with us, as the Terms describe. If this Policy and a BAA conflict about PHI, the BAA controls. For Practices, the Terms control all other matters, including disclaimers, limitations of liability, governing law, and how disputes are resolved. The Terms also explain which of their provisions each User agrees to personally. For individuals, including Users, Visitors, patients, and dental professionals listed in our directory, this Policy is a notice that describes our practices, and it does not create a separate contract with them.

3. Patient Information We Handle for Practices

3.1 The Service is designed for Practices to create, send, receive, and store information about their patients. This can include names, contact details, dates of birth, insurance information, referral details, clinical notes, X-rays and other images, documents, voice messages, and messages between offices. We treat all of this information as PHI.

3.2 We handle PHI as a business associate under HIPAA. This means we create, receive, maintain, and transmit PHI on each Practice's behalf so that we can provide the Service to the Practice. If a Practice is itself a business associate, such as a dental support organization, we act as its subcontractor.

3.3 We use and disclose PHI only as the BAA permits or requires, or as the law requires. We do not sell PHI. We do not use or disclose PHI for marketing, advertising, or fundraising.

3.4 The Service does not accept patient information from a Practice until the Practice has signed our current BAA. It also does not show a Practice the referrals sent to it until the Practice has signed our current BAA. In addition, the Service does not yet accept PHI from anyone. Section 7.1(e) explains what we will do before it does.

3.5 Each Practice decides what patient information to put into the Service, who receives it, and why. Each Practice is responsible for its own notice of privacy practices and for obtaining any patient consent or authorization that the law requires.

3.6 If a breach of unsecured PHI occurs, we will notify the affected Practice as the BAA and HIPAA require.

3.7 The Service's artificial intelligence (AI) features are turned off by a platform-wide switch. Before we turn them on, we will update this Policy. We will use PHI with an AI feature only as the BAA permits, and only through a provider that has signed a business associate agreement with us.

3.8 If you are a patient: Dental Refer is not your dental provider. Your information in the Service is controlled by the dental practices involved in your care, such as the practice that referred you and the practice you were referred to. Their Notices of Privacy Practices explain how your health information may be used and shared, the rights you have, and how to make a complaint.

3.9 To see or get a copy of your health information, to ask for a correction, to ask for a list of certain disclosures, or to use any other right you have under HIPAA, please contact your dental provider. If you contact us instead, we will forward your request to the Practice or Practices involved within 5 business days. We will not decide the request ourselves unless a Practice asks us to in writing and we agree.

3.10 The Service has features that a Practice can offer to its patients, such as a secure link to check on a referral or to upload documents, or a satisfaction survey. When a patient uses these features, we handle the information the patient provides for the Practice as PHI under the BAA.

3.11 A Practice may also publish an online referral form, or a link or QR code that opens it, for other dental offices to use when they refer patients to the Practice. These forms are for dental offices, not for patients. The patient information that a referring office enters is PHI, and we handle it for the receiving Practice under the BAA. Information about the referring office and the person who completes the form, such as their name, phone number, and email address, and the technical information described in Section 4.2, is handled under this Policy.

3.12 Please put PHI only in the parts of the Service built for patient information. Do not put it in your profile, in support requests, or in file names, and do not email it to us. If you need to send us PHI, ask us for a secure method first.

4. Information We Collect

4.1 Information you give us:

(a) Account information: your name, work email address, phone number if you give one, role, the Practice you belong to, and your password. We store your password only as a salted, one-way hash, so we cannot read it.

(b) Practice information: the Practice's name and type, National Provider Identifier (NPI), dental license number and state, addresses, phone and fax numbers, contact email address, website, and profile details such as specialties, hours, and photos.

(c) Two-step verification information: the secret key for your authenticator app, which we store encrypted, and your backup codes, which we store only as hashes. Where the Service offers emailed verification codes or remembered devices, we also keep a hashed form of each emailed code until it expires a short time after we send it, and, for a device you choose to have remembered, a record of that device that includes only a hash of its token.

(d) Billing information: your Practice's plan, billing email address, and the customer, subscription, and payment records that our payment processor, Stripe, sends us. You enter payment card details on pages hosted by Stripe. We do not receive or store your full card number.

(e) Information about other people: for example, the name, email address, and role of a colleague you invite, or the name, email address, or fax number of an office you invite or send a referral to.

(f) Communications: your messages and calls to us, feedback, privacy and legal requests, and records of our replies.

(g) Choices and agreements: your notification settings and email opt-outs, and a record of each version of the Terms, this Policy, or the BAA that you accept or sign, including when you did so and the IP address and browser you used. For the BAA, we also record the signer's name and title.

4.2 Information we collect automatically:

(a) Device and log information: IP address, browser type and version, operating system, device type, the pages and features you use, the page that referred you, and the date and time of each request.

(b) Security information: sign-in attempts and their results, two-step verification events, password changes, account lockouts, security alerts, and audit records of actions taken in the Service, including access to PHI.

(c) Cookies and browser storage, as Section 5 describes.

We do not collect your device's precise location.

4.3 Information from other sources:

(a) Your Practice: a Practice owner or administrator may give us your name, email address, and role to set up your access.

(b) Other Users: a User may give us your office's contact details to send you a referral or an invitation.

(c) Public sources: we check NPI numbers against the federal NPI Registry, and we build our directory from public sources, as Section 8 describes.

(d) Service providers: for example, Stripe tells us whether a payment succeeded, Cloudflare tells us whether a bot check passed, and a breached-password service tells us whether a new password appears in known data breaches. For that check, we send only a short, partial hash of the password, never the password itself or anything that identifies you.

4.4 We may combine information from different sources, for example when a Practice claims its directory listing.

4.5 If you give us personal information about another person, you confirm that you are allowed to share it with us for that purpose.

5. Cookies and Similar Technologies

5.1 Cookies are small text files that a website stores in your browser. We use only the cookies and browser storage described in this Section. Each one is needed for the Service to work or to stay secure, or does something you asked for.

5.2 Sign-in cookie. When you sign in, we set a cookie that keeps you signed in. Your session ends when you sign out, at most 30 minutes after your last activity, or 12 hours after you sign in, whichever comes first.

5.3 Security cookie. We set a cookie that holds a random security token. It protects you against cross-site request forgery, a kind of attack in which another website tries to act in your name. It expires after 24 hours.

5.4 "Remember this device" cookie. Where the Service offers this option, you may choose, when you sign in, to have us remember the device you are using. If you do, we set a cookie that holds a random token, and we keep only a hash of that token. While it is valid, you can sign in on that device with your password, without a second-step code. It lasts for the period shown to you when you choose it, which is 30 days unless we show you a different period, and never more than 90 days. We stop honoring it sooner if your password or your authenticator changes, and we may stop honoring it at any time for security reasons. Some sensitive actions may still ask you for a fresh code. If you do not choose this option, we do not set this cookie.

5.5 Patient link cookie. When a patient opens a secure link from a Practice to view a referral or upload documents, we set a cookie that keeps that access open for up to 60 minutes.

5.6 Browser storage. We also use your browser's storage to remember a few things on your device, such as that you closed the getting-started banner, that you have already accepted our current legal terms (so that we do not check again for a few minutes), or which directory listing you chose to claim while you sign in. We do not use it to track you.

5.7 Bot protection. On our sign-in, registration, and password-reset pages, and on the online referral forms that Practices publish for referring offices (Section 3.11), we use Cloudflare Turnstile to tell people apart from automated programs. Turnstile runs a check in your browser, which sends Cloudflare your IP address and information about your browser and device. We do not give Cloudflare the information typed into these pages. To confirm the check, our servers send Cloudflare only the token that the check produced, not your IP address. Cloudflare may use cookies or similar technologies for this check. Cloudflare's privacy policy explains how it handles this information.

5.8 Maps. When you view a map in our directory, your browser loads map images directly from OpenStreetMap, which receives your IP address and the map area you view. Links for directions open Google Maps, which has its own privacy policy.

5.9 Page counts. We count visits to Practices' public pages and to the referral widget that a Practice places on its own website, as well as actions such as starting or submitting a referral form. We keep only totals, such as the number of views of a page on a given day, where visits came from (for example, a QR code or a link), and the type of device (mobile, tablet, or desktop). We do not use cookies for this, and the totals do not identify you. Each Practice can see the totals for its own pages.

5.10 We do not use advertising cookies, tracking pixels, or third-party analytics tools.

5.11 You can set your browser to block or delete cookies. If you block the cookies described in Sections 5.2 and 5.3, you will not be able to sign in.

6. How We Use Information

6.1 We use personal information to:

(a) provide the Service, including creating and managing accounts, verifying email addresses and professional information, routing referrals and messages, and sending the emails, faxes, and notices that Users ask us to send;

(b) keep the Service and its Users secure, including by requiring two-step verification, detecting and preventing fraud, abuse, and unauthorized access, monitoring for unusual activity, and investigating security incidents;

(c) provide support and respond to your requests;

(d) manage subscriptions, billing, and payments;

(e) send service messages, such as verification codes, security notices, referral notifications, billing notices, and notices about changes to our terms;

(f) send by email the invitations that Users ask us to send, invite dental practices by email to join the Service, and tell Users about features and offers, as Section 9 describes;

(g) publish and maintain our directory, as Section 8 describes;

(h) understand how the Service is used and improve it, using aggregated or de-identified information that is not PHI;

(i) keep the records the law requires, such as audit, tax, and billing records, and records of the agreements you accept;

(j) comply with the law and legal process, enforce the Terms, and protect the rights, property, and safety of Dental Refer, our Users, patients, and others; and

(k) do anything else we describe to you when we collect the information, or that you agree to.

6.2 We use PHI only as Section 3 describes. As the BAA permits, we may de-identify PHI under HIPAA's de-identification standard and use the result only to operate and improve the Service. We do not sell de-identified information. We keep de-identified information in de-identified form and do not try to re-identify anyone.

6.3 We use automated tools to protect the Service, such as bot checks, rate limits, account lockouts after repeated failed attempts, and checks against known breached passwords. If one of these tools blocks you, contact us and a person will review it. We do not use personal information to make automated decisions that have legal or similarly significant effects on you.

7. How We Share Information

7.1 We share personal information only as this Policy describes:

(a) Within your Practice. The owners and administrators of your Practice's account can see your name, your role, and the information you add to that account, and they control who has access to it.

(b) With other Practices, at your direction. When you send or receive a referral, message another office, or connect with another Practice, that Practice sees your name, your Practice, and the information you send. Invitations you send include your name and your Practice's name.

(c) With systems your Practice connects. If your Practice connects the Service to another system, such as its practice-management software, we exchange information with that system at the Practice's direction.

(d) In public. Directory listings and Practices' public pages can be seen by anyone, as Section 8 describes.

(e) With service providers. We use service providers to host and run the Service, including for hosting and computing, our database, file storage, email delivery, our business email, fax, insurance eligibility checks, payments, bot protection, rate limiting, and job queues. They may use personal information only to provide services to us, under written agreements that limit how they use it. Some providers, such as Stripe and Cloudflare, also use information they collect directly from you for their own purposes, such as preventing fraud and abuse, as their own privacy policies describe. We require each service provider that receives PHI from us to sign a business associate agreement with us first, as HIPAA requires. Cloudflare, which today stores the files uploaded to the Service and the documents the Service generates, has not signed a business associate agreement with us. The Service does not yet accept PHI, and it will not accept PHI until we have moved that storage to a provider that has signed one. Our current list of these providers, what each one does, where each one processes information, and which ones have signed a business associate agreement with us is at dentalrefer.com/subprocessors.

(f) With public registries and map services, only as needed for a feature to work, for example an NPI number to check it, or a practice address to place it on a map.

(g) For legal reasons. We may disclose information when we believe in good faith that a law, regulation, subpoena, court order, or other legal process requires it, or to respond to a lawful request from a government authority.

(h) To protect rights and safety. We may disclose information when we believe in good faith that it is needed to protect the rights, property, or safety of Dental Refer, our Users, patients, or others, including to investigate fraud, security incidents, or violations of the Terms.

(i) With professional advisers, such as lawyers, accountants, auditors, and insurers, who must keep it confidential.

(j) In a business transfer. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business, personal information may be transferred as part of that transaction, under confidentiality terms. We will notify Users by email or by a notice in the Service before their personal information becomes subject to a materially different privacy policy. PHI will be transferred only as the BAA and HIPAA permit.

(k) With your consent or at your direction.

7.2 We share PHI only as Section 3 describes.

7.3 We do not sell personal information. We do not share personal information for cross-context behavioral advertising or targeted advertising. We do not give personal information to other companies for their own marketing. We have not done any of these things in the past 12 months.

7.4 We may share aggregated or de-identified information that does not identify you, if it was not created from PHI. Information de-identified from PHI is shared only with our service providers, to operate and improve the Service, as the BAA permits.

8. Our Dental Directory

8.1 We publish a directory of dental practices and dental professionals in the United States. It helps Practices find colleagues to refer patients to, and it helps patients find a dentist.

8.2 We build the directory from publicly available information, such as the federal NPI Registry and the business listings and websites that practices publish. A listing may include a practice's or dentist's name, specialties, addresses, phone and fax numbers, email address, website, hours, and similar business details.

8.3 Directory listings are public, except that we do not show the email addresses in listings to the public. We may use the contact details in a listing to deliver the referrals that Users send, to deliver by email the invitations that Users send, to verify a practice that claims its listing, and to invite the practice by email to join the Service. We do not send advertising faxes to a listing's fax number without the practice's prior express invitation or permission.

8.4 A Practice can claim its listing in order to manage it. Information that the Practice adds to its listing becomes part of its public profile.

8.5 If you are a dental professional and want us to correct or remove information about you in the directory, email privacy@dentalrefer.com and tell us which listing you mean. We will correct information that is inaccurate. If you ask us to remove your personal information from the directory, we will remove it from public view and stop using it to send invitations. We may keep it in our records where the law requires it, or where it is part of a referral or other record that a User has already created.

9. Emails, Faxes, and Text Messages

9.1 Service messages. We send messages that are needed to run your account and the Service, such as verification codes, password resets, security notices, referral notifications, billing notices, and notices about changes to our terms. You cannot opt out of these while you have an account. You can choose which optional notifications you receive in your account settings.

9.2 Invitations and promotional email. When a User asks us to invite a colleague or another office, we send the invitation by email for that User. We may also invite dental practices by email to join the Service, for example when a User sends a referral to a practice that does not yet use the Service, and we may tell Users about features and offers. Every promotional email we send includes our postal address and a link to unsubscribe. You can also unsubscribe by sending any email to unsubscribe@dentalrefer.com or optout@dentalrefer.com. We treat every message sent to either address as a request to stop promotional email to the address it was sent from and to any other address it asks us to remove. We honor unsubscribe requests within 10 business days.

9.3 Faxes. A Practice can use the Service to send referral documents by fax. Those faxes are sent at the Practice's direction, so please contact the Practice about them. We do not send faxes that advertise the Service to a fax number unless the person or business it belongs to has given us prior express invitation or permission. To withdraw a permission you have given us, or to ask us not to send faxes to a number, call (503) 662-8088, fax (888) 268-4785, or email optout@dentalrefer.com, and tell us the fax number your request covers. We honor these requests promptly, and within 30 days.

9.4 Text messages. The Service does not currently send text messages. If we add text messaging, we will update this Policy, and we will obtain any consent the law requires before we send texts.

10. How Long We Keep Information

10.1 We keep personal information only as long as we need it for the purposes this Policy describes, unless the law requires or permits us to keep it longer.

10.2 Account and Practice information: we keep it while the account is open. After an account closes, we keep it only as long as we need it for legal, tax, billing, security, audit, and dispute purposes, and then we delete it or de-identify it.

10.3 Information you add to a Practice's account, such as referrals and messages, is part of that Practice's records. It stays with the Practice if you leave the Practice.

10.4 Security and audit records, including sign-in records and records of access to PHI, are kept for at least six years. Our audit log is append-only.

10.5 Records of your acceptance of our legal terms, and of BAA signatures, are kept while the agreement is in effect and for at least six years after it ends.

10.6 Billing records are kept as long as tax and accounting laws require.

10.7 Opt-out records are kept so that we can keep honoring your choice.

10.8 PHI is kept as the BAA and the Practice's instructions require. A referral is a record of each practice that sends or receives it, so if one Practice leaves, we may keep the referral for the other practice under that practice's own agreement with us. When a BAA ends, we return or destroy PHI as the BAA requires. If that is not feasible, for example for PHI in backups until they expire, we keep protecting it and limit its use as the BAA requires.

10.9 Our providers keep backups for a limited period so that we can recover from errors and outages. Information we delete may remain in backups until they expire. We protect it in the same way while it remains.

10.10 Directory information is kept while the listing is in the directory.

11. How We Protect Information

11.1 We use administrative, technical, and physical safeguards designed to protect personal information and PHI. They include:

(a) encryption in transit, using TLS 1.2 or higher;

(b) encryption at rest by our database and storage providers. We also protect certain fields with AES-256-GCM field-level encryption. For patient identifiers (name, date of birth, phone number, and email address), insurance subscriber details, and the clinical text of referrals, specialist reports, and messages, we keep a separate encrypted copy, and the original values also remain in our database, which is encrypted at rest. Referral letters are the exception: when the Service creates or edits a referral letter, it keeps the letter's text only in encrypted form. We also encrypt authenticator secrets and the credentials that Practices give us to connect other systems;

(c) two-step verification, which every User must set up and use at sign-in, except on a device the User chose to have remembered, where the Service offers that option;

(d) passwords of at least 12 characters, stored only as salted, one-way hashes, and screened against known breached passwords;

(e) role-based access controls that keep each Practice's information separate and limit what each User can see;

(f) automatic sign-out after inactivity, and a maximum session length;

(g) a tamper-evident audit log that records access to and changes of PHI made through the Service, and security events;

(h) rate limits, lockouts after repeated failed attempts, bot checks, and monitoring for unusual activity; and

(i) access by our own personnel to PHI only when needed to provide support, keep the Service secure, or meet legal duties, with access through the Service recorded in our audit log.

11.2 No method of transmitting or storing information is completely secure, and we cannot guarantee the security of any information. You are responsible for keeping your password, authenticator app, backup codes, and devices secure. Tell us right away at security@dentalrefer.com if you think your account has been compromised.

11.3 If we learn of a security incident that affects your personal information, we will notify you when the law requires, in the time and manner the law requires. For PHI, we notify the affected Practice as the BAA and HIPAA require, and the Practice is responsible for notifying affected patients unless it has agreed otherwise with us in writing.

12. Where We Store Information

12.1 We are based in the United States, and the Service is intended for use in the United States. Our primary database and our application hosting are located in the United States.

12.2 Some of our service providers process information outside the United States, or have not yet confirmed to us that they process it only in the United States, and this can include patient information. Today, these are Cloudflare, which stores the files uploaded to the Service and the documents the Service generates and runs a global network; our fax provider, SRFax, which has not yet confirmed whether it processes faxes in the United States or in Canada; and Google Workspace, which receives email sent to our @dentalrefer.com addresses and may process it globally. Our list at dentalrefer.com/subprocessors shows where each provider processes information.

12.3 If you use the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, where privacy laws may differ from those where you live.

13. Children

13.1 The Service is for dental professionals and their staff. It is not directed to children under 16, and we do not knowingly collect personal information directly from children under 16.

13.2 Practices may enter PHI about patients who are children. We handle it for the Practice under the BAA, as Section 3 describes.

13.3 If you believe that a child under 16 has given us personal information directly, contact us at privacy@dentalrefer.com. We will delete it, or, if it is PHI that we hold for a Practice, we will refer the matter to the Practice.

14. Your Choices and Rights

14.1 Your account. You can view and update much of your account information in your account settings. A Practice's owners and administrators can update the Practice's information.

14.2 Requests. You may ask us to:

(a) tell you what personal information we hold about you, where we got it, why we use it, and the categories of third parties we disclose it to (or the specific third parties, where the law gives you that right), and give you a copy;

(b) correct personal information that is inaccurate;

(c) delete personal information;

(d) give you your personal information in a portable, commonly used electronic format; or

(e) close your account.

Depending on where you live, the law may give you some or all of these rights. We will respond to every request. We will honor a request to the extent the law requires, and otherwise where we reasonably can.

14.3 Opt-out rights. Some laws give people the right to opt out of the sale of their personal information, of targeted advertising, and of profiling that produces legal or similarly significant effects. We do not do any of these things. If that changes, we will update this Policy first and give you a way to opt out.

14.4 Sensitive information. We use sensitive personal information, such as your account credentials, only to provide the Service and keep it secure, or as the law otherwise permits.

14.5 Promotional email. You can unsubscribe from promotional email at any time, as Section 9 describes.

14.6 How to make a request. Email privacy@dentalrefer.com, call (503) 662-8088, or write to Dentist Owners LLC, Attn: Privacy Officer, PO Box 2007, Beaverton, OR 97075. Tell us what you are asking for and how we can reach you. If you are a patient asking about your health information, please contact your dental provider first, as Section 3 describes.

14.7 Verification. Before we act on a request, we must confirm that it comes from you or from someone you have authorized. If you have an account, we will usually ask you to confirm the request from the email address on your account. If you do not, we will ask for information that lets us match your request to the information we hold. We may ask for more information if we need it, and we will use that information only to verify the request.

14.8 Authorized agents. You may use an authorized agent to make a request for you. We may ask the agent for proof of your signed permission, and we may ask you to confirm your identity with us directly.

14.9 Timing. We will respond within 45 days after we receive your request. If we need more time, we will tell you why, and we may take up to 45 more days.

14.10 Limits. We may decline or limit a request where the law allows. For example, we may do so if we cannot verify the request; if the information is PHI that we hold for a Practice (we will forward the request to the Practice); if the information belongs to a Practice's account and the Practice controls it; if we must keep the information to meet a legal obligation, keep the Service secure, keep audit records, or establish or defend legal claims; or if responding would reveal personal information about someone else. If we decline a request, we will tell you why.

14.11 Appeals. If we decline your request, in whole or in part, you may appeal by emailing privacy@dentalrefer.com, or by writing to us at the address in Section 14.6, and telling us that you are appealing our decision. Our Privacy Officer will review your appeal and tell you the decision, and the reasons for it, within 45 days. If we need more time and the law allows it, we will tell you why. If we deny your appeal, you may contact the attorney general of your state.

14.12 We will not discriminate against you for exercising your privacy rights.

15. Do Not Track and Global Privacy Control

15.1 Some browsers can send a "Do Not Track" signal. There is no common standard for how websites should respond to it. We do not track you across other websites, so we do not change how the Service works when we receive one.

15.2 Global Privacy Control ("GPC") is a browser setting that tells websites you want to opt out of the sale or sharing of your personal information. We treat a GPC signal as a valid request to opt out of the sale or sharing of personal information collected from that browser. Because we do not sell or share personal information, a GPC signal does not change how the Service works.

16. Changes to This Policy

16.1 We may update this Policy from time to time. Each version has a version number, and the "Last updated" date at the top shows when this version was last changed.

16.2 If we make a material change, we will tell Users before the change applies to them, by email or by a notice in the Service. The Service will ask you to review and accept the updated Policy, and the change applies to your account from when you accept it.

16.3 We will not use personal information that we collected under an earlier version of this Policy in a materially different way without your consent, where the law requires consent.

16.4 For Visitors, an updated Policy applies from the date we post it.

16.5 We keep earlier versions of this Policy. Contact us if you would like a copy.

17. Contact Us

17.1 For questions or requests about this Policy or your personal information, contact our Privacy Officer:

Merat Ostovar, Privacy Officer

Dentist Owners LLC, doing business as Dental Refer

PO Box 2007, Beaverton, OR 97075

Email: privacy@dentalrefer.com

Phone: (503) 662-8088

17.2 To report a security concern, email security@dentalrefer.com.

17.3 If you are a patient, please contact your dental provider first, as Section 3 describes.

17.4 If you need this Policy in a different format because of a disability, contact us and we will provide it in a format that works for you.

18. Consumer Health Data Privacy Policy (Washington and Nevada)

18.1 Scope. This Section is our consumer health data privacy policy under Washington's My Health My Data Act (chapter 19.373 RCW) and Nevada's consumer health data law (chapter 603A of the Nevada Revised Statutes), to the extent those laws apply to us. It covers "consumer health data," as those laws define it, that we collect about a person who uses our public directory or find-a-dentist search to look for dental care. It does not cover PHI that we handle for Practices, which Section 3 describes, or information about dental professionals and their staff acting in their work. The rest of this Policy also applies to this information. If this Section conflicts with another part of this Policy about consumer health data, this Section controls.

18.2 What we collect, and why. When you search our directory or view a dentist's profile, your browser sends us:

(a) your search choices, some of which can show that you are looking for dental care, such as a dentist's name, a dental specialty, a city, state, or ZIP code, a search radius, an insurance plan, a language, a minimum rating, and whether you want a dentist who offers emergency care or sedation, is available today, or is accepting referrals;

(b) the pages you view, such as dentists' profiles; and

(c) your IP address and information about your browser and device.

We use this information only to show you the results, profiles, and maps that you ask for, to keep the Service secure (for example, by limiting repeated requests and detecting abuse), and to find and fix problems. You do not need an account to search. We do not save your search choices in our database, and we do not use this information for advertising or to build a profile about you. The page totals that Section 5.9 describes do not identify you.

18.3 Where it comes from. We collect this information only from you, through your browser.

18.4 Who receives it. We share this information only with these categories of recipients, and only as needed for the purposes in Section 18.2:

(a) our hosting provider, which processes each request for us and keeps request logs, which can include your search choices and IP address, for a limited time;

(b) our rate-limiting provider, which receives your IP address for a short time so that we can limit repeated requests; and

(c) our map image provider, OpenStreetMap, which receives your IP address and the map area you view directly from your browser when a map is shown, as Section 5.8 describes.

If you choose to open directions to a dentist's office, your browser goes to Google Maps, which receives the address and your IP address under its own privacy policy. We do not share this information with any affiliate, and we do not sell consumer health data. Our list at dentalrefer.com/subprocessors names our current providers.

18.5 Other categories and purposes. We will not collect other categories of consumer health data, or use or share it for other purposes, unless we first update this Section and obtain any consent these laws require.

18.6 Activity across other websites. We do not use advertising or analytics services. The Cloudflare bot check described in Section 5.7 does not run on our directory or find-a-dentist pages, and we do not allow any other third party to run code or set cookies on the Service. OpenStreetMap and Google Maps receive the information that Section 18.4 describes directly from your browser and handle it under their own policies.

18.7 Your rights. If these laws apply to you, you have the right to:

(a) confirm whether we collect, share, or sell your consumer health data, and get access to it;

(b) get a list of the third parties and affiliates with whom we have shared or sold it, with a way to contact them;

(c) have us delete it; and

(d) withdraw any consent you gave us to collect or share it.

To use these rights, contact us as Section 14.6 describes. We will verify your request as Section 14.7 describes and respond within 45 days. If we reasonably need more time, we may extend that once by up to 45 more days, and we will tell you why within the first 45 days. Requests are free, up to twice in any 12 months. When we delete consumer health data, we also notify the providers and other third parties that received it from us, as these laws require. We do not link searches to a name or an account, so we may need details such as the IP address you used and when you used it. Because we keep this information only briefly, it may already have been deleted when we receive your request.

18.8 Appeals. If we decline your request, in whole or in part, you may appeal as Section 14.11 describes. If we deny your appeal, we will tell you how to submit a complaint to your state's attorney general.

18.9 Changes and effective date. Section 16 explains how we tell you about changes to this Section. The "Last updated" date at the top of this Policy is the effective date of this Section.