Security
You store medical records, and that means knowing where they are, who sees them and what happens if something goes wrong. This is what we do and what we sign with you.
Where your data lives
In the European Union. Dentasys runs on Amazon Web Services (AWS) in the Paris region (France): your clinic's database, documents, X-rays and backups are stored there. You don't need to install any server at the practice.
One database per clinic
Each clinic has its own database, separate from all others. There are no tables shared between customers and no way for one clinic's data to show up in another.
Encryption
Everything travelling between your browser and our servers is encrypted (TLS). Stored data is also encrypted at rest, backups included.
Backups
We take automatic daily backups, encrypted, kept for at least 30 days, and we regularly test that they restore. If you need it, we restore your clinic to the backup closest to the time you ask for.
Who gets in and what they do
Each member of your team signs in with their own user and two-step verification, and only sees what their permissions allow. Every time someone opens a medical record or changes something, it is logged. Our own team's access is limited to what is needed to support you, and it is logged too.
Signed documents
Consent forms and treatment plans signed by your patients carry a qualified electronic timestamp. Only the document's fingerprint (hash) is sent to timestamp it, never its content.
Availability committed by contract
We commit to 99.5% monthly availability. If we miss it in a given month, we credit 5% of the next fee for each point below.
If there is an incident
If a security breach affects your data, we notify you within 24 hours with what happened, who is affected and what we are doing, so you can meet your obligations to the Spanish Data Protection Agency (AEPD).
Data processing agreement (GDPR)
Your clinic is the controller of its patients' data and Dentasys acts as processor. When you sign up we sign the Article 28 GDPR data processing agreement, including security measures, the list of providers involved in the service and their safeguards. We give you 30 days' notice before adding or changing any of them, and you can object.
Your data is yours
You can export your data at any time from within the app, in common formats (CSV and Excel). No lock-in: if you cancel, you have 30 days to download everything before it is deleted.
Certified data centres
AWS data centres hold security certifications such as ISO 27001, SOC 2 and PCI DSS.
Need the data processing agreement or more detail for your data protection officer? Write to andres@dentasys.es and we'll send it over.
Your data and your patients', with access controls and traceability
Access controls, two-step verification and activity logs help manage clinical information. Security also depends on each practice’s configuration and procedures.
eIDAS digital signature
European legal validity for consents and documents with official ACCV time stamping.
Two-step verification
Two-step verification via WhatsApp to protect your entire team's access.
Access log
Detailed record of every action: who accessed, when, and what they modified.
Roles and permissions
Everyone sees only what they need: admin, dentist, reception and custom roles.
Data export
Export all your clinic information to comply with GDPR data portability rights.
Data in the European Union
Data hosted in the European Union (AWS, Paris), encrypted in transit and at rest, with daily backups.
Working-hours records, paper-free and ready for an inspection
Everyone clocks in from the app. The location is stored only at the moment of clocking in, encrypted, and every change is logged with who made it and why. You export it for the Labour Inspectorate whenever they ask.
Time tracking
Today, 7 March 2026
7,5 h
30 min
40.4168, -3.7038
Visible only to whoever runs the practice
Art. 34.9 of the Workers' Statute
Daily working-hours record, kept for 4 years and ready for the Labour Inspectorate.
Location only when clocking in
The position is stored at the moment of clocking in, not during the day, and it is stored encrypted.
Change history
Every correction is logged with who made it, when, the reason and the previous value.
Protected location
Each clock-in location is stored encrypted and only the practice admin can see it, when needed.
GDPR and LOPDGDD
Everyone gives consent before clocking in with location.
Permission-based access
Only the practice admin sees locations and the change history.