What we collect when you visit the site, request GuideFlow access, buy a licence or a course, and how we handle the patient data you share with us. Patient data is covered separately in section 6 and in Annex A of the Public Offer.
1.1. The controller of your personal data is Maxilla Medical Sp. z o.o., ul. Hoża 86, lok. 410, 00-682 Warszawa, Poland, VAT ID PL7011112545 (we, us). We process personal data under the EU General Data Protection Regulation (GDPR) and Polish data-protection law.
1.2. Privacy questions and requests: sales@maxilla-medical.net, subject «Privacy».
1.3. This Policy covers maxilla-medical.net, the GuideFlow account, our emails and our courses. For patient data shared with us through the RealGUIDE™ cloud we act as a processor on your instructions; see section 6.
| When | Data |
|---|---|
| You visit the site | IP address, browser and device type, pages viewed, referrer, approximate location, cookie identifiers (section 9). |
| You send an inquiry or book a call | Name, email, clinic, country, topic, your message, the page you wrote from and campaign tags (UTM). |
| You request GuideFlow access | Name, email, phone, clinic name and address, country, professional details needed to verify you are a dental professional, your RealGUIDE™ cloud identifier. |
| You buy a licence, course or webinar | Billing name and address, VAT number, invoice history, course attendance, support correspondence. Card details are handled by Stripe and never reach us. |
| You use RealGUIDE™ through us | Licence key, workstation identifier, support session logs (AnyDesk), case-review correspondence. |
2.1. We do not collect data on patients from you except through the RealGUIDE™ cloud (section 6). Do not send patient scans or names by email; we delete such emails and ask you to share the case in RealGUIDE™.
| Purpose | Legal basis (GDPR) |
|---|---|
| Answering inquiries, running a call | Art. 6(1)(b) — steps before a contract; Art. 6(1)(f) — legitimate interest in responding to you |
| Connecting you for GuideFlow, delivering plans and guides | Art. 6(1)(b) — performance of a contract |
| Verifying that you are a dental professional | Art. 6(1)(f) — legitimate interest in providing clinical services only to licensed clinicians |
| Selling licences and courses, invoicing, refunds | Art. 6(1)(b) — contract; Art. 6(1)(c) — tax and accounting obligations |
| Support, installation, case reviews | Art. 6(1)(b) — contract |
| Sending news about courses, software updates and offers | Art. 6(1)(a) — your consent, withdrawable at any time via the unsubscribe link |
| Analytics and advertising measurement | Art. 6(1)(a) — consent given in the cookie banner |
| Security, fraud prevention, defending legal claims | Art. 6(1)(f) — legitimate interest |
3.1. Providing the data marked as required in a form is a condition of the service; without it we cannot connect you or answer. Everything else is optional.
3.2. We do not use automated decision-making or profiling that produces legal effects on you.
4.1. We do not sell personal data. We share it only with service providers who process it for us under a data-processing agreement, and with authorities where the law requires.
| Provider | Purpose · location |
|---|---|
| Stripe Payments Europe Ltd. | Card payments and refunds · Ireland / EU |
| Google Workspace (Google Ireland Ltd.) | Email, documents, inquiry records, delivery of STL files via restricted Drive links · EU data regions |
| Tilda Publishing | Website hosting · EU |
| Elestio (Dublin, Ireland) — managed n8n on EU servers | Routing form submissions to our email and records · Germany / EU |
| 3Diemme S.r.l. | RealGUIDE™ cloud for case transfer, licences and activation · Italy / EU |
| AnyDesk Software GmbH | Remote installation and support sessions · Germany |
| Analytics and advertising platforms (Google, Meta) | Only with your cookie consent · see section 9 |
| Accounting firm, legal advisers | Statutory bookkeeping, legal claims · Poland |
4.2. Course instructors and partner printing labs receive only the data needed for their part of the service and only when you have asked for it.
You are the controller. We are the processor.
Patient CBCT scans, intraoral scans, photographs and identifiers that you share with us through the RealGUIDE™ cloud are processed only to plan and design the guide for that case, only on your instructions, and only within the EU.
6.1. The terms of this processing — purpose, security measures, sub-processors, breach notification within 48 hours, deletion and audit rights — are set out in Annex A (Data Processing Terms) of the Public Offer, which you accept when requesting access.
6.2. You remain responsible for informing patients and for the legal basis of the processing in your clinic. Cases are shared under a case code, never the patient's name; the plan does not need it. The finished STL file and report are shared through a Google Drive link restricted to your email address, under the same code, with no patient identifiers; the link expires after 30 days.
6.3. The RealGUIDE™ cloud is operated by 3Diemme S.r.l. (Italy) under its own terms; data you keep there remain under your control. Copies on our side are deleted 12 months after the case is closed, or earlier on your request, except for the anonymised plan parameters we keep for quality statistics.
6.4. Clinical images shown in our Cases section or courses are published only with the treating clinician's confirmation that patient consent has been obtained, and without identifiers.
7.1. Our systems and all patient data stay in the European Economic Area. Where a provider in section 4 may access data from outside the EEA (for example support staff of Google or Meta), the transfer is covered by an EU adequacy decision or the European Commission's Standard Contractual Clauses, with supplementary measures where needed. Copies of the safeguards are available on request.
8.1. Under the GDPR you may ask us to: access your data and receive a copy; rectify inaccurate data; erase data we no longer need; restrict processing; port data you gave us in a machine-readable format; object to processing based on legitimate interest; and withdraw consent at any time, without affecting earlier processing.
8.2. Write to sales@maxilla-medical.net. We answer within one month; for complex requests we may extend by two further months and tell you why. Requests are free unless manifestly unfounded or excessive.
8.3. You may lodge a complaint with the Polish supervisory authority — Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl — or with the authority of the EU country where you live or work.
8.4. Requests about patient data should go to the clinic that uploaded the case; we assist that clinic as its processor.
9.1. Strictly necessary cookies (session, security, cookie-consent choice) are set without consent. Analytics and advertising cookies are set only after you accept them in the banner; you can change your choice at any time via the «Cookie settings» link in the footer or by clearing cookies in your browser.
| Category | Examples · lifetime |
|---|---|
| Necessary | Tilda session and consent cookies · session to 12 months |
| Analytics | Google Analytics 4 (_ga, _ga_*) · up to 13 months. Measures pages visited and traffic sources; IP addresses are truncated. |
| Advertising | Meta Pixel (_fbp), Google Ads conversion cookies · up to 13 months. Measures whether an ad led to a registration or purchase. |
9.2. Refusing analytics and advertising cookies does not limit any function of the site.
10.1. Access to systems holding personal data is limited to named staff on a need-to-know basis, protected by two-factor authentication and logged. Data is encrypted in transit (TLS) and at rest by our providers. Patient files are kept separate from business records. Staff who see clinical data are clinicians or technicians bound by confidentiality.
10.2. If a breach is likely to put your rights at risk, we notify you and the supervisory authority as the GDPR requires; for patient data we notify the clinic within 48 hours of becoming aware.
11.1. We may update this Policy when our services or the law change. The version and date are shown at the top; material changes affecting GuideFlow customers are announced by email before they take effect.
Maxilla Medical Sp. z o.o.
ul. Hoża 86, lok. 410, 00-682 Warszawa, Poland
VAT ID PL7011112545
sales@maxilla-medical.net · subject «Privacy»
Related documents: Public Offer (Annex A — Data Processing Terms) · Refund Policy.