Draft. This policy has not yet been reviewed by counsel and is published for transparency while that review happens. It will be replaced by the reviewed version, with a dated change note, before it is relied on.
Effective date: to be set on review. Last updated: 2026-10-13.
Who we are
Calibic (“Calibic”, “we”, “us”) provides analytics software for dental practices that reads a practice’s own practice management system (Open Dental, Dentrix or Eaglesoft) and shows the practice what is worth acting on. This policy covers calibic.com and the Calibic application and agent.
Contact for anything in this policy: hello@calibic.com.
Two kinds of data, two sets of rules
Customer and visitor data is information about you as a person using our website or running a Calibic account: your name, work email, practice name, sign-in records and support messages. This policy governs it.
Patient data is protected health information that a dental practice holds about its patients and that Calibic receives on the practice’s behalf. For that data the practice is the covered entity and Calibic is its business associate. The Business Associate Agreement between the practice and Calibic governs it, and where this policy and the BAA differ, the BAA wins. Patients should direct requests about their records to their dental practice, not to Calibic, because the practice controls the record and Calibic cannot act on it without the practice’s instruction.
What we collect from website visitors
- Server logs: IP address, browser type, pages requested and the time of the request, kept for operational security and troubleshooting.
- Anything you send us by email.
We do not run advertising trackers on calibic.com and we do not sell visitor data.
What we collect from customers
- Account details: your name, work email, practice name, practice address, time zone, the practice software you run and your role (owner, admin or staff).
- Sign-in records: one-time codes sent to your email, the time and IP address of sign-ins, and session records.
- Agent and connector records: the install token used to enrol an agent, its heartbeat, sync status and health, and the practice database connection settings the agent needs to run.
- Usage records the owner can see: who opened a patient card, exported a list or asked a question.
- Billing details handled by our payment provider. Calibic does not store full card numbers.
- Support correspondence.
What patient data Calibic receives, as a business associate
The agent reads, read-only, the practice’s own database and sends records to Calibic’s cloud. This includes patient identity (name, date of birth, gender, phone, email, address), appointments, treatment plans and procedures, ledger entries (payments, adjustments, claims and balances, with before and after values of changes), insurance details including the last four digits of a subscriber id, and conditions, allergies and medications. The text of clinical notes is not read. Card numbers and bank account numbers are not read.
Calibic uses this data only to provide the service to the practice: building lists, dashboards, reports, the audit trail and answers to the practice’s questions. We never sell it and never use it for advertising.
How AI features use data
Some features send data to a large language model to produce an answer, a draft or a narration. Today that model runs on Microsoft Azure OpenAI, and Microsoft states that prompts and completions are not used to train its models. Depending on the feature, what is sent can include patient first names or full names, amounts, carriers and dates, as described on the HIPAA and BAA page. A practice owner can turn AI features off in Settings.
Who else sees the data (subprocessors)
| Provider | Purpose | Location |
|---|---|---|
| Microsoft Azure | Hosting, database, backups, Azure OpenAI | United States |
We will update this table when a provider is added or removed. Customers under a BAA are notified of subprocessor changes as the BAA provides.
Where data is stored
On Microsoft Azure in the United States. Data is encrypted in transit using HTTPS and encrypted at rest using Azure’s platform encryption. Each practice’s data is logically separated by account and location in a shared database. The Security page describes the controls and what we do not have yet.
The agent keeps a local copy of the last 30 days of change events on the practice’s own server.
How long we keep data
- Customer account data: for the life of the account and a short period after closure to complete deletion and billing.
- Patient data: for the life of the practice’s subscription. On request after termination, it is deleted, and backups roll off within the backup retention window.
- Server logs: a limited period for security purposes.
- Records we must keep by law, for as long as the law requires.
Your rights
Customers can ask to see, correct, export or delete the customer data we hold about them by emailing hello@calibic.com. We respond within 30 days. Depending on where you live, you may have further rights under state privacy law; we will honour those that apply.
Patients: contact your dental practice. Calibic acts only on the practice’s instruction for patient records.
Security
We take measures described on the Security page. No system is perfectly secure, and we do not claim ours is. If we learn of a breach affecting your data, we will notify you as the law and, for practices, the BAA require.
Children
Calibic’s website and accounts are for adults running or working in dental practices. We do not knowingly collect personal information from children through the website. Patient records about minors are handled under the practice’s BAA.
Changes to this policy
We will post changes here with a new “last updated” date, and will email account owners about changes that materially affect how their data is handled.
Contact
hello@calibic.com. Do not include patient information in email.
Related: Terms of service, Trust Center, Coverage.