How we handle your data, your patients' data, and AI

• AI assists. Humans decide. Every AI-generated output — clinical notes, denial appeals, insurance summaries, recall messages — is presented as a draft for review. No AI output is auto-saved, auto-sent, or auto-acted-on.
• Your data doesn't train models. We don't train any AI model on customer data, and under our AI providers' terms your data is never used to train a model. Your patients' encounters never become part of any model's weights.
• Every inference is logged. Each AI call is timestamped and recoverable — the input, the output, and the model version, written to a per-practice audit trail. Live across all of DentalIQ's in-app AI modules.

DentalIQ uses AI across its workflow modules. Each operates under the same verify-before-action principle: you trigger the AI, review the draft it produces, and decide how to use it — nothing reaches a patient automatically.

• NoteIQ. Voice-to-SOAP clinical note generation — records the encounter, transcribes via OpenAI Whisper, structures a SOAP note via Claude. You review the note before it's attached to the patient record.
• BillingIQ. Denial pattern analysis, A/R review, and appeal narratives. Appeal letters are reviewed by you before any submission.
• AcceptIQ. Treatment plans with an estimate calculated by DentalIQ's own rules from the patient's newest insurance check, never invented by the AI. The dentist sets each procedure's urgency; the AI only writes the plain-language wording, which you can edit and must approve before the plan prints.
• ReviewIQ & RecallIQ. Review requests and lapsed-patient recall messages. Each message is drafted by AI for one patient, from their visit history and never from clinical details, and is approved by your team before it's sent.
• ReportIQ. Monthly practice summaries, generated from your own data — no external sharing.
• LabIQ. Lab-case checklists, reviewed and edited by you before submission. Emails to the lab carry only the case reference, case type, due date and practice name, never patient details.
• PrescriptionIQ. Post-treatment guidance, always carrying an explicit disclaimer that it is not a substitute for clinical judgment and that all dosages must be verified against current references.
• AuditIQ. Operational scoring across practice dimensions — practice-level signals only, no patient data.

We collect only the data needed to operate the modules you use. NoteIQ means encounter transcripts and SOAP notes; BillingIQ means billing codes, denial reasons, and A/R data; RecallIQ means patient contact information and recall histories. We don't pull data you don't enable.

Data lives in our PostgreSQL database on managed infrastructure with encryption at rest. Backend services run on Railway; the frontend is delivered through Vercel's edge network; authentication is handled by Clerk. Each practice is isolated at the database level via multi-tenant scoping, enforced on every authenticated route.

When you use an AI module, only the relevant payload is sent to Anthropic's Claude, which runs on Amazon Bedrock under our business associate agreement with AWS, or, for voice transcription, to OpenAI's Whisper under our business associate agreement with OpenAI. We don't bundle extra data "just in case": the minimum input required to produce the output is the maximum we send.

Insurance eligibility checks and claims go to payers through Stedi, our clearinghouse, under a business associate agreement. Email is sent through Amazon SES under our agreement with AWS.

• Encryption. Encrypted in transit (TLS) and at rest.
• Multi-tenant isolation. Each practice's data is scoped at the database query level, and every backend route enforces tenant resolution before returning any record. We treat any cross-tenant access path as a critical bug, verified at the query layer on every authenticated route.
• Authentication. Handled by Clerk, with MFA and SSO support.
• Least privilege. Access to production data is limited to what's required to operate and support the platform.

Every AI inference is logged with the module, the endpoint, the user who triggered it, the patient it relates to (if applicable), a hash of the input, the full input payload, the full output, the model version, the token cost, and the latency. This is live across all of DentalIQ's in-app AI modules; capture of the action you took (saved, edited, or rejected) is being added next.

You can request your practice's complete AI audit log at any time, delivered as a structured export. Audit logs are retained for seven years from the date of the inference, in line with standard healthcare record-keeping. If you terminate your account, you can request a final export and full deletion of all your data, including audit logs, within thirty days of termination.

Generative models can produce confident, well-formatted output that is wrong. DentalIQ addresses this with a structural rather than a probabilistic safeguard: nothing AI generates takes effect without explicit human review. AI output is generated only when you trigger it and is presented for your review before you act on it — never sent to a patient automatically. We label every output as an "AI-assisted draft," not finished work product, and are rolling out an explicit review-acknowledgment step across all consequential actions. PrescriptionIQ additionally carries a standing clinical-judgment disclaimer.

DentalIQ processes patient information on behalf of dental practices, so it is built around the safeguards HIPAA expects: encryption in transit and at rest, per-practice tenant isolation, authenticated access, and audit logging. We do not use practice or patient data to train AI models.

Business associate agreements in place today:

• AWS: Claude on Amazon Bedrock (DentalIQ's AI) and Amazon SES (email).
• OpenAI: Whisper voice transcription for NoteIQ.
• Stedi: insurance eligibility checks and claims.

Not yet covered, and how we handle it: DentalIQ's database and backend currently run on Railway and the website on Vercel, and patient text messages go through Twilio; none of these has a business associate agreement with us today. Before a practice uses DentalIQ with real patient data, its database and backend move to AWS under our business associate agreement. Text messages to real patients stay off until texting runs through a provider that signs one.

If your practice needs a business associate agreement with DentalIQ, email [email protected] and we'll put one in place before you send any patient data.

All generative AI tasks run on a single, pinned production model. Before we roll out any model version change, we will run a regression check against a curated set of known-good outputs across the AI modules, compare the new model against the current one, and hold the change if quality regresses. We're building this regression suite out alongside the audit-log dataset it draws from.

We don't change the model silently. The full model changelog is published at dentaliq.app/trust/changelog.

MIT xPRO's seven-week Artificial Intelligence in Healthcare: Fundamentals and Applications course is a clear public framework for thinking about AI in clinical contexts. Its modules describe what responsible healthcare AI looks like — from the design process to the ethical and regulatory obligations AI products in healthcare must meet. We've mapped DentalIQ's architecture against them.

• Designing AI Products + Ethics. Audit logs, BAA-ready posture, multi-tenant isolation, role-based access controls.
• Generative AI + Hallucination Management. Verify-before-action across AI outputs, explicit AI-assisted-draft labeling, PrescriptionIQ disclaimers.
• Frontiers + Data Governance. Audit-log governance, with drift monitoring and anomaly detection on the roadmap.

Public course curriculum: emeritus.org/blog/mit-xpro-ai-in-healthcare-course-curriculum. DentalIQ is not affiliated with, endorsed by, or partnered with MIT or MIT xPRO. We cite the public curriculum because it is the clearest available framework for explaining what we've already built.

Your practice owns its data. You can request a full export at any time, and a complete deletion of your data within thirty days of terminating your account. Questions about access, correction, or deletion go to [email protected].

If you believe you've found a security vulnerability, please report it to [email protected]. We welcome good-faith research and will work with you to validate and address legitimate issues. Please don't access, modify, or exfiltrate data that isn't yours while testing.

Questions about how we handle your data? We answer every email — no support tier, no ticket queue.