Privacy Policy

Last updated: January 2026

1. Identification of the Data Controller

2. Scope of Application

This Privacy Policy applies to all personal data collected through:

• The website https://owalls.com
• The OWALLS SaaS platform (web and mobile application)
• Communications via email, phone, or chat
• Contact and registration forms

3. Personal Data We Collect

3.1 Data you provide to us directly

a) Registration and Account Data

When creating an OWALLS account, we collect:

• First name and last name
• Email address
• Phone number (optional)
• Dental clinic or practice name
• Tax ID of the professional entity
• Professional address
• Password (stored using hash encryption)

b) Billing and Payment Data

To process subscriptions and payments:

• Name or company name for invoicing
• Full tax address
• Tax ID
• Bank details (IBAN) for SEPA direct debit
• Credit/debit card details (processed directly by our payment provider, not stored by OWALLS)

c) Platform Usage Data

By using our services, you upload:

• Dental images: Photographs of clinical treatments
• Patient data: Information you voluntarily add (names, dates, clinical notes)
• Metadata: Technical information from images (capture date, device, camera settings)

d) Communications

• Messages sent through the contact form
• Technical support tickets
• Live chat conversations
• Emails exchanged with our team

3.2 Automatically collected data

a) Browsing and Connection Data

• IP address
• Browser type and version
• Operating system
• Device type (computer, tablet, smartphone)
• Screen resolution
• Date and time of access
• Pages visited and time spent
• Referrer URL (page from which you arrived at the site)

b) Cookies and Similar Technologies

We use cookies and similar tracking technologies. For detailed information, please see our Cookie Policy.

c) System Logs

We automatically record:

• Platform access (login/logout)
• Actions performed within the application
• System errors and events
• Response times and performance

Retention: Logs are kept for 30 days (extendable due to legal or security requirements).

4. Purposes and Legal Basis for Processing

Purpose	Legal Basis (GDPR)
Management of your user account Create, maintain, and manage your access to the platform	Art. 6.1(b) GDPR - Contract execution
Provision of the SaaS service Store, process, and manage dental images using AI	Art. 6.1(b) GDPR - Contract execution
Payment processing and billing Subscription collection and invoice issuance	Art. 6.1(b) GDPR - Contract execution Art. 6.1(c) GDPR - Legal obligation (tax invoicing)
Customer service and technical support Respond to inquiries, resolve issues	Art. 6.1(b) GDPR - Contract execution Art. 6.1(f) GDPR - Legitimate interest (service quality)
Security and fraud prevention Detect unauthorized access, prevent abuse	Art. 6.1(f) GDPR - Legitimate interest (security) Art. 6.1(c) GDPR - Legal obligation (breach notification)
Service analysis and improvement Usage statistics, feature optimization	Art. 6.1(f) GDPR - Legitimate interest (product improvement)
Commercial communications Newsletters, product updates, offers	Art. 6.1(a) GDPR - Consent (can withdraw at any time)
Compliance with legal obligations Invoice retention, response to authorities	Art. 6.1(c) GDPR - Legal obligation

4.1 Processing of Health Data (Special Category)

When you upload dental images containing patient data, OWALLS processes health data under the special category of Article 9 of the GDPR.

Legal basis:

• Art. 9.2(h) GDPR - Preventive medicine, medical diagnosis, healthcare provision
• Art. 9.3 GDPR - Data necessary for preventive or occupational medicine purposes

Your responsibility: As a healthcare professional, you must ensure:

• Obtain informed consent from your patients for processing their images
• Inform your patients about the use of cloud services
• Comply with professional secrecy and applicable healthcare regulations

5. Recipients of Personal Data

5.1 Internal Access

Within OWALLS, only employees and collaborators who need access to provide the service have access to your personal data, under strict confidentiality obligations.

5.2 Data Processors (Sub-processors)

We share your data with the following third parties acting as data processors under contract:

Provider	Service	Location
CONTABO GmbH	Server infrastructure and cloud storage	Germany (EU)
STRIPE	Card payment processing and SEPA direct debits	Ireland (EU)

All these providers are subject to Data Processing Agreements (DPA) that guarantee GDPR compliance.

5.3 Transfers Due to Legal Obligation

We may share your data when legally required:

• Tax authorities (Agencia Tributaria) - invoices and tax data
• Law enforcement - in case of court order or criminal investigation
• Data protection authorities (AEPD) - in case of inspection

5.4 We Do Not Sell Your Data

6. International Data Transfers

6.1 Primary Data Location

Your data is primarily stored on servers located in the European Union (CONTABO data centers in Germany), ensuring full GDPR compliance.

6.2 Transfers Outside the EU (if applicable)

In the event we use providers with servers outside the European Economic Area (EEA), we guarantee the protection of your data through:

• Standard Contractual Clauses (SCC) approved by the European Commission
• Adequacy Decisions for countries with equivalent protection levels
• Additional security guarantees (encryption, pseudonymization)

7. Data Retention Periods

Data Type	Retention Period
Account and profile data	While the account is active + 60 days after cancellation
Images and clinical data - Essential Plan	Processed: While the account is active Originals: 12 months from upload
Images and clinical data - Professional Plan	Processed and Originals: While the subscription is active + 60 days
Backup copies	DB: 30 days Full images: 12 months Incremental images: 3 months
Billing data	10 years (legal tax obligation under Spanish legislation)
System logs	30 days (extendable for security investigations)
Support communications	2 years from the last interaction
Analytics cookies	Up to 2 years (depending on cookie settings)

After these periods, data will be securely deleted or irreversibly anonymized for statistical purposes.

8. Your Rights Regarding Your Personal Data

In accordance with the GDPR and LOPDGDD, you have the following rights:

8.1 Right of Access (Art. 15 GDPR)

You may request information about what personal data we process about you, for what purposes, for how long, and with whom we share it.

8.2 Right of Rectification (Art. 16 GDPR)

You may request the correction of inaccurate or incomplete personal data. You can also update much of your data directly from your profile on the platform.

8.3 Right of Erasure - "Right to be Forgotten" (Art. 17 GDPR)

You may request the deletion of your personal data when:

• It is no longer necessary for the purposes for which it was collected
• You withdraw your consent and there is no other legal basis
• You object to the processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Exceptions: We cannot delete data when there is a legal obligation to retain it (e.g., tax invoices for 10 years).

8.4 Right to Restrict Processing (Art. 18 GDPR)

You may request that we limit the use of your data in certain cases (e.g., while verifying the accuracy of data after a rectification request).

8.5 Right to Data Portability (Art. 20 GDPR)

You may request to receive your personal data in a structured, commonly used, and machine-readable format (e.g., JSON, CSV) to transmit it to another provider.

Export feature: From your dashboard you can export all your images and data at any time.

8.6 Right to Object (Art. 21 GDPR)

You may object to the processing of your data based on legitimate interest or for direct marketing.

Marketing opt-out: You can unsubscribe from commercial communications by clicking "unsubscribe" in any email or from your profile.

8.7 Right Not to Be Subject to Automated Decisions (Art. 22 GDPR)

Although we use AI to process images, we do not make automated decisions with legal or significant effects on you without human intervention.

AI processing is for technical assistance (classification, image optimization) and you always maintain control and professional oversight.

8.8 Right to Withdraw Consent

When processing is based on your consent (e.g., analytics cookies, newsletters), you may withdraw it at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

8.9 How to Exercise Your Rights

8.10 Right to Lodge a Complaint with the Supervisory Authority

If you believe that the processing of your data violates the GDPR, you have the right to lodge a complaint with the competent data protection authority:

9. Security Measures

OWALLS implements advanced technical and organizational measures to protect your personal data:

9.1 Technical Security

• Encryption: TLS 1.3 for data in transit, AES-256 for data at rest
• Authentication: bcrypt-hashed passwords, optional two-factor authentication (2FA)
• Firewall and DDoS protection: Advanced firewall, anti-attack protection
• Encrypted backups: Automatic backups with AES-256 encryption
• Data isolation: Each client has an isolated private environment
• 24/7 Monitoring: Intrusion detection and suspicious activity monitoring
• Security updates: Regular patches and updates

9.2 Organizational Security

• Restricted access: Principle of least privilege, authorized personnel only
• Confidentiality agreements: All personnel sign NDAs
• Security training: Regular data protection training
• Clean desk policy: Protocols for devices and documents
• Incident response plan: Procedures for security breaches
• Periodic audits: Security and regulatory compliance reviews

9.3 Security Breach Notification

In the event of a security breach affecting your personal data, we will comply with the GDPR:

• Notification to the AEPD: Within a maximum of 72 hours from becoming aware of the breach
• Notification to affected parties: If the breach poses a high risk to your rights and freedoms
• Documentation: Detailed record of the incident, causes, and corrective measures

10. Privacy of Minors

OWALLS is a professional service intended exclusively for dental professionals over 18 years of age.

We do not intentionally collect personal data from children under 16. If you become aware that a minor has provided personal data, please contact us immediately at info@owalls.com to proceed with its deletion.

10.1 Data of Minor Patients

If, as a dental professional, you upload images of minor patients:

• It is your responsibility to obtain consent from parents or legal guardians
• You must comply with applicable healthcare regulations on data of minors
• OWALLS acts solely as a data processor under your instructions

11. Cookies and Tracking Technologies

We use cookies and similar technologies to improve functionality and user experience.

11.1 Types of Cookies We Use

a) Strictly Necessary Cookies (Do not require consent)

• Authentication: Keep your session securely logged in (JWT)
• Security: CSRF protection, attack prevention
• Payments: Secure transaction processing (Stripe)

b) Analytics Cookies (Require consent)

• Usage statistics: Most visited pages, time spent, navigation flow
• Performance: Load times, technical errors
• Anonymized data: Do not personally identify individual users

11.2 Cookie Management

When accessing our website, a cookie consent banner will be displayed. You can:

• Accept all: Essential + analytics cookies
• Essential only: Reject analytics cookies
• Customize: Choose specific categories

You can change your preferences at any time by clicking on "Cookie Settings" in the footer.

For more information, please see our full Cookie Policy.

12. Links to Third-Party Websites

Our website may contain links to third-party websites (e.g., social media, technical documentation, external blog articles).

OWALLS is not responsible for the privacy practices of third-party websites. We recommend reading the privacy policies of any external site you visit.

13. Modifications to this Privacy Policy

OWALLS reserves the right to modify this Privacy Policy to:

• Adapt to regulatory changes (new laws, case law)
• Reflect changes in our data processing practices
• Incorporate new service features
• Improve clarity and transparency

13.1 Notification of Changes

In the event of substantial modifications:

• The updated version will be published on this page with a new "Last updated" date
• Notification will be sent by email to registered users
• A prominent notice will be displayed on the platform
• Users will have 30 days to review the changes before they take effect

We recommend reviewing this policy periodically to stay informed about how we protect your information.

14. Applicable Data Protection Regulations

This Privacy Policy complies with:

• Regulation (EU) 2016/679 - General Data Protection Regulation (GDPR)
• Organic Law 3/2018, of 5 December - Personal Data Protection and Guarantee of Digital Rights (LOPDGDD)
• Law 34/2002, of 11 July - Information Society Services and Electronic Commerce (LSSICE)
• Directive 2002/58/EC - Privacy and electronic communications (ePrivacy Directive)
• Regulation (EU) 2024/1689 - Artificial Intelligence (AI Act) - for transparency in AI use

15. Contact Information - Data Protection

16. OWALLS as Data Processor of Health Data

16.1 Contractual Relationship with the Controller (Dental Professional)

When you, as a healthcare professional, upload health data of your patients to OWALLS:

• You are the Data Controller: Determines purposes and means of processing your patients' data
• OWALLS is the Data Processor: Processes health data only according to your instructions

16.2 Obligations of OWALLS as Data Processor (Art. 28 GDPR)

We undertake to:

• Process data only according to your documented instructions
• Ensure that authorized personnel are subject to confidentiality
• Implement appropriate technical and organizational measures (see section 9)
• Not subcontract without your prior informed authorization
• Assist you in responding to data subjects' exercise of rights
• Assist you in compliance with security obligations and impact assessments
• Delete or return data upon termination of the service (except legal retention obligations)
• Make available information to demonstrate compliance
• Notify security breaches affecting health data

16.3 Your Obligations as Data Controller

As a healthcare professional, you must:

• Obtain informed consent from your patients for the processing of their data
• Inform patients about the use of cloud services
• Comply with the duty of professional secrecy
• Implement security measures on your side (strong passwords, 2FA, etc.)
• Not upload more health data than strictly necessary
• Review and accept the Data Processing Agreement (DPA)

16.4 Data Processing Agreement (DPA)

By accepting the Terms of Service, you accept the Data Processing Agreement which forms part of the contractual agreement and complies with Article 28 of the GDPR.

---

OWALLS Privacy Policy - Version 1.0
Last updated: January 2026
For inquiries about this policy: info@owalls.com