Introduction
Welcome to ALLONXFLOW, a case management portal operated by Vertex Dental Studio (“Company,” “we,” “our,” or “us”).
Your privacy is important to us. This Privacy Policy explains how we collect, use, disclose, protect and manage your information when you visit our website, use our applications, or interact with our services.
Where applicable, we safeguard Protected Health Information (“PHI”) in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended, and other applicable federal and state privacy laws.
By accessing or using our services, you acknowledge that you have read and understood this Privacy Policy.
Information We Collect
Depending on how you interact with our services, we may collect the following.
Personal information
- Full name
- Email address, including any additional notification addresses you add
- Phone number, including any additional notification numbers you add
- Mailing address
- Practice, organization or employer
- Professional credentials and license details, where required for verification
- Account credentials
- Payment information, processed securely through third-party payment providers
Health information
Where applicable and authorized, we may collect Protected Health Information submitted by a treating provider, including:
- Patient identifiers
- Case records, treatment plans and clinical notes
- Scans, images, models and related case files you upload
- Appointment and case scheduling details
- Insurance information
- Clinical communications exchanged through the portal
Such information is collected only for legitimate healthcare and treatment-support purposes, and is handled in accordance with HIPAA requirements and any applicable Business Associate Agreement.
Technical information
We automatically collect certain information, including:
- IP address
- Browser type and version
- Device information and operating system
- Access times and session activity
- Pages and records viewed within the portal
- Cookies and similar technologies
How We Use Your Information
We use the information we collect to:
- Provide, operate and improve our services
- Create and manage user accounts, and verify professional eligibility
- Process case submissions, uploads and status updates
- Deliver notifications about activity on your cases
- Support the delivery of healthcare-related services
- Process transactions and maintain billing records
- Respond to support requests and inquiries
- Detect, investigate and prevent fraud and security incidents
- Comply with legal, regulatory and contractual obligations
- Communicate important service updates
We use Protected Health Information only as permitted by HIPAA, by an applicable Business Associate Agreement, or as otherwise required by law. We do not use PHI for advertising, and we do not sell it.
Email and SMS Notifications
The portal sends operational notifications about activity on your cases — for example when a case is registered, when its status changes, when new scans are uploaded, or when a message is posted to a case.
Notifications are sent to the email address on your account and to any additional notification addresses you have chosen to add in your profile.
Text messages (SMS)
We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes. Mobile opt-in information is never disclosed for marketing, is excluded from every category of sharing described elsewhere in this policy, and is used only to deliver the notifications described here.
- What we collect for messaging. Only the mobile telephone number you enter in your profile, and the record that you added it. We do not collect or use any other data for our messaging program.
- How it is used. The number is used solely to send you operational alerts about your own cases — a new case, an upload, or a message on a case. It is never used for marketing or promotional messaging.
- Consent. Text messages are sent only to mobile numbers you add yourself in your profile. Adding a number is your opt-in; you may remove it at any time to stop messages to that number.
- Message frequency. Message frequency varies and depends on activity on your cases.
- Opting out. Reply STOP to any message to unsubscribe that number, or HELP for assistance. You may also contact us at Support@allonxflow.com.
- Carrier charges. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages.
- Content. Every message identifies ALLONXFLOW as the sender, references the case number only, and directs you to sign in to the portal for details. Patient names, clinical details and the contents of portal messages are never included in a text message. Text messaging is not an encrypted channel, so Protected Health Information is never sent over it — you sign in to the portal to see which case a message refers to.
- Delivery. Your number is disclosed only to the telecommunications provider that transmits the message on our behalf, solely for that purpose. That provider is contractually prohibited from using it for any other purpose.
Our SMS Program page describes the messaging program in full, including the exact opt-in screen and consent wording shown in the portal.
HIPAA Compliance
Where we act as a HIPAA Business Associate or Covered Entity, we implement administrative, physical and technical safeguards designed to protect Protected Health Information.
Our security program includes:
- Encryption of sensitive information in transit
- Encryption of stored PHI where appropriate
- Role-based access controls
- Multi-factor authentication where applicable
- Audit logging of access and case activity
- Workforce privacy and security training
- Ongoing security monitoring
- Periodic risk assessments
- Secure backup and recovery procedures
Access to PHI is limited to authorized personnel with a legitimate business need, and is logged.
Disclosure of Information
We do not sell your personal information.
We may disclose information:
- To healthcare providers involved in a patient’s care
- To authorized business associates under written agreement
- To service providers performing services on our behalf
- To comply with legal obligations, subpoenas or lawful requests
- To protect public safety or prevent serious harm, where legally permitted
- In connection with a merger, acquisition or other business transfer
Any disclosure involving PHI is made only as permitted by HIPAA, an applicable Business Associate Agreement, or applicable law.
None of the above applies to mobile telephone numbers or messaging consent data. We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes, and mobile opt-in data is never transferred in connection with a merger, acquisition or business transfer for marketing use. It is disclosed only to the provider that transmits the message, solely to deliver it.
Data Retention
We retain personal information only for as long as necessary to:
- Provide the services you have requested
- Meet legal, regulatory and professional record-keeping obligations
- Resolve disputes
- Enforce our agreements
Protected Health Information is retained in accordance with applicable legal and regulatory requirements, and with the instructions of the Covered Entity on whose behalf it is held.
Security
We maintain reasonable administrative, technical and physical safeguards designed to protect your information against unauthorized access, disclosure, alteration and destruction.
While we employ industry-standard security practices, no method of transmission or storage is completely secure. You are responsible for keeping your account credentials confidential and for notifying us promptly of any suspected unauthorized access.
Your Rights
Depending on applicable law, you may have the right to:
- Access the information we hold about you
- Correct inaccurate or incomplete information
- Request deletion, where permitted by law
- Obtain a copy of your data
- Restrict or object to certain processing
- Request an accounting of disclosures involving PHI
- File a privacy complaint without fear of retaliation
Individuals covered by HIPAA may also exercise the rights available under the HIPAA Privacy Rule. Where we hold PHI on behalf of a Covered Entity, we will direct such requests to that entity.
To exercise any of these rights, contact us at Support@allonxflow.com or (980) 622-3131.
Third-Party Services
Our services may integrate with third-party providers, including:
- Payment processors
- Cloud infrastructure and storage providers
- Email and SMS delivery providers
- Analytics platforms
- Healthcare technology vendors
These providers are required to protect information consistent with applicable contractual and legal requirements, including Business Associate Agreements where they may access PHI.
Children's Privacy
Our services are intended for use by licensed healthcare professionals. We do not knowingly collect information directly from children. Information about a minor patient may be submitted only by their treating provider, or under the supervision of a parent, guardian or healthcare provider, in accordance with applicable law.
International Users
Our services are operated from the United States. If you access them from outside the United States, you acknowledge that your information may be transferred to, stored and processed in the United States or in other jurisdictions where our service providers operate, which may have different data protection laws than your own.
Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be posted on this page with a revised effective date, and where required by law we will provide additional notice. Continued use of our services after an update constitutes acceptance of the revised policy.
Contact Us
If you have questions about this Privacy Policy, or wish to make a privacy request, contact Vertex Dental Studio at Support@allonxflow.com or (980) 622-3131.
See also our Terms & Conditions, which govern your use of the portal.