Sedation Sync, Inc.
Effective Date: April 23rd, 2025

1. Introduction

Sedation Sync, Inc. (“Sedation Sync,” “we,” “us,” or “our”) operates the web platform located at https://www.sedationsync.com and related mobile or desktop applications (collectively, the “Services”). Our platform allows dental practices to connect with board‑certified anesthesiologists, schedule cases, exchange health records, and streamline peri‑operative workflows. We understand that protecting privacy—especially protected health information (“PHI”)—is fundamental to patient trust and our legal obligations.

This Privacy Policy explains what information we collect, why we collect it, how we use and share it, and the rights and choices you have. By using the Services, you agree to the collection and use of information in accordance with this Policy.

2. Scope

This Policy applies to information collected through the Services and any offline contact in which we direct you to this Policy. It does not cover third‑party sites or services that we do not control—even if linked from our Services.

3. Information We Collect

Special Category Data: We process PHI as a “Business Associate” under HIPAA and as a “Covered Business” under the CPRA’s sensitive data provisions.

4. How We Use Information

• Provide & improve the Services (create accounts, schedule cases, route files, recommend anesthetic plans).
  
  
• HIPAA/HITECH compliance (execute Business Associate Agreements, audit logs).
  
  
• Security & fraud prevention (penetration testing, anomaly detection, MFA).
  
  
• Customer support & training.
  
  
• Marketing (with opt‑in consent where required; never for PHI).
  
  
• Legal obligations & risk management (subpoena response, contractual enforcement, dispute resolution).
  
  

5. Legal Bases for Processing (GDPR)

We rely on (i) contract necessity for providing the Services; (ii) legal obligation for HIPAA and tax records; (iii) legitimate interests in improving our products and preventing fraud; and (iv) consent for marketing or where required to process sensitive data cross‑border.

6. Sharing & Disclosure

We share information only as necessary:

1. Authorized Dental Providers & Anesthesiologists – limited to the patient’s case file.
   
   
2. Service Providers & Sub‑Processors – secure hosting, e‑signature, SMS, email, AI analytics (subject to DPAs/BAAs).
   
   
3. Regulators or Law‑Enforcement – when required by law or to protect safety.
   
   
4. Business Transfers – corporate reorganization, merger, or sale (with notice).
   
   
5. With Consent – when you instruct us, e.g., exporting data to another EHR.
   
   

7. Retention

We retain PHI and business records for the longer of (a) seven years after the last patient encounter (per CA Bus. & Prof. Code § 1684.5) or (b) as required by payer contracts or applicable statutes of limitation. Logs and backups are purged on a rolling 90‑day basis unless needed for security or litigation.

8. Security

We employ administrative, technical, and physical safeguards aligned with NIST 800‑53 and HIPAA Security Rule standards, including encryption in transit (TLS 1.3) and at rest (AES‑256), role‑based access, and annual SOC 2 Type II audits.

9. Your Rights

• California (CCPA/CPRA): Right to know, access, correct, delete, and opt‑out of “sharing” for targeted advertising. We do not “sell” personal information.
  
  
• EU/UK (GDPR): Right of access, rectification, erasure, restriction, data portability, and objection.
  
  
• HIPAA: Right to inspect and obtain a copy of PHI, request amendments, and receive an accounting of disclosures.
  
  

Submit requests at privacy@sedationsync.com or call +1 (917) 268‑4966. Identity verification is required.

10. Children’s Privacy

We do not knowingly collect information directly from children under 13. Pediatric data is provided by parents/guardians or treating dentists under HIPAA’s treatment exception. If we learn we collected personal data from a child without parental consent, we will delete it immediately.

11. International Transfers

Data may be processed in the United States and other jurisdictions with different privacy laws. We rely on standard contractual clauses (SCCs) or comparable safeguards for cross‑border transfers.

12. Third‑Party Sites

Our Services may link to third‑party websites (e.g., X‑ray vendors). We are not responsible for their privacy practices.

13. Changes to This Policy

We will post any revisions here and update the “Effective Date.” Material changes will be announced via e‑mail or dashboard notice 30 days before taking effect.

14. Contact Us

Sedation Sync, Inc.
Attn: Privacy Officer
2760 West Peoria Ave, #1190, Phoenix, AZ 85029, USA
privacy@sedationsync.com | +1 (917) 268‑4966