See exactly how information moves through HeyDenta — from a patient's first hello to a booked appointment — and how it stays protected under the Data Privacy Act.
Call, chat or Messenger
In Taglish, in real time
Consent asked at intake
Encrypted; deletions logged
Export or delete while your account is active
The controls behind every record — no jargon, no overstatement.
TLS in transit, encryption at rest.
Per-clinic separation keeps your patients and records apart from every other clinic's.
Access is role-based. Opening a patient record, exports, merges and permanent deletions are logged, and the clinic owner can read that log in the dashboard.
A managed database in Northeast Asia (Seoul), on Supabase & Vercel infrastructure.
The AI receptionist is built to capture only what a booking needs.
Every AI call opens by telling the caller it's recorded; recordings and their transcripts are deleted after 30 days.
Aria handles inquiries, booking and follow-ups; clinically significant questions are escalated to your team. You set what it can do.
Patients consent to how their details are used as part of the intake step.
In the patient chat, phone numbers and emails are masked before the message reaches the AI provider abroad, and a name is masked when the patient introduces it with a phrase such as "my name is", best effort. Voice calls, the scribe's dictation and scanned forms are processed without masking.
Clear roles, in writing — and fast when it matters.
Your clinic is the Controller; HeyDenta is your Processor — spelled out in the agreement you e-sign.
If a breach affecting your clinic occurs, we notify you within 24 hours so you can meet your reporting obligations to the NPC on time.
We never sell patient data, and never use patient messages to train external AI models.
The company behind HeyDenta, on the record. You can check the DTI business name yourself at bnrs.dti.gov.ph.
Everything your data-protection officer or counsel needs to review HeyDenta — the documents themselves, not a wall of badges.
A patient contacts the clinic by call, chat or Messenger. Aria identifies the intent in Taglish, in real time. The form asks for the details needed to book, with consent asked at intake. The appointment is created and encrypted; opening a patient record, exports and deletions are logged. The clinic controls the record and, while its account is active, can delete it and download its patient and clinic records from the dashboard.
Your clinic is the Controller and HeyDenta is your Processor. The roles are spelled out in the agreement you e-sign under RA 8792. If a breach affecting your clinic occurs, we notify you within 24 hours so you can meet your reporting obligations to the NPC on time. You sign it in your HeyDenta dashboard under Launch kit, and we email you a signed confirmation. To read the full text first, request the Trust Brief below.
Supabase (managed database, Seoul region, encrypted at rest), Vercel (application hosting), Hostinger (the server that runs HeyDenta's background jobs and the SMS relay), Upstash (rate limits and short-lived session state, including the sender's number on SMS), OpenAI (the patient chat, masked best effort; the clinic dashboard assistant's patient lookups, schedule, booking changes and treatment-plan drafts, the scribe's dictation and patient name, and scanned forms, unmasked), OpenRouter and Anthropic (automated quality checks and bot-fix reviews on masked chat; OpenRouter routes to OpenAI and Google models), Meta (Messenger and Instagram delivery; Meta keeps its own copy of those chats), Resend (email delivery), Semaphore (SMS in the Philippines), Twilio (SMS outside the Philippines, off by default), Retell (AI voice calls; recordings and transcripts deleted after 30 days), Sentry (error reports, configured without personal data), Discord (operations alerts; some alerts carry a patient's name).
Call recordings and their transcripts are deleted after 30 days. Patient records stay with your clinic and are deleted on request. The clinic owner and admins can download the clinic's patient and clinic records from the dashboard while the account is active (photo files are in the download when they fit, otherwise they come on request), and a full export also comes on request within 15 days.
Email hello@heydenta.com. A breach affecting your clinic is reported to you within 24 hours.
Clear Controller and Processor roles in writing. Consent at intake. Encryption in transit and at rest, with per-clinic isolation. Least-privilege access; opening a patient record, exports and deletions logged. Fast breach notification. No selling of patient data, and no training of external AI models on patient messages.
Or email hello@heydenta.com and we send the documents.
Compliance is a journey, and we'd rather tell you exactly where we stand than overstate it. Ask us about any certification, registration, or safeguard and you'll get a direct answer — what's in place today, and what's on the roadmap.
Email hello@heydenta.com →