Privacy Policy

Practice Evolved, Inc. ("Practice Evolved", "we", "us", "our") is a practice intelligence dashboard for dental practices, and the company that operates it. This Privacy Policy explains what information we collect, how we use and protect it, and the choices you have when you use our websites (practiceevolved.com and signaldmd.com), the Practice Evolved web dashboard, and the Practice Evolved sync agent for Windows (together, the "Service").

Practice Evolved is a business service for dental practices. It is not directed to consumers or the general public.

Practice Evolved provides services to dental practices that are HIPAA "covered entities". When we handle protected health information (PHI) on a practice's behalf, we act as a "business associate" under a written Business Associate Agreement (BAA) with that practice.

The practice (our customer) controls its own patient information; we process it only to provide the Service to that practice, and only as permitted by the BAA and applicable law. Where the BAA conflicts with this Policy, the BAA controls for that PHI.

Account and contact information. When a practice or its staff signs up or contacts us, we collect names, work email addresses, the practice or business name, role, and authentication credentials.

Practice data synced from your practice software. With the practice's authorization, the Practice Evolved sync agent reads financial and operational data from the practice's existing practice management system: insurance claims, amounts written off, adjustments, accounts receivable balances, appointments and recall, provider production, and related practice and insurer reference data. So a practice's own staff can work this data, a limited set of patient identifiers may be included for that practice's authorized users only, for example a patient's name and, where needed to contact a payer about an open claim, date of birth and insurance member or subscriber ID. The agent writes back only a small, named set of records, described in full by clauses 5 and 6 of the Business Associate Agreement: today that is a note or comment a person at the practice composed in the dashboard, on Open Dental, which the practice can turn off at any time. It never deletes anything and never changes what a person at the practice entered.

Setup Scan and diagnostics. On first connection, the sync agent runs a Setup Scan that collects the database schema (table and column names, types, relationships), system diagnostics (operating system version, connectivity, drivers), the practice management system type, and a consent record and logs. The Setup Scan does not collect patient records, claims, or payment exports.

Early Access signups. When you sign up for Early Access on practiceevolved.com, we collect your first and last name, work email address, phone number, the practice management software you run, the number of locations you operate, an optional referral code, and the campaign parameters in the link you arrived from. This is business contact information about you in your professional capacity, not patient information, and it is used only to record your signup, keep your place in the line, contact you about getting your practice connected, and understand which practice management systems the practices waiting with you run.

Usage and technical data. When you use the dashboard or our websites, we collect standard technical data such as IP address, browser and device type, pages viewed, and log and diagnostic events, to operate, secure, and improve the Service.

What we collect. If a practice owner or manager chooses to connect the practice's bank account, the connection is made through Plaid Inc. ("Plaid"). We use Plaid's Transactions product only, with read only access to the practice's business deposit accounts. From it we keep the connected accounts' names, types and last four digits, and the incoming deposits and insurance returns on those accounts: the date, the amount, the bank's description of the deposit, and the payer details we read from that description. We do not keep ordinary outgoing payments or pending transactions, and we never receive the practice's bank login, full account number or routing number. Plaid's access token is encrypted before we store it.

Why. We use this data only to match insurance deposits to the payments insurers report, so the practice can see which insurance money arrived and which did not. We cannot move money, and we do not use bank data for any other purpose, sell it or use it for advertising.

How long we keep it, and how to disconnect. While a bank is connected we keep its deposit lines for a rolling 24 months and delete older lines automatically. An owner or manager can disconnect the bank at any time on the Bank page of the dashboard. When they do, we ask Plaid to remove our access at once and erase our copy of the access token, and we automatically delete every deposit line, account and connection record we stored from that bank within 30 days. When a practice's account closes, we disconnect every bank and delete this data within 30 days. Encrypted backups that contain it expire within 90 days.

Plaid's role. Plaid collects and processes the information you provide in Plaid's connection window, such as your bank login, under its own End User Privacy Policy, linked below.

Plaid End User Privacy Policy

We do not collect your database passwords (they remain on your own systems), and we do not collect Social Security numbers, clinical or treatment note text, or patient contact details such as home addresses or phone numbers, beyond the limited identifiers described above that your own staff need to do their work.

We do not sell your information, and we do not use patient information for advertising.

We use the information to provide and operate the Service (building each practice its own dashboard and worklists), authenticate users and secure accounts, provide customer support and onboarding, maintain, troubleshoot, and improve the Service, and comply with our legal obligations. We process PHI only as permitted by the applicable BAA.

We share information only as needed to run the Service, and only with appropriate safeguards.

Service providers and subprocessors. We use trusted vendors (for example, cloud hosting and infrastructure providers such as Amazon Web Services) to host and operate the Service. They are bound by contract, and where PHI is involved by business associate terms, to protect the information and use it only to provide services to us.

Plaid. When a practice connects its bank, Plaid provides the read only deposit data described above, under the practice's authorization given in Plaid's connection window.

Within your practice. Practice data and any included patient identifiers are visible only to the authenticated users of that same practice.

Legal and safety. We may disclose information if required by law, or to protect rights, safety, and the integrity of the Service.

Business transfers. If the business is involved in a merger, acquisition, or asset sale, information may be transferred subject to this Policy and applicable BAAs.

We do not sell or rent personal information, and we do not share it for third party advertising.

We protect information with measures appropriate to its sensitivity, including encryption in transit and at rest, authenticated and access controlled accounts, least privilege and read only database access on the practice connection, and activity logging. No method of transmission or storage is perfectly secure, but we work to protect your information and continually improve our safeguards.

We retain information for as long as needed to provide the Service to the practice, to comply with our legal and BAA obligations, resolve disputes, and enforce our agreements. On termination, we return or delete PHI as required by the applicable BAA. A practice may request deletion of its data as described below.

Bank account data from Plaid follows its own schedule, described in "Bank account data (Plaid)" above: a rolling 24 months while connected, and deletion within 30 days of a disconnect or of the account closing.

Early Access signups are kept while you are on the list and for a reasonable period afterward so we can honor your place in the line and reach you when we get to you. You can come off the list at any time by replying to any note from us or by emailing support@practiceevolved.com, and we will delete your signup.

Practices and their authorized users may access and update account information in the dashboard or by contacting us. Depending on your location, you may have rights to access, correct, delete, or restrict the use of personal information, or to receive a copy of it.

For patient information that we process as a business associate, requests are directed to and handled by the practice (the covered entity); we assist the practice as required by the BAA. To make a request, email support@practiceevolved.com.

Our websites use a minimal set of cookies and similar technologies necessary to operate the site, keep you signed in, and understand aggregate usage. We do not use them for cross site advertising.

The Service is a business tool intended for dental practices. It is not directed to children, and we do not knowingly collect personal information directly from children through the Service.

We honor applicable privacy laws, including U.S. state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA) where they apply. We do not sell or "share" (as those laws define it) personal information. The Service is operated in the United States; if you access it from elsewhere, you consent to processing in the United States.

We may update this Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, provide additional notice. Continued use of the Service after an update means you accept the revised Policy.

Questions about this Policy or your information? Email support@practiceevolved.com, call (781) 856-6620, or write to Practice Evolved, Inc., 39 Cherokee Road, Canton, MA 02021.

For legal notice, our registered office is Practice Evolved, Inc., c/o The Corporation Trust Company, 1209 Orange Street, Wilmington, DE 19801.

For matters involving patient information held on a practice's behalf, please also contact your practice, which controls that information as the covered entity.