Diastema Privacy Policy
Effective date: November 10, 2026
1. Who we are and what this policy covers
Diastema LLC, a Texas limited liability company ("Diastema", "we", "us"), makes the Diastema software for dental practices that use Open Dental. This policy explains what information we collect, why, who we share it with, how long we keep it, and the choices you have.
It covers:
- Visitors to our website, diastema.app, including people who use the free X-ray audit or our sign-up form.
- Dental practices that are our customers and the people who work there or act for them, such as an owner, office manager or IT company.
- Our online services: the servers we run so that a practice's Diastema installation can be reached securely, kept up to date and backed up.
The Diastema software itself runs on each practice's own server. Patient information it reads from Open Dental belongs to the practice. Where we handle patient information at all, we do so as the practice's business associate under HIPAA, and our Business Associate Agreement with the practice governs it (see section 6). This policy does not change that agreement.
Diastema is for dental practices in the United States, and our servers are in the United States. This policy describes our practices. It is not a contract, and it doesn't create rights beyond those the law and our agreements give.
2. The short version
- Patient records stay on your server. Diastema reads Open Dental on your own server. We don't keep a readable copy of your patient records. The few ways patient information can pass through our systems are encrypted so that we don't have the key (section 5).
- No cookies or analytics on our website. No advertising or third-party scripts either. For security, our servers log connections (section 3). The free X-ray audit runs entirely in your browser; the file you drop on it never reaches us.
- We collect what we need to run your account: contact and business details, billing records from Stripe, and status reports and usage counts from your Diastema installation that contain no patient names or details.
- We don't sell personal information or share it for advertising.
- You can see, correct or delete what we hold about you (section 11).
3. What we collect on our website
Browsing. Our website sets no cookies and has no analytics, advertising or tracking tools, and no third-party scripts, fonts or embeds. For security, our servers record each connection: your internet address, the time, and which of our site names you reached, but not which pages you read. If a request to our servers fails, we record which page address failed and when, without your internet address, so we can fix it.
The free X-ray audit. The audit page does all of its work in your browser. The query you run in Open Dental, the file you export and the results you see never reach our servers, and the page's security settings tell your browser to block it from sending anything. We learn nothing about your practice or your patients when you use it.
The sign-up form. When you use the "Get started" form, we collect:
- your name, email address and phone number, and whether you'd like a free demo or to get set up
- the name of your web browser (as your browser reports it)
- a scrambled (hashed) form of your internet address, used to limit sign-ups from one place and to spot repeats. We don't store the address itself.
We use these details only to write back to you about Diastema. Each sign-up reaches us as an email sent through Amazon's email service, and we reply from our own email account, hosted by Google.
Other forms with a private link. Some pages are opened only from a link we send a practice: the buy link, the onboarding form and the install guide. They record a scrambled (hashed) form of your internet address, to limit repeated attempts. What you enter on them is described in section 4.
Messages you send us. If you write to us, we keep the message and our reply.
4. What we collect when a practice becomes a customer
Payment details. Payments are handled by Stripe. When you save a card or bank account, you enter it on Stripe's own page, and the full number goes to Stripe, not to us. From Stripe we receive and keep what we need to run your subscription: Stripe's customer and subscription numbers, the kind of payment method with its brand or bank name and last four digits, and whether each payment succeeded.
The onboarding form. To set up your account, sign your agreements and install Diastema, we ask for:
- the practice's legal name, the name the IRS has on file, any business name it trades under, its business type, Employer Identification Number (EIN) and website
- the practice address and billing address, office hours and time zone
- names, titles, email addresses and phone numbers of the owner, the office manager and a main contact
- the name and contact details of the practice's IT company, if it has one
- setup details: the Open Dental version, how many computers and locations, whether Open Dental's clinics feature is on, the phone system, who has the server's Windows login (we never ask for the password), and when installation would suit you
Signed agreements. When you sign the terms of service, the Business Associate Agreement and any other agreement, we keep the exact text you signed, the signer's name, title and email address, the date and time, and a scrambled (hashed) form of the internet address it was signed from. We email you a PDF copy.
Open Dental keys. To connect Diastema to your Open Dental, we create a customer key for your practice in Open Dental's system and deliver it to your Diastema server. We keep it encrypted, and copies in our records show only its last four characters.
Our emails to you. We keep a copy of each service email we send you (with any one-time links and codes blanked out) and whether it was delivered, so we can see what you received.
Account notes. We keep notes about your account, such as support conversations and installation details.
5. What the Diastema software sends us
Diastema runs on your practice's own server and reads Open Dental there. Your Open Dental database, your patient records, and what your team enters into Diastema (follow-up notes, staff PINs, settings) stay on that server.
Once your server is connected to our online services, normally at installation, it sends us only the items below.
| What | When | What it holds | Patient information? |
|---|---|---|---|
| Status reports | Every 15 minutes | Diastema's version and update status; whether Open Dental answers, and its version; whether clinics are on, and how many; whether backups are on and when the last one worked; the secure address's status; the server's clock; the internet address it connects from | None |
| Usage statistics | Once a month | Totals for the month: how many times each part of Diastema was used; dollar totals for GapCheck, our X-ray check (the fees of X-rays it added, that were completed, or that it removed) and, where that feature is on, for treatment plans printed; how many staff signed in, by access level and device type; requests in each hour of the day, totaled for the month, and how many failed or were slow; a few yes/no settings. Any count or total made of fewer than 5 items is sent only as "fewer than 5", and dollar totals are rounded to the nearest $100 | No patient names or details, no dates within the month, no staff names, nothing typed into Diastema, and no amount for a single patient |
| Update results | After each update | Which version was installed and whether it worked | None |
| The secure address | Whenever your team uses Diastema | Your office's own address on diastema.app. Connections pass through our servers inside encryption whose key only your server holds; we see the address used, the internet addresses connecting and how much data passes | Travels inside the encryption; we don't have the key |
| Off-site backups (if your admin turns them on) | Nightly | Your Diastema backup file, which can include patient information such as follow-up history. It's locked with your practice's recovery code before it leaves your server, and the code never leaves your server | Inside the locked file; we have no way to open it in ordinary operation |
| Missed calls (if your practice turns them on) | When a call is missed | The caller's number and caller ID name, the number dialed and the time, sent by your phone system straight to your office's secure address. It passes through our servers encrypted, like your team's connections, and we don't store it. If your server is offline, that call isn't delivered | Can be; travels inside the encryption, and we don't have the key or keep a copy |
| Support files (only if you send one) | When you choose | Version, settings, a connection check, service logs and update history; no keys and no database contents; phone numbers and email addresses in the logs are masked | Designed to hold none |
Two outside services also see a little about your server:
- GitHub, which hosts our software updates, sees your server's internet address when it downloads one. Your server installs only updates signed by us.
- Let's Encrypt issues the security certificate for your office's address. Like every website certificate, the address name (for example, yourpractice.app.diastema.app) is recorded in public certificate logs that anyone can search.
6. Patient information and HIPAA
Your practice is the HIPAA covered entity for its patients' information. When our services create, receive, keep or transmit patient information for your practice, we act as your business associate, and the Business Associate Agreement you sign with us governs that information. If this policy and the Business Associate Agreement ever differ about patient information, the agreement controls.
We use patient information only to provide Diastema to your practice, as the agreement allows. We don't use it for marketing, we don't sell it, and we don't use it to build products for anyone else.
As section 5 explains, the paths by which patient information can reach our systems are built so that we don't hold the keys to read it: the secure address is encrypted end to end to your server, off-site backups are locked with a code only your practice holds, and missed-call details travel to your server inside the same encryption, and we don't store them. Missed-call details can be patient information, and we handle them as your business associate.
Please don't send us patient information, or your practice's recovery code, by email, through our sign-up form or in other messages; use Diastema's own features instead. If patient information reaches us another way, we may delete it.
Patients who want to see, correct or limit their information should contact their dental practice. If a practice asks us to help with a patient's request, we will.
6A. Text messages
Diastema sends text messages for the dental practices that use it: appointment reminders and confirmations, links to the practice's forms, and replies to patients' questions. Only patients who gave their practice a mobile number and agreed to receive texts get them.
Text messages travel through our messaging carrier, Telnyx. The history of the messages is kept on Diastema's own servers.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are not shared with any third parties.
Reply STOP to any text to opt out at any time, or HELP for help.
7. How we use information
We use the information described above to:
- answer your questions and talk with you about Diastema
- set up your account, prepare and keep your signed agreements, and install Diastema
- bill for your subscription and keep tax and accounting records
- check that your installation is running, connected, backed up and up to date, and fix problems
- install updates, including ones we schedule for you
- turn on the features your plan includes
- see which parts of Diastema practices use, so we can decide what to improve
- send service messages: onboarding, billing, security notices and changes to this policy or our terms
- keep our services secure and prevent abuse
- meet legal obligations and enforce our agreements
We don't send marketing emails without your consent, and we don't use your information for advertising.
8. Who we share it with
We share information only with the service providers that run parts of Diastema for us, each limited to what it needs to do that job.
| Provider | What it does for us | What it can see | Patient information? |
|---|---|---|---|
| Amazon Web Services | Runs our servers, stores our encrypted backups, and sends our email | What our servers hold | Yes, in encrypted form: locked backups, and secure-address traffic passing through, including missed-call details. We don't have the keys, and we have a Business Associate Agreement with Amazon. |
| Stripe | Billing and payments | Practice billing details and payment methods | No |
| Our email account, which we use to write to you | Your name, email address and our messages with you | No | |
| Cloudflare | Our domain name's directory service (DNS) | Lookups of our site names; our traffic doesn't pass through it | No |
| Let's Encrypt | Security certificates for practices' secure addresses | Each office's address name | No |
| GitHub | Hosting our software updates | A practice server's internet address when it downloads an update | No |
| Tailscale | The private network our staff use to reach our own servers | Nothing of yours in readable form | No |
| Telnyx | Carries the text messages practices send and receive through Diastema (section 6A) | Patients' mobile numbers and the texts | Yes: the texts pass through it |
This is our complete list of service providers, and our Terms and Business Associate Agreement refer to it. We will update it before adding a provider. Information a provider collects from you directly, for example when you enter a card on Stripe's page, is also covered by that provider's own privacy policy.
We may also disclose information when the law requires it, to protect the safety or rights of people or of Diastema, or with your consent. If Diastema is merged or sold, your information would go to the new owner, who would have to honor this policy and our agreements with you.
9. Where it's stored and how we protect it
Our servers and storage are in the United States, at Amazon Web Services in Ohio, with backups in Oregon.
- In transit: every connection to our website and services is encrypted (HTTPS only).
- Sensitive fields: Open Dental keys and the one-time links we send are stored encrypted.
- Our own backups: our database is copied continuously, and a sealed copy is made each night that can't be read from storage alone.
- Practices' off-site backups: locked with the practice's recovery code, and stored so that no one, including us, can change or delete them early.
- Access: only people working for Diastema who need access, under confidentiality obligations, can reach our servers, through a private network that requires signing in with multi-factor authentication.
- In your office: Diastema asks each staff member for a PIN, uses access levels to decide who sees what, and opens your secure address only on devices your practice has approved.
No system is perfectly secure. If a breach affects your information, we will tell you as the law and our agreements require.
10. How long we keep it
We keep information only as long as we need it for the purposes above, or as the law requires.
| Information | Kept for |
|---|---|
| Sign-up details (name, email, phone, your choice, browser, hashed address) | 24 months after our last contact if you don't become a customer, or sooner if you ask us to delete them |
| Account details, onboarding answers and account notes | While your practice is a customer, then 12 months |
| Signed agreements | 6 years after the agreement ends |
| Billing records | 7 years, for tax and accounting |
| Copies of the service emails we send, and their delivery status | 24 months |
| Status reports from your server | 30 days |
| Usage statistics | 25 months |
| Practices' off-site backups | 14 days, then deleted about a day later |
| Missed-call details | Not stored; passed straight through to your server |
| Daily connection counts for secure addresses | 30 days |
| Internet addresses our servers refused | 7 days |
| Hashed addresses used to limit repeated attempts | 2 days, or with the sign-up or signature they belong to |
| Connection records and error records on our servers | 7 days |
| Our own database backups | Continuous copies 7 days; nightly sealed copies 35 days |
When a practice's subscription ends, it can still sign in for 30 days to export its own Diastema records, as our terms describe. After the periods above, we delete the information or keep it only in a form that can't identify anyone.
11. Your rights and choices
We offer everyone these choices, whether or not a law requires us to. You can ask us to:
- tell you whether we hold information about you, and give you a copy
- correct information that's wrong
- delete information about you
- give you your information in a format you can take elsewhere
- stop any marketing email
These choices cover information we hold about you, not a practice's patient records (section 6) or records a practice needs us to keep for its account. We will answer within 45 days. We may need to confirm who you are first, and we may keep what the law requires us to keep, such as billing records and signed agreements. If we turn down your request, you can appeal by replying to our answer, and we'll respond within 60 days. If you're still not satisfied, you can contact your state attorney general; in Texas, that's the Office of the Attorney General.
We don't sell personal information, including sensitive information, and we don't use it for targeted advertising.
Some things can't be turned off while you use Diastema: service emails about your account, and the status reports and usage statistics your server sends while it's connected to our services.
Cookies. Our website sets no cookies. The Diastema software on your practice's server uses cookies only to keep your staff signed in and to remember devices your practice has approved. Your own server sets them, for your office's own address, and they're never used for tracking.
Children. Diastema is for dental businesses and isn't directed to children. We don't knowingly collect information from children under 13, apart from patient information a practice holds in its own systems, including information about minor patients, which section 6 covers.
Changes to this policy. We'll post any change here and update the effective date. For a change that matters, we'll email account contacts at least 30 days before it takes effect. Changes to the list of providers in section 8 take effect when we post them.
Contact us. Email privacy@diastema.app, reply to any email we've sent you, or write to Diastema LLC, 3088 Basswood Blvd STE 150, Fort Worth, TX 76137. You can also use the sign-up form at diastema.app and say it's about privacy: we won't treat it as a sales inquiry, and once we've answered, we delete the request record, apart from a note that we responded.