Privacy Policy

We collect information you provide directly to us, such as when you create an account, apply for financing, or contact us for support. This includes:

• Identity information: name, date of birth, government-issued ID

• Contact information: email address, phone number, mailing address

• Financial information: income, employment details, bank account information, and credit history

• Health-related information: treatment plans and dental procedure details provided by your dental practice

• Device and usage information: IP address, browser type, pages visited, and other log data

We use the information we collect to:

• Evaluate and process financing applications

• Provide, maintain, and improve our services

• Communicate with you about your account, payments, and updates

• Comply with legal and regulatory obligations

• Detect and prevent fraud and unauthorized activity

• Conduct internal analytics to improve our platform

Dotly handles certain protected health information (PHI) as a Business Associate under HIPAA. We maintain administrative, physical, and technical safeguards to protect PHI consistent with HIPAA requirements. We do not use or disclose PHI except as permitted or required by law and as described in our Business Associate Agreements with covered dental practices.

We do not sell your personal information. We may share your information with:

• Service providers who assist us in operating our platform (e.g., cloud hosting, payment processing, identity verification) under confidentiality obligations

• Dental practices involved in your treatment and financing

• Financial partners and lenders necessary to originate or service your loan

• Regulatory and legal authorities when required by law or to protect our rights

• Successors in connection with a merger, acquisition, or sale of assets, subject to continued privacy protections

We use industry-standard encryption (TLS in transit, AES-256 at rest) and access controls to protect your information. Sensitive fields such as SSNs and account numbers are encrypted at the database level. We conduct regular security assessments and limit data access to employees who need it to perform their job functions.

We retain your personal information for as long as your account is active or as needed to provide services, comply with legal obligations, resolve disputes, and enforce our agreements. When retention is no longer required, we securely delete or anonymize your data.

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you

• Request correction of inaccurate information

• Request deletion of your personal information, subject to legal retention requirements

• Opt out of marketing communications at any time

• Request a copy of your data in a portable format

To exercise any of these rights, contact us at privacy@dotly.health.

We use cookies and similar technologies to remember your preferences, maintain your session, and understand how our services are used. You can control cookie settings through your browser; disabling certain cookies may affect the functionality of our platform.

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected such information, please contact us and we will promptly delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a prominent notice on our website. Your continued use of our services after changes take effect constitutes your acceptance of the revised policy.

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

Dotly, Inc.

privacy@dotly.health