Privacy Policy

1. Who operates the Service

Operator: TouchApp Inc., Delaware, United States.
Address: 16192 Coastal Highway, Lewes, DE 19958, United States.
Legal, privacy and support contact: support@plastictou.ch.

TouchApp Inc. operates PlasticTouch. This policy covers Bridge, Website, waiting-room TV, AI receptionist and Inbox features, the separate 3D catalog and purchasing/download workspace, and related supported apps. Sharing a login does not merge product subscriptions or give one practice access to another’s data.

For account, billing, security and our own platform operations we determine the processing purpose. For practice-controlled visitor enquiries, content and assistant configuration, the practice determines its use and must provide its own notices and lawful basis; we process that information to deliver its selected features. The precise responsibilities may also be set out in an applicable data-processing agreement. Do not assume a healthcare-compliance agreement exists merely because you have an account.

2. Information we process

• Accounts: name, email, sign-in identity, profile and authorized agency/client relationships.
• Practice content: business/contact/location/hours information, services, team, FAQ, websites, testimonials, uploaded photos and videos, before-and-after images, and settings.
• Purchases: product, license scope, entitlements, invoice/payment references, subscription status and legal acceptance records. Stripe handles payment credentials; we do not store full card numbers.
• Receptionist and Inbox: chat text, timestamps, conversation identifiers, provided visitor details, enquiries, booking requests and reviewed/unread state. Voice integrations may process audio, transcripts, call metadata and recordings according to enabled settings and provider operation.
• Usage and technical data: device/browser information, IP addresses, security/server logs, consent preferences and supported activity events, such as page views, clicked links and playback. Separate Bridge and Website reporting identifies the channel of recorded events; it does not reconstruct earlier traffic.
• 3D: previews, license purchases, access/download records and supported library activity. These are distinct from a practice’s patient enquiries.
• Optional integrations: connected account identifiers, authorized access tokens and content required for the feature you enable, such as Instagram updates, notifications or booking integrations.

3. Purposes and lawful bases

We use data to provide purchased features, verify licenses and payments, operate saved assistant settings, route enquiries, maintain shared practice review status, support customers, prevent fraud, secure the service and meet legal/accounting obligations.

Where GDPR or comparable law applies, relevant bases may include performing a contract, legal obligations, legitimate interests in secure and reliable operation, and consent for optional tracking or another processing activity that requires it. Special-category or healthcare information requires an additional lawful condition and suitable safeguards; a subscription alone is not that condition.

We do not sell uploaded patient imagery or conversation transcripts as stock content. Publishing a page or choosing to share content may make it accessible to visitors; the practice must review what it publishes.

4. AI, practice access and simulated conversations

When an AI feature is used, the applicable provider receives the saved practice knowledge and the text, audio or media needed for that request. AI outputs may be incorrect. Provider terms, feature settings and any applicable agreement govern their handling and retention; this policy does not promise zero retention or prohibit every provider use independently of those terms.

Authorized practice users and authorized agency users may view the practice’s Inbox and enquiries. Read status is shared within that practice; later visitor messages may require review again. Linking an enquiry to a conversation does not imply that other conversations from that visitor produced the enquiry.

Use simulated data in assistant tests. Test requests still go to the applicable AI provider and may use allowances. Whether a testing surface separates its conversations from patient records is described by that interface; a test label is not permission to enter sensitive real-patient data.

We are not a medical-record platform and do not claim default HIPAA certification or a default business associate agreement.

5. Providers and recipients

Data is provided only as needed for the enabled feature, account/payment operation or lawful purpose. Current integrations include:

• Supabase: account authentication, session/identity data and database operations used by the Service.
• Cloudflare R2 / Stream: storing, delivering, encoding and playing uploaded media and animation assets, with associated technical delivery information.
• Stripe: payments, subscriptions, invoices, fraud controls and billing-portal operations; Stripe receives billing/payment information under its own terms.
• OpenAI: AI chat, relevant text/translation and enabled generation requests, with the input and practice context needed to respond.
• Vapi and its connected voice providers: enabled voice/phone reception, call audio, transcripts, metadata and configured tools.
• Resend: transactional emails, recipients and message content, including practice enquiry notifications where configured.
• Google: optional Google sign-in; Analytics/AdSense and supported reporting integrations where enabled, with associated identity or activity/device data.
• Meta: authorized Facebook/Instagram integrations and optional marketing-pixel events, according to connected permissions and consent settings.
• OneSignal / web-push services: opted-in notification delivery, subscription/device identifiers and notification content.
• Replit: hosting and operational logs where the application is hosted on its infrastructure.
• Browserless: content and technical information needed for enabled browser-based rendering or export operations.

A practice’s own booking system, social network, WhatsApp or linked website is a separate destination with its own policy. We may also disclose data to professional advisers, authorities where legally required, or a successor as permitted by law and with appropriate safeguards.

6. Cookies, analytics and advertising

Essential session/security storage, consent preferences and supported local interface state are used for service operation. Optional analytics and marketing are controlled through our consent settings where applicable. Advertising or measurement integrations may receive device and event information according to their settings and your choices; not all pages or account types display advertising.

See the Cookie Policy and Cookie Preferences. Rejecting optional analytics/marketing does not cancel a purchased license. Browser or provider privacy settings and notification permissions remain separate controls.

7. Connected accounts

If you connect Instagram/Facebook or another supported service, we use the permissions and content needed for the feature you enable. Disconnect using the product’s integration controls or revoke permission with the provider. Disconnecting does not automatically delete every previously published copy, invoice or security record. Contact support for deletion requests; retention exceptions and provider policies may apply.

8. Retention and deletion

We retain account, practice and feature data for as long as needed to provide the service and fulfill the relevant purpose. Chat, enquiry and voice records are not promised to disappear automatically after a fixed 90-day or 12-month timer. Retention depends on the feature, account status, practice needs, provider settings and applicable obligations.

Subscription cancellation alone does not delete content or revoke perpetual licenses. Request account closure, deletion or an appropriate export through support. We verify the requester’s identity and authority, then act within the time required by applicable law. Payment, tax, acceptance, fraud/security and dispute records may need to be retained after account closure. Backups and provider-held data follow their applicable retention arrangements.

A practice visitor should normally direct requests about that practice’s enquiry or published content to the practice; we can assist the authorized practice as appropriate. Do not include sensitive clinical information in an initial support email.

9. Security and international processing

We use access controls, authenticated workspace boundaries and appropriate technical and organizational measures to protect information. No network or storage system is guaranteed secure. Signed media links and watermarks are access/content protections, not a promise that publicly published content can never be copied.

Processing may occur in the United States and other countries where providers operate. Where applicable law requires safeguards for international transfers, the appropriate arrangements must apply. We do not claim EU-only hosting or a particular certification merely because a provider offers it.

10. Your rights

Depending on applicable law, you may request access, correction, deletion, portability, restriction, object to qualifying processing, or withdraw consent without affecting earlier lawful processing. You may complain to a competent supervisory authority. Mandatory privacy rights remain available regardless of the Delaware contract-law clause.

Contact support@plastictou.ch. We may need to verify identity and practice/agency authority. Rights may have lawful limitations, including required financial/security retention and another person’s rights.

11. Children and sensitive data

Purchasing and practice-management accounts are intended for adults. The service is not directed to children under 13. Practices must apply appropriate safeguards and permissions for minors’ content or enquiries and must not use a public assistant as a channel for regulated clinical records.

12. Changes and contact

The date and version identify this policy. We will communicate material changes where required by law. Product separation does not itself authorize a new use of previously collected data.

Operator: TouchApp Inc., Delaware, United States.
Address: 16192 Coastal Highway, Lewes, DE 19958, United States.
Legal, privacy and support contact: support@plastictou.ch.