Pilot documents — Draft 0.1 — 2026-09-19
Privacy notice — DRAFT
What the public website and the pilot Project Workspace collect today, why, who processes it, how long it is kept, and how to ask about it. Written to match how the pilot actually operates on 2026-09-19. It will be revised before any real client uses the workspace.
Who is responsible. Zachary Bowman, a sole proprietor, [Address], operating as Build My Dental Office from Columbus, Ohio. Privacy requests: hello@buildmydentaloffice.com. General support: hello@buildmydentaloffice.com.
Scope
Three kinds of people.
- Visitors to buildmydentaloffice.com, the public website.
- Architects and firm staff with an account in the Project Workspace at staging.buildmydentaloffice.com. Accounts are created by BMDO or by a firm's owner; there is no public sign-up.
- Clients and contractors invited by an architect to review one released version of one project.
Inventory
What is collected today.
This list is drawn from the workspace's data model and access-log configuration as they exist on 2026-09-19. If a feature is not built yet, it is not on the list.
- Public website
- No account and no form is submitted to a BMDO server. The contact form composes an email in your own mail application. There are no analytics, advertising or tracking scripts. The interactive 3D viewer loads its rendering library from the jsDelivr CDN, which receives your IP address as any web request does. The site is served by Amazon CloudFront; access logging is not enabled on the public site's distribution.
- Account details
- Email address, firm name and role (owner, architect or operator), plus the identifier the sign-in service assigns. Amazon Cognito sends the temporary-password email when a firm's owner invites a team member.
- Project records
- Project title, client name, location, stage, reference and summary, as typed by your firm's architects. These may include the names of dental practices and their owners.
- Invitations
- The recipient's email address and name, whether they are a client or a contractor, the capabilities granted, the expiry date, and a one-way digest of the invitation token. The invitation link itself is shown once to the architect and is not stored.
- Comments
- The text and the author, visible to the project's staff and, for comments made on a shared project, to the invited recipients.
- Activity feed
- Who did what and when: project created or archived, invitation created or revoked, comment posted, team or billing change.
- API access logs
- Time, method, path, status code, latency and request id for each request to the workspace API. No cookies, query strings or request bodies are recorded, so no session token or sign-in code can appear in a log.
- Billing
- Stripe customer id, subscription id, plan, billing interval, status and current period end, and a ledger of processed Stripe event ids. Card details are entered on Stripe-hosted pages and never reach BMDO. When Stripe is not configured the workspace stores a labelled “demo” record and no payment occurs.
- Plan sets and drawings
- The workspace does not yet accept plan-set uploads. Drawings sent for a pilot conversation arrive by email and are handled by hand. This notice will be revised before uploads are used with real clients.
- Email you send us
- Messages to the address in the footer are kept in that mailbox. Support and privacy mail goes to hello@buildmydentaloffice.com.
Purpose
Why it is collected.
- To provide the service: sign you in, show your firm its projects, deliver an invitation to the person the architect named, and show a recipient the one release they were invited to.
- To keep it secure: sessions, the activity feed and the access logs exist so that access can be checked, revoked and reviewed.
- To bill: subscription status decides how many seats and active projects a firm may use.
- To answer you: support and pilot conversations by email.
- There is no profiling, no advertising, and no sale of personal information.
Recipients
Who processes it.
- Amazon Web Services, us-east-1
- Everything the workspace stores is in AWS's us-east-1 region in the United States: Cognito for sign-in, DynamoDB for records, S3 for files, CloudFront and API Gateway to serve requests, Lambda to run the application, CloudWatch Logs for the access log, KMS for encryption keys and SSM Parameter Store for configuration secrets. Storage in AWS alone does not mean data never leaves AWS during processing.
- Stripe
- Payment collection, subscriptions and the customer portal, on Stripe's own pages and under Stripe's own privacy notice. BMDO holds only the identifiers listed above.
- jsDelivr
- Serves the 3D viewer's rendering library to visitors of the public site. It is not used in the workspace.
- Advertising analytics
- None, on the public site or in the workspace.
- AI providers
- No client material is sent to an AI provider by default. Any exception would require the specific permission described in the terms draft and a verified provider agreement. Approved providers for client material at this draft: none.
Retention
How long it is kept.
In place today: a workspace session expires 8 hours after sign-in and its record is then removed; the temporary state used during sign-in expires after 10 minutes. Removing a team member or revoking an invitation ends that access on the person's next request.
Not yet in place: no other automated retention or deletion schedule exists. Project records, invitations, comments, activity and billing records are kept until removed by hand. The proposed schedule for plan sets, deliverables, backups and audit events is published in the terms draft as “Proposed retention (not yet a commitment)”; it becomes a commitment only once it is configured and tested.
Cookies
One cookie, in the workspace only.
- bmdo_session
- Set by the workspace when you sign in or accept an invitation. It holds a random token that identifies your session and nothing else. HttpOnly, Secure, SameSite=Lax; expires 8 hours after it was set, or earlier when you sign out or an invitation's expiry arrives sooner. It is the only cookie BMDO sets.
- Public website
- Sets no cookies.
- Cognito and Stripe pages
- The sign-in page runs on an AWS-hosted domain and the payment pages run on stripe.com; each sets its own cookies on its own domain under its own notice.
Requests
Access, correction, deletion and export.
Write to hello@buildmydentaloffice.com from the email address on your account or invitation, and say which of the categories above you are asking about. BMDO will confirm the request came from that address before acting. Firm owners can remove members and revoke invitations themselves in the workspace, immediately.
Response time: [to be specified]. Rights that depend on where you are: the law of the State of Ohio and of launch markets are to be confirmed by counsel before this notice takes effect.
Deletion of a project covers what the terms draft describes; copies that an invited recipient obtained while their access was valid are outside BMDO's reach.
Patient information
Not for patient records.
The workspace and BMDO's services are for architectural drawings and visualizations of dental offices. They are not for patient records or any other clinical or health information, and the pilot expressly excludes them. The pilot is not marketed as HIPAA compliant, and hosting on AWS does not change that. If the service were ever to handle protected health information, its agreements and safeguards would be reassessed before any such information was accepted.
Changes
Versions and notice.
Version: [Effective date/version]. Material changes are announced to account holders before they apply. Earlier versions stay available, so the text you accepted is never silently replaced. Security controls are described separately on the security page.