Privacy policy
The short version
- ComplyDay is software for dental offices. We hold your team's accounts, training records, written plans and equipment logs so you can show them to an inspector.
- We never collect patient information, and the service is not built for it. Please don't enter any.
- We don't sell personal information or show ads in ComplyDay. We advertise ComplyDay on Google, and for visitors who come from those ads we measure whether they started a trial or a plan (see Cookies and tracking).
- A few service providers help us run ComplyDay, and each one only handles data to provide its service to us. They're listed below.
- Your office owns its records. You can export them at any time, and you can ask us to see, correct or delete information about you by emailing hello@complyday.com.
This policy explains what information ComplyDay collects, why, who helps us handle it, and the choices you have. It covers complyday.com and the ComplyDay app. "We" and "us" mean Rivvs LLC, which operates ComplyDay. "Your office" means the dental practice that holds the subscription.
What we collect
We collect only what we need to run the service.
| Category | Examples | Where it comes from |
|---|---|---|
| Account details | Name, work email address, job title, role in the office (owner, admin or staff) | You, or the office manager who invites you |
| Office details | Practice name, state, address, number of staff, and your answers to the plan questionnaire (for example, the sterilizers, sharps devices and chemicals you use) | Your office |
| Training records | Courses assigned, lesson progress, quiz answers and scores, completion dates, certificates, and in-person training your office records | Created as staff use the courses, or entered by your office |
| Messages to trainers | Questions staff send to a trainer during a course, and the trainer's replies | Staff and our trainers |
| Written plans and records | Exposure control plan, hazard communication program, HIPAA policies, risk assessment, business associate list, chemical list and the other plans you create | Your office, using ComplyDay |
| Logs | Sterilizer cycles, spore tests, Bowie-Dick tests, equipment and maintenance entries, and who logged each one | Staff in your office |
| Employee health records | Hepatitis B vaccination or declination status, and sharps injury entries | Your office (see below) |
| Billing details | Plan, billing period, subscription status and the billing email. Card details go directly to Stripe; we never see or store full card numbers | You and Stripe |
| Support emails | What you write to us at hello@complyday.com | You |
| Technical information | IP address, browser type and request logs kept by our hosting and database providers to run and secure the service | Your browser |
Employee health records
OSHA requires dental offices to keep certain employee records, such as hepatitis B vaccination status and sharps injuries, confidential. In ComplyDay only the office's owners and admins, and the employee the record is about, can see them. They are not included in the inspection binder that staff can open.
What we never collect: patient information
ComplyDay does not need, request or store patient information, also called protected health information (PHI), such as patient names, dates of birth, chart numbers, treatment details or insurance information. The service is not designed to hold PHI, and you agree not to enter it anywhere in ComplyDay, including in notes, log entries, messages to trainers or uploaded files.
Because we don't create, receive, keep or send PHI for your office, ComplyDay is not a business associate under HIPAA and we don't sign business associate agreements. If PHI is entered by mistake, tell us at hello@complyday.com and we'll help you remove it.
How we use information
- To provide the service: sign you in, assign and track training, write and store your plans, keep your logs, and print your inspection binder.
- To send service emails: sign-in links, invites, training and review reminders, failed test alerts, and replies from trainers.
- To bill your subscription and keep billing records.
- To answer your questions and give support.
- To keep ComplyDay secure, prevent abuse and fix problems.
- To improve the service, using information about how features are used. We don't use your office's records to train artificial intelligence models.
- To meet legal obligations, such as tax records, and to enforce our terms.
We don't sell personal information, share it for cross-context behavioral advertising, or show ads in the service.
Who we share it with
- People in your office. Owners and admins can see the team's training status, logs, plans and records. Staff see their own training, the office's logs and plans, and their own health records. The details depend on each person's role.
- Our trainers. The trainers who answer questions during courses see the questions sent to them, the name of the person asking, the office name and the course.
- Service providers who run parts of ComplyDay for us, listed in the next section.
- When the law requires it, for example a valid subpoena or court order. Where we're allowed to, we'll tell your office first.
- If ComplyDay is sold or merged, information may move to the new owner, who must keep honoring this policy. We'll email account owners before that happens.
Service providers
These companies process information on our behalf. Each one handles it only to provide its service to us, under its own security and privacy commitments.
| Provider | What it does for us | Information involved |
|---|---|---|
| Vercel | Hosts the website and app, and counts marketing page visits | Requests to the site, IP addresses, everything shown in the app as it's delivered, anonymous page view counts |
| Supabase | Database, sign-in and file storage | All account, training, plan, log and record data |
| Stripe | Payments and subscriptions | Billing name, email, address, card details and payment history |
| Resend | Sends sign-in and invite emails | Email address and the email's contents |
| Mango Mail | Email for hello@complyday.com and app notifications sent from it | Email address and the email's contents |
| Google Ads | Measures which of our Google ads lead to a trial or a paid plan | Only for visitors who arrive from one of our Google ads: the ad click ID, your IP address and browser details, and whether you started a trial or paid, with the plan's price. No names, email addresses or office records. |
| Google Fonts | Serves the typefaces on our marketing pages | Your IP address and browser details when a marketing page loads the fonts |
We'll update this list before we add a provider that handles your office's records.
Cookies and tracking
We use cookies to keep you signed in to the app and to finish a checkout. These are needed for the service to work.
We count visits to our marketing pages with Vercel Web Analytics. It sets no cookies and doesn't identify you: it records the page, the referring site, and your country, browser and device type, and counts unique visitors with a hash that resets every day.
Ad measurement. We pay for ads on Google. If you arrive at our site from one of those ads (or from a link with campaign tags), we save the ad click ID and campaign details in a first-party cookie for 90 days. If you then start a plan, we store those details with your subscription at Stripe, so we can see which ads lead to customers. For visitors who came from a Google ad, and only for them, our pages also load the Google Ads tag, which sets Google's own measurement cookies, and we tell Google when a trial starts and when the first payment goes through, with the plan's price. We turn off ad personalization for this tag: we don't build remarketing lists or show you ads based on your visit. Visitors who didn't come from a Google ad never load a Google Ads script. You can block or delete these cookies in your browser at any time; the site works without them.
Information your office controls
Your office decides who to invite and what to record, so it controls the records in its account. If you're a staff member and want information about you changed or removed, ask your office manager first. We'll also help if you email us, and we may need to check with your office, because some records (such as training records) are ones OSHA requires the office to keep.
How long we keep it
- While your office subscribes, we keep its records so you can show them to an inspector. OSHA asks offices to keep training records for 3 years, and HIPAA asks for 6 years for required documentation. Keeping them for those periods is your office's responsibility, and you can export them at any time.
- After your office cancels, we keep its records for 90 days so you can export them, then delete them. Copies in our providers' backups are removed within a further 30 days.
- Removed staff. When an office removes someone, their training records stay with the office, because the office needs them for its records.
- Billing records are kept as long as tax and accounting rules require.
- Support emails are kept as long as they're useful for helping you, and no longer than 3 years.
How we protect it
- All traffic to ComplyDay is encrypted in transit with HTTPS.
- Our database and file storage providers encrypt data at rest.
- Each office's records are separated by access rules in the database itself, so a signed-in user can only reach records of the office they belong to, and only what their role allows.
- Sign-in uses one-time email links, so there are no ComplyDay passwords to steal or reuse.
- Logs are append-only: entries are corrected with a new entry, not changed or deleted.
- Our own access to production data is limited to what we need to run and support the service.
No system is perfectly secure. Keep your email account secure, because access to it gives access to ComplyDay sign-in links.
If something goes wrong
If we learn that someone accessed your office's information without permission, we'll email the account owners without unreasonable delay, say what happened and what we're doing about it, and meet any notice rules that apply.
Your choices and rights
Wherever you live, you can ask us to:
- tell you what personal information we hold about you and give you a copy,
- correct information that's wrong,
- delete information about you, subject to records your office must keep, and
- stop sending you emails that aren't needed for the service.
Email hello@complyday.com from the address on your account. We'll reply within 30 days. We won't treat you differently for asking.
Service emails such as sign-in links and failed test alerts are part of the service. Office admins can change which reminders are sent in the app's settings.
State privacy rights
Some states, including California, give residents rights over their personal information. ComplyDay is a small business, and these laws may not apply to us yet. We still honor the rights above for everyone. We don't sell or share personal information for advertising, and we don't use sensitive personal information to infer characteristics about you. You can use an authorized agent to make a request; we may ask for proof that the agent may act for you.
Children
ComplyDay is for people who work in dental offices and is not meant for anyone under 18. We don't knowingly collect information from children. If you think a child has given us information, email us and we'll delete it.
Where data is stored
ComplyDay is offered to offices in the United States. Our providers store and process data in the United States. If you use ComplyDay from outside the United States, your information will be handled in the United States.
Changes to this policy
If we make a material change, we'll email account owners at least 30 days before it takes effect, and update the date at the top. Small changes, such as fixing wording, take effect when posted.
Contact us
ComplyDay is operated by Rivvs LLC, a New York limited liability company. Mail: Rivvs LLC, 418 Broadway, Ste R, Albany, NY 12207, United States. Questions about privacy, or a request about your information: hello@complyday.com or (646) 687-9874.