Privacy Policy

This Privacy Policy explains how [Yafa Fix legal entity name] (“Yafa Fix,” “we,” “us”) collects, uses, and shares information when you use the Yafa Fix web application and mobile apps (collectively, the “Service”). Yafa Fix is a service-operations platform used by dental practices and our field technicians to manage equipment maintenance, service requests, loaner devices, invoices, and payments.

1. Information we collect

We collect the following categories of information:

• Account information — your name, email address, phone number, profile photo, role, and the office/practice you belong to.
• Practice & service data — practice and branch details, service requests, equipment records, maintenance schedules, loaner reservations, and photographs taken during a visit.
  Photographs are of equipment. Our technicians are instructed not to photograph patients, screens, charts, schedule boards or anything else that could identify a patient. If you believe such information has been captured, tell us and we will remove it — see section 10.
• Location data — Yafa Fix field personnel only. While you are clocked in, the app records your position continuously, not only at clock-in and clock-out. Each update includes latitude, longitude, accuracy, heading and speed, and on Android it continues while the app is in the background. We use it to place you on the live operations map, to confirm that a visit happened where and when it was recorded, and to reconstruct a day’s route on a timesheet. Location stops being recorded when you clock out.
  We do not collect location from dental practice staff or managers, and we do not collect it from any customer.
• Sign-in credentials — a one-way hash of your app PIN if you set one, and a flag recording whether you enabled biometric unlock. Your fingerprint or face data never leaves your device and is never transmitted to or stored by us; the device tells the app only whether it recognised you.
• Messages — the content of support conversations and internal messages sent through the app, and comments and notes left on a service request or project.
• Employment records — for Yafa Fix personnel: clock-in and clock-out times, hours by category, pay rate, and expenses you file including any receipt photograph.
• Activity records — an audit log of significant actions taken in the Service (who changed what, and when), retained for security and dispute resolution.
• Payment information — when you pay an invoice, card details are collected and processed directly by our payment processor (Stripe). We never receive or store full card numbers; we retain only a payment record (amount, method, status, and a processor reference).
• Device & notification data — push-notification tokens, device type, and app/usage logs needed to deliver alerts and keep the Service reliable.

2. How we use information

• To provide, operate, and secure the Service.
• To create and route service requests, projects, loaners, invoices, and payments.
• To send transactional messages (e.g., invoice notifications, estimate links, account emails) and push notifications you have not disabled.
• To verify field work and prevent fraud or abuse.
• To provide customer support and respond to your requests.
• To comply with legal obligations and enforce our Terms.

3. How we share information

We do not sell your personal information. We share it only as needed to run the Service:

• Within your organization — staff and managers in your office see the requests, invoices, and people associated with that office, according to their role and permissions. Office staff cannot see financial data unless granted access.
• Service providers (subprocessors) — we rely on Supabase (database, authentication, and file storage), Stripe (payment processing), Resend (transactional email), Google Firebase Cloud Messaging (push notifications), and Google Maps (map display). Each processes data only on our instructions.
• Legal & safety — when required by law, or to protect the rights, property, or safety of Yafa Fix, our users, or the public.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

4. Data retention

We retain information for as long as your account is active and as needed to provide the Service, comply with our legal and tax obligations, resolve disputes, and enforce our agreements. You may request deletion of your account as described below; some records (e.g., invoices and payments) may be retained where required by law.

5. Security

We protect information using row-level access controls scoped to your office, encryption in transit, and least-privilege access for our staff. Payment card data is handled entirely by Stripe (PCI-DSS Level 1). No method of transmission or storage is 100% secure, but we work to protect your information and continuously improve our safeguards.

6. Your rights & choices

• Access & correction — you can view and update most profile information in the app, or contact us for help.
• Notifications — you can disable push notifications in your device settings or your in-app notification preferences.
• Deletion — you may request deletion of your account and associated personal data by contacting us.
• State privacy rights — depending on your U.S. state of residence, you may have additional rights to access, delete, or limit the use of your personal information. We honor verified requests as required by applicable law.

7. Location, for the people it applies to

If you are a Yafa Fix technician or field worker, this section is about you. If you work at a dental practice, it is not — we do not collect your location at all.

• When — only while you are clocked in. Clocking out stops it. There is no collection outside a shift.
• What — position, accuracy, heading and speed, recorded continuously rather than at the start and end of a visit.
• Why — to show the operations map, to confirm a visit happened where and when it was recorded, and to build the route shown on a timesheet.
• Who sees it — Yafa Fix staff whose role includes dispatch or timesheet review. Dental practices never see where a technician is or has been.
• Turning it off — you can withdraw the operating system permission at any time in your device settings. Doing so stops collection; it may also stop features that depend on it, such as clocking in at a site.

8. Dental practices, patients and HIPAA

Yafa Fix services equipment. It is not a patient record system, it is not a practice-management system, and it is not designed to receive protected health information.

• We do not ask for, and the Service has no field for, patient names, appointments, treatment or any clinical record.
• Technicians work inside treatment rooms and photograph equipment. They are instructed not to photograph patients, screens, charts or schedule boards. If patient information reaches us incidentally, we treat it as a mistake to be corrected rather than data to be kept: tell us and we will delete it.
• If your practice requires a Business Associate Agreement before a vendor may work on premises or receive any information from you, contact us at the address in section 12 and we will address it before work begins.

9. Children’s privacy

The Service is intended for business use by dental practices and Yafa Fix personnel and is not directed to children under 13. We do not knowingly collect personal information from children.

10. International users

The Service is operated from the United States. If you access it from outside the U.S., you understand your information will be processed in the United States, where data-protection laws may differ from those in your country.

11. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here and revise the “Last updated” date. Material changes will be communicated through the Service or by email.

12. Contact us

Questions about this Policy or your information? Contact us at [privacy@yafafix.com], or by mail at [Company mailing address, Virginia, USA].