VELscope Mantis App Privacy Policy

Applies to the VELscope Mantis mobile application published by LED Dental Inc.

Effective date: [DATE]  |  Last updated: [DATE]

The VELscope Mantis app is a professional tool used by dental and healthcare providers to capture and organize oral mucosal examination images. Patient images captured in the app stay on the provider's device. LED Dental Inc. does not receive, view, or store them.

1. Who this policy covers

This policy describes how the VELscope Mantis app handles information. It is written for the dental and healthcare professionals who install and use the app.

This policy is separate from the privacy policy for velscope.com, which covers our website, online ordering, continuing education platform, and marketing communications. If you use both, both apply in their own context.

The app is published by:

LED Dental Inc.
580 Hornby Street, Suite 780
Vancouver, BC, Canada V6C 3B6

2. The app is a professional tool, not a consumer app

The VELscope Mantis app is intended for use by licensed dental and healthcare professionals in a clinical setting. It requires a VELscope Mantis device to function. It is not intended for use by patients or by the general public.

If you are a patient and your provider captured images of your mouth using this app, those images are part of your dental record. Your provider, not LED Dental Inc., controls that record. Direct any questions about your images, including requests to see or delete them, to the dental practice that treated you.

3. Roles and responsibilities under health privacy law

In the United States, a dental practice using this app is a Covered Entity under HIPAA. The practice is responsible for the patient information it creates and stores, including images captured with this app, and for obtaining any patient consent its own policies or state law require.

Because patient images and any patient information you enter remain on your device and are not transmitted to LED Dental Inc., LED Dental Inc. does not create, receive, maintain, or transmit protected health information on your behalf through the app, and does not act as a Business Associate in connection with your use of the app.

If you choose to send images from the app to a separate service, that service's terms govern what happens next. Where LED Dental Inc. provides such a service, a separate agreement, including a Business Associate Agreement where one is required, will govern it.

Comparable principles apply outside the United States. In Canada, the practice is the custodian of the patient record under applicable provincial health information legislation and PIPEDA. In the United Kingdom and the European Economic Area, the practice is the data controller for patient images.

4. Information the app handles on your device

Patient images

The app captures white light and fluorescence visualization images of oral mucosal tissue using your device camera through the VELscope Mantis optical assembly. Captured images are written to the app's protected storage area on your device.

Information you enter

You may enter identifiers, labels, dates, and notes to organize images. Anything you type is stored with the images in the same protected storage area on your device. The app does not require you to enter a patient name and does not validate what you type. Practices that prefer to use record numbers rather than names can do so.

Device permissions the app requests

• Camera. Required to capture images.
• Bluetooth. Required to connect to and control the VELscope Mantis device. No patient information is sent over this connection.
• Photos. Requested only if you choose to save an image to your device photo library.
• Notifications. Optional, used for device and app status messages.

You can review or change these permissions at any time in the iOS Settings app. Denying camera or Bluetooth access will prevent the app from performing its core function.

5. Information LED Dental Inc. receives

We do not receive patient images. We do not receive the identifiers, labels, or notes you enter. We have no ability to view, retrieve, or restore them.

We may receive the following, none of which contains patient information:

• Aggregate App Store data from Apple. Apple provides publishers with anonymized, aggregated statistics such as download counts, app version distribution, territory, and device type. We cannot identify individual users from this data.
• Crash and performance diagnostics. If you have enabled sharing of analytics with app developers in your iOS privacy settings, Apple may send us crash logs and performance data. This is controlled entirely by your iOS setting and can be turned off at any time. These reports describe technical failures and do not contain patient images or the information you enter.
• Information you send us directly. If you contact support, register a device, or submit feedback, we receive what you choose to send, such as your name, practice name, email address, phone number, device serial number, and a description of the issue.

Do not send patient images or patient identifiers to our support team. Our support channels are not configured to receive protected health information. If a support issue appears to require an image, contact us first and we will advise on how to proceed.

6. What we do not do

• We do not sell or rent any information.
• We do not share information with data brokers.
• We do not use patient images or your app data for advertising.
• We do not track you across other companies' apps or websites.
• We do not use patient images to train artificial intelligence or machine learning models.
• We do not build user profiles from app activity.

7. Sending images out of the app

The app lets you export or share images so they can be added to the patient record. Exporting is always an action you take deliberately. The app does not send images anywhere on its own.

Once an image leaves the app, this policy no longer governs it. Two consequences are worth understanding:

• Saving to your device photo library moves the image out of the app's protected storage. If your device photo library syncs to iCloud Photos or to another consumer cloud service, the image will sync with it. Most practices should evaluate this before allowing it, since a consumer photo sync service is not typically covered by a Business Associate Agreement.
• Sending an image to email, messaging, cloud storage, or a practice management or imaging platform transfers it to that provider. That provider's privacy terms and your agreement with them govern the image from that point forward.

Choosing where images go, and confirming that the destination meets your obligations, is a decision for your practice.

8. Device backups

Backing up your device to iCloud or to a computer may include the app's stored data, including patient images. iOS backups are encrypted, but the practice remains responsible for deciding whether its backup configuration is appropriate for patient information. Your organization's IT or compliance lead should make this call.

9. Security

App data is stored in the app's protected storage area and is subject to iOS file protection, which encrypts data at rest on the device. That protection depends on your device being secured.

To protect patient information, we recommend that practices:

• Require a passcode, Face ID, or Touch ID on every device running the app.
• Keep iOS and the app updated.
• Enable Find My iPhone so a lost device can be located or erased remotely.
• Manage practice-owned devices through mobile device management where available.
• Avoid installing the app on shared or personal devices that are not under practice control.
• Delete images from the app once they have been transferred into the permanent patient record.

No security measure is absolute. If a device holding patient images is lost or stolen, the practice is responsible for assessing and reporting the incident under HIPAA or applicable local law. LED Dental Inc. cannot remotely access or erase app data.

10. Retention and deletion

Because we do not receive your app data, we do not retain it. You control retention entirely:

• Images and notes remain on your device until you delete them.
• You can delete individual images or a patient's full set from within the app.
• Deleting the app from your device removes the app's stored data from that device. This cannot be undone, and it will not remove copies you previously exported elsewhere or copies contained in a device backup.

Support correspondence and device registration records are retained for as long as needed to support the product and to meet our legal, warranty, and regulatory obligations.

11. Minors

The app is a professional tool and is not directed to children. We do not knowingly collect information from children through the app.

A provider may examine and capture images of a patient who is a minor. Those images are part of that patient's dental record, are held by the practice, and are governed by the practice's own policies and by applicable law on consent and parental access. They are not transmitted to us.

12. International use

LED Dental Inc. is located in Canada. Because patient images and app data stay on your device, using the app does not transfer patient information across borders.

Support correspondence and device registration information you send us is processed in Canada and the United States, which may have different data protection laws than your country. Where required, we rely on appropriate safeguards for these transfers.

13. Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or restrict the use of personal information a company holds about you, and to be free from discrimination for exercising those rights. These rights include those provided under the California Consumer Privacy Act, other US state privacy laws, PIPEDA in Canada, and the UK and EU General Data Protection Regulation.

Because we do not collect personal information through the app itself, a request to us will generally concern support correspondence, marketing communications, or device registration. To make a request, contact us at the address below. We do not sell personal information, so there is nothing to opt out of on that front.

Requests concerning patient records, including a patient's request to access or delete images, must be directed to the treating dental practice. We cannot act on those requests because we do not hold the records.

14. Third parties

The app is distributed through the Apple App Store. Apple's handling of your download, purchase, and device information is governed by Apple's privacy policy and is outside our control.

The app does not include advertising networks, third-party analytics software development kits, or social media tracking tools.

15. Changes to this policy

We may update this policy as the app changes. The effective date at the top will be revised, and material changes will be noted in the app release notes. Continued use of the app after an update means you accept the revised policy.

16. Contact

VELscope Mantis is an oral mucosal examination and fluorescence visualization tool.