# Privacy Policy: Mandible

URL: https://mandible.io/privacy-policy

> How Mandible collects, uses, and protects information.

# Mandible Privacy Policy

**Effective date:** December 1, 2026

This updated policy applies to new users from the date we publish it and to existing users from December 1, 2026.

This Privacy Policy explains how Mandible, Inc., the company that operates Mandible ("Mandible," "we," "us," or "our"), collects, uses, and shares information in connection with the Mandible applications, websites, and related services (the "Services"). The Services are built for dental professionals. By using the Services, you agree to this Privacy Policy and our Terms of Service.

**Summary** (the full policy controls):

-   We collect the information you give us (profile, credentials, cases, posts) and basic usage and device information.
-   Mandible is a no-PHI platform. Clinical content you post must already be de-identified, and identifiable patient information is not allowed.
-   AI features process what you submit to them in order to generate suggestions for your review. They run on Google Cloud, and Google's terms say it will not train its AI models on your content without our permission.
-   We develop and improve our own AI using only de-identified data. We do not use identifiable information to train AI models, and we do not sell your personal information.
-   You can view and update your information, and you can delete your account. Deleting your account deactivates it but does not erase everything. Section 6 says what we remove, what we keep, and why.
-   Material changes to our data practices apply going forward, not retroactively.

## 1\. Information We Collect

**Information you provide:**

-   Account and profile information: name, preferred first name, handle, email address, phone number, password, professional credentials and affiliations (such as position, education, residency, and license or NPI information you choose to provide), profile photo, bio, and the city, state, work locations and home or mailing address you enter.
-   Credentials and continuing education: the licenses, certifications and other credentials you add, with their numbers and expiry dates, and your CE records and certificates.
-   Content you create: cases and case information (titles, descriptions, images such as radiographs, procedure codes, tooth charting information, captions), comments, messages, posts in spaces, files you save in Mandible Files, and your confirmations or corrections of AI suggestions.
-   What you send to AI features: your messages to DA-3, our assistant, and the files and text you put in Drop.
-   Information about other people: the email address or phone number of a colleague you invite.
-   Communications with us, such as support requests, bug reports (which can include a screenshot of the screen you were on), content reports, and information you submit on our waitlist or signup forms, including your NPI and photo.
-   Joining through an invite: if you apply through a member's link, your first and last name, email address, role, state and, if you choose, your NPI. We also record who invited you and the short reason any member gives when vouching for you. If you use a dental school email, we send a code to confirm it. A dentist who adds a team member gives us that person's name and email address.
-   Referrals: the colleagues you list as people you refer patients to, and any leaderboard name you set.
-   Sign-in information: if you sign in with Apple or Google, the name, email address and, for Google, profile picture that the provider shares with us.
-   Payment information, if you purchase paid features: payments are processed by our payment processor (Stripe); we receive transaction records but do not store full card numbers.

**Information collected automatically:**

-   Usage information: pages and features used, actions taken, and interaction with content. We store these usage events on our own systems.
-   Device and technical information: IP address, device and browser type, operating system, app version, identifiers needed to deliver push notifications, and log data.
-   Location: we do not collect your device's precise location. We use the city, state and work locations you enter. If you use CE Drop to add course photos, the app reads each photo's capture time on your device. On iPhone it also turns the coordinates stored in the photo into a city and state, using Apple's geocoding service, and it sends us the time and the city and state, not the coordinates. Photos you add to cases have embedded location data removed when they are uploaded. Other files you upload, including files you add through Drop, are stored as you provide them and can contain any location data saved in the file.
-   Join checks: when you apply through an invite link, we keep a salted hash of your IP address to detect members inviting themselves. We clear these hashes about 90 days after you join. If we confirm that an account is impersonating someone, we keep hashes of its email address, NPI and phone number to stop it rejoining.
-   Error and performance data: crash reports and diagnostics that help us fix problems.

We do not ask for, and you must not submit, identifiable patient information. Clinical content must be de-identified before posting, as described in our Terms of Service.

## 2\. How We Use Information

-   **To provide and operate the Services:** accounts, profiles, case sharing, community features, messaging, notifications, and support.
-   **To provide AI features:** when you use an AI feature, what you submit is processed to generate output for your review. AI suggestions are administrative assistance only; you review and confirm or correct them. Our AI features are:
    -   DA-3: reads your messages and the case and account information it needs to answer you. We store your DA-3 conversations with your account.
    -   DA-3 memory: DA-3 can remember short professional facts about you. It asks you to confirm each one and refuses anything that looks like patient information. You can ask DA-3 what it remembers and ask it to forget.
    -   Drop: reads the files and text you put in so it can sort and file them. It refuses an item that looks like patient information.
    -   CE certificates: reads a certificate you add and drafts the course title, hours, date, instructor and sponsor. Nothing counts until you confirm it.
    -   Export check: when you export a case photo, reads the image to detect text in it. It reports only whether text was found and how many areas.
-   **To create and use de-identified data:** we may create de-identified versions of content by removing identifier categories and screening images for embedded identifying information. We use de-identified data for research, analytics, benchmarking, service improvement, and the development and training of machine-learning models and new features. **We do not use identifiable information to train AI models.**
-   **To communicate with you:** service messages, notifications you have enabled, and product updates. You can manage notification preferences and opt out of non-essential communications.
-   **To keep the Services safe:** security, fraud and abuse prevention, reviewing reports, enforcing our Terms, and verifying professional credentials.
-   **To improve the Services:** internal analytics, debugging, and research on how features are used.
-   **To comply with law** and to establish, exercise, or defend legal claims.

## 3\. How We Share Information

We do not sell your personal information, and we do not share it with third parties for their own advertising.

-   **Other users:** your profile and the content you post are visible to other users according to the feature you use and your sharing settings. Community content should be treated as not confidential.
-   **Public profile:** if you turn on your public profile, anyone with the link can see your name, handle, photo, position, city and state, bio, degrees, education and training, practice and school names with your role at each, your case count, and a Licensed dentist badge if you have one. It does not show your email address, phone number, NPI or cases.
-   **Link previews:** when a Mandible link is pasted into a message or another app, that app can fetch a preview without signing in, and it may keep its own copy. A link to an unpublished case, or to a case in a private or locked space, shows only a generic title and description. A link to a case published to the feed shows the CDT catalog name of the procedure on its first tagged photo and the tooth number, and it shows your name and position only if your public profile is on. A preview never shows your case title or description, and previews do not include case photos. A profile link shows only your handle unless your public profile is on; then it shows your name, position and photo. An invite link can show the name of a public space, and the inviter's name if their public profile is on.
-   **Invites and referrals:** while you apply through an invite, the member who invited you and up to five members who open your vouch link see your name and the role you claimed. A referral you list is private to the two of you; the colleague can see it and can hide it from their own list. The referral leaderboard shows other members a name you chose or, if your school or practice has at least five members, "A member at" that group, with your counts of active invites and cases shared.
-   **Case cards in Messages:** if you share a case through our iMessage app, you send a card that shows the same kind of information as a link preview.
-   **Service providers:** companies that process information on our behalf:
    -   Google Cloud Platform: hosting, storage, databases, and AI. AI requests go to Google's Vertex AI service through its standard endpoint. Google's terms say it will not use this data to train or fine-tune AI models without our permission or instruction. Google may briefly cache requests and may log a request its systems flag for possible abuse.
    -   Google Maps Platform (place search and geocoding); OpenStreetMap (map tiles, which receive your IP address).
    -   Google Workspace: sends our email. It receives your email address and the message.
    -   OneSignal: push notifications. It receives your account ID, your email address, your device's push identifiers and technical details its SDK collects from your device. Apple Push Notification service, Firebase Cloud Messaging and your browser's push service carry each notification to your device.
    -   Sentry: error and crash reporting from the app.
    -   Stripe: payment processing.
    -   Apple App Store, Google Play and RevenueCat: if in-app subscriptions are offered on your device, the store takes the payment and RevenueCat records the subscription. RevenueCat receives a random ID, not your name or email address.
    -   Apple and Google sign-in: if you use Sign in with Apple or Sign in with Google, that provider confirms who you are.
    -   Google Drive: if you import from or save to Google Drive on the web, you sign in to Google, and Mandible can reach only the files you pick or save.
    -   Slack: internal team notifications. These can include a waitlist applicant's name, email address and NPI, and a member's name, state and space names.
    -   Linear: the bug reports and feature requests you send us, with technical diagnostics. Reports carry your user ID, not your email address.
-   **NPI lookups:** when you enter an NPI, or DA-3 or a connected assistant looks one up, we send the number to the federal NPI registry (NPPES), a public government database.
-   **De-identified and aggregated information:** we may use and share information that does not identify you or any patient, such as aggregate statistics and de-identified datasets, as described in Section 2 and our Terms of Service.
-   **Legal and safety:** if required by law or legal process, or to protect the rights, safety, or property of Mandible, our users, or the public.
-   **Business transfers:** in connection with a merger, acquisition, financing, or sale of assets, with notice to you and subject to this policy's commitments, including the prospective-only rule in Section 10.

## 4\. AI Assistants and Connected Apps

You can connect your Mandible account to an AI assistant, such as ChatGPT or Claude, that supports the Model Context Protocol. Nothing is shared until you approve the connection on Mandible's consent screen. That screen gives a short description of each permission the assistant is asking for, and you allow or deny the whole request. This section gives the full detail of what each kind of connection can read. Every connection is read-only: a connected assistant cannot change, send or delete anything.

**Apps listed in an AI directory.** An app you add from an AI assistant's directory can read only your own records and events you can see, and only the categories on the consent screen you approved: your profile (name, preferred first name, handle, position, city, state and country, NPI, school, training years, years in practice and residency program), your licenses and credentials (type, issuing state, expiry, with license and DEA numbers shown as the last four digits only), your continuing-education hours and renewal readiness, your memberships, the spaces you belong to, and events you can see. One tool looks up a public record in the federal NPI registry for a number you provide. A directory app cannot read your cases, images, messages or files.

**Adding Mandible by URL.** If you add Mandible to an assistant yourself as a custom connector, using its URL, the assistant can also ask for read access to: your own cases (titles, descriptions, tags, treatments, dates, image captions and tooth numbers, and which spaces each case is shared into, but not images), the discussion on your cases, including other members' comments and names, the names and details of your Mandible Files (not their contents), your competency progress, the spaces you administer with their members' names and roles, and colleagues' public profiles (only people who chose to be discoverable, and never their email). It can also read your bio, the descriptions of your spaces and of events you can see, and the public details of spaces listed in Discover, and look up CDT codes. Allow the request only if you are comfortable with everything it can read. Connected assistants cannot read your messages.

**What we keep.** We record each request a connected assistant makes: which app, which tool, the permission it used, the item it asked for when there is one, the time and whether it succeeded. We do not record your questions, the assistant's answers, or the data returned. We never receive your conversation with the assistant.

**What the assistant's provider does.** Information Mandible returns to an assistant is handled by that assistant's provider (for example OpenAI or Anthropic) and is governed by that provider's own terms and privacy policy. Mandible does not sell this information or use it for advertising.

**Disconnecting.** You can disconnect an assistant at any time in Mandible under Settings > Connected apps. It stops working on its next request. Access also lapses on its own: access tokens last one hour, a connection unused for 14 days stops, and every connection stops after 30 days. To renew it, the assistant must send you back through Mandible in your browser. The consent screen appears again if the assistant asks for something new or you disconnected it.

## 5\. Your Choices and Rights

-   **Access and update:** you can view and edit your profile and content in the app. To ask for a copy of your information, email team@mandible.io.
-   **Privacy controls:** in Settings > Privacy & security you can choose whether you appear in member search, who can message you, and whether your public profile is on. You can block a member from their profile; our Terms of Service explain what a block does.
-   **Deletion:** you can delete your account in Settings > Privacy & security > Your data, or by contacting us. If you are the only admin of a practice with an active plan, you must add another admin or cancel the plan first. Section 6 says what deletion removes and what we keep.
-   **Notifications:** you can manage push and email preferences in settings or via unsubscribe links.
-   **State privacy rights:** depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information, and to not be discriminated against for exercising them. We honor applicable rights; contact us at team@mandible.io and we will verify and respond as required by law.

## 6\. Data Retention

We retain personal information for as long as your account is active and as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements.

**When you delete your account,** we deactivate it and remove the items below. We do not erase it, and what stays can still identify you.

What we remove:

-   your email address, which is replaced with a placeholder;
-   your first and last name, which are replaced with "Deleted User";
-   your phone number and password;
-   the licenses and other credentials on file;
-   your Apple and Google sign-in links, and your OneSignal push identity.

You are signed out everywhere and can no longer sign in. Any personal Stripe subscription is canceled.

What we keep:

-   the rest of your profile, including your preferred first name, display name, handle, second email address, NPI, bio, photo, position, practice name and address, city, state, ZIP code, education and training;
-   your privacy settings, including your public profile and discoverability choices;
-   your CE records and certificates;
-   your cases, posts, comments, messages and files;
-   the copy of your name and photo saved on each case, post and comment when you wrote it (DA-3 and connected assistants can still show that name to other members);
-   your DA-3 conversations and memory;
-   your memberships, schedules, work locations and home or mailing address;
-   your waitlist application, including the name, email address and NPI on it;
-   any documents you uploaded for your credentials;
-   billing, audit and report records;
-   anything else tied to your account, such as follows, notifications and usage events; and
-   de-identified data, which does not identify you or any patient and may be retained and used as described in Section 2.

**Why we keep it.** Other members' discussions, shared cases and school submissions depend on these records, so removing them would break records other people rely on. We also keep records for security, to resolve disputes and to meet legal obligations.

**What other people see.** In the app, your cases and posts stay in their spaces, shown as from "Deleted User." A preferred first name you set can still appear. If your public profile is on when you delete your account, it stays reachable at your handle, so turn it off first.

We have not set a date on which kept records are erased. To ask us to remove more, email team@mandible.io.

## 7\. Cookies, Browser Storage and Do Not Track

The Mandible website (mandible.io) does not set cookies and does not load analytics, advertising or other tracking scripts. If you arrive through a campaign link, a small script keeps the campaign tags in your browser's session storage for that visit and adds them to links into the app, so we can tell where a sign-up came from.

The Mandible web app (app.mandible.io) does not use cookies to sign you in. It keeps your sign-in and settings in your browser's storage. It also loads OneSignal's code for push notifications and, when you use them, Google's and Apple's sign-in and Google's file picker. Those providers may use their own cookies or browser storage under their own policies.

We do not use third-party advertising tools on the website or in the web app. Because of that, nothing changes when your browser sends a Do Not Track signal.

## 8\. Security

We use safeguards designed to protect information, including HTTPS connections, access controls, audit logging, and encryption of the numbers in our credential vault. Our infrastructure is hosted on Google Cloud Platform. No system is perfectly secure; please use a strong password and notify us at team@mandible.io of any suspected unauthorized access.

## 9\. Children

The Services are for professional use by adults. We do not knowingly collect information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

## 10\. Changes to this Policy

We may update this Privacy Policy. If a change is material, we will notify you at least 30 days before it takes effect, by email or in-app notice, and where the change involves a new or materially expanded use of previously collected information, we will ask for your affirmative consent before applying it to that information. New data practices otherwise apply prospectively.

## 11\. Contact Us

Questions about this Privacy Policy or your information: **team@mandible.io**