Policies and help

Privacy Policy

Last updated: 2026-10-11

Who we are

Dentakit is a mobile app for dental students and dentists in Egypt. It lets users order dental supplies from independent stores and collect them from the store's branch at a time they choose.

The app is operated by the Dentakit team ("Dentakit" or "we"), the controller of the personal data described in this policy.

The person responsible for data protection at Dentakit can be reached at support@dentakit.app.

Scope of this policy

This policy applies to the Dentakit app for iOS and Android, our public web pages, and the support we provide. It explains what personal data we process, why, who receives it, and the user's rights under the Egyptian Personal Data Protection Law No. 151 of 2020.

Stores that sell through Dentakit are independent businesses. A store uses order details only to prepare and hand over the order, under its agreement with us.

The data we collect

Account data

Mobile number, used to sign in with a one-time code.
Name.
Profile type (student or dentist), study year and university.
Preferred app language.

We do not ask for an email address or a profile photo.

Orders and pickup

Items, quantities, prices, fees and totals.
The chosen branch, pickup slot, pickup code and order status history.
The user's choices when an item is unavailable.
Cart, favourites and kits.
Loyalty points earned and redeemed, where a store offers a points programme.
Ratings and comments on orders.

Communications and support

Order chat messages between the user and the branch.
Support requests and help-session transcripts, including any photos the user chooses to attach.
Ask Dentakit conversations: what the user writes, the assistant's replies, and the photos of order lists the user uploads there.
Notifications sent to the user.

Usage and device data

Search terms typed in the app, to improve search results.
Offers the user views.
App usage events (screens, products viewed, cart and order events), linked to an internal account number, not to the name or phone number.
App version, build number and operating system.
The device's push notification token.
Sign-in records: a hashed copy of the one-time code, the IP address and the device user agent.
Security logs: IP address and user agent.

Location data

Location is optional. We use it only while the app is in use, to find the user's area and pin an address on the map.
An address with its map point is stored only if the user saves it. A saved address is used for delivery if delivery becomes available.
Only when delivery is available, we check whether an address is covered using a location rounded to about 500 metres.

Permissions

Location (while using the app, optional): to find the area and pin an address.
Camera and photos: only to attach a photo to a support request.
Notifications: for order updates and pickup reminders.

We do not access contacts or the microphone. We do not collect or store payment card data; payment is in cash at the counter.

Store users and staff

Counter staff (cashiers) and delivery couriers: phone number, name and branch. For delivery only, the courier's location when marking an order delivered or failed.
Store panel users: name, phone number, username and password (stored hashed); the store owner's name and phone number, commercial registration number and tax number.

How and why we use the data

Performance of our contract with the user

Create and secure the account.
Show stores and products.
Receive and manage orders, and send the branch the order details it needs.
Run pickup slots and pickup codes, and handle unavailable items.
Run order chat, kits, favourites and loyalty points.
Send service messages: order status, a reminder 15 minutes before the pickup slot, and replies to support requests.

Consent

Location, camera and photos, and notification permissions.
Consent can be withdrawn at any time in the device settings. Withdrawal does not affect processing carried out before it.

Legitimate interest

Protecting the service and preventing fraud and misuse, including sign-in and security logs and the no-show rule.
Improving search and the app using usage statistics.
Handling support requests and settling disputes, including review of order chats by our support team when needed.

We weigh these interests against the user's rights and limit the data used to what is necessary.

Legal obligation

Keeping order and invoice records as required by Egyptian tax and commercial law.
Responding to lawful requests from competent authorities.

Who we share the data with

Stores

The store preparing an order receives the items ordered, the user's first name and district. It does not receive the phone number or address. The branch sees the chat messages about that order.

Service providers (processors)

Google Firebase Cloud Messaging: sends push notifications; receives the device's push notification token and the notification content.
Google Analytics for Firebase: usage statistics; receives the internal account number and the usage events listed above. Not used for advertising.
Google Maps and Google Places: show maps and search addresses; receive the search text and map requests.
SMS provider: sends sign-in codes; receives only the phone number and the message text.
Hosting (Hostinger): the app's data is stored on servers rented from Hostinger in the United States.

Processors act on our instructions and may not use the data for their own purposes.

Other parties

The phone's location service (Apple or Google): converts a map point into a written address, and may send the point's coordinates to the company's servers to do so, under its own policy.
DeepL: translates product names only and receives no personal data.
YouTube: when a product video is played, YouTube may receive the IP address under its own policy.

Competent authorities

We disclose data when the law requires it, under an order from a competent authority, or to protect our rights or the rights of others in a legal dispute.

Transfers outside Egypt

The app's data is stored on servers in the United States, and Google services and the SMS provider may process data on servers outside Egypt. We transfer personal data outside Egypt only to the extent needed for the purposes in this policy, to service providers bound by data protection terms, and under the conditions set by Law No. 151 of 2020 and its executive regulations, including any licence or permit they require.

How long we keep data

We keep data only as long as needed for the purpose it was collected for, then delete it or make it no longer identifiable.

Data	Purpose	Kept for
Account data (phone, name, profile, language)	Account and orders	While the account is open; after deletion, the name and phone number stay linked to past order records
Sign-in session	Keeping the user signed in	An access session ends after 60 minutes; sign-in renews automatically for up to 180 days
One-time sign-in code	Verifying the number	Expires after 5 minutes
Sign-in and security logs	Security and fraud prevention	Sign-in codes 30 days; sign-in sessions 30 days after they end; security logs 24 months
Orders and invoices	Contract, tax, accounting and disputes	Five years from the order date
Order chats	Order handling and disputes	12 months from the order date
Support requests and attached photos	Support	24 months after the request or session is closed
Ask Dentakit conversations and their photos	Answering the user's questions	30 days from the last message in the conversation, then the text and photos are deleted; only identifiers, counts, cost and response time, without any text, stay up to 365 days
Ratings and comments	Service quality	With the order record: five years from the order date
Addresses, cart, favourites, kits	Convenience	Until the user deletes them or deletes the account
Loyalty points	Rewards	Points expire after the validity period shown in the points programme; the points record is kept with order records
Search terms	Improving search	12 months, and deleted as soon as the account is deleted
Usage events and offer views	Improving the app	Usage events up to 14 months; offer views 14 months, deleted as soon as the account is deleted
Push notification token	Sending notifications	Until the account is deleted
Coverage-check location (rounded)	Checking the delivery area	30 days, and deleted as soon as the account is deleted

After an account is deleted

We delete saved addresses, the user's own kits, favourites, cart, notifications, push tokens, search terms, offer views and coverage checks, end all sign-in sessions, and close the account. We keep orders, invoices and the messages related to them, with the name and phone number linked to them, to meet tax and accounting obligations and to settle disputes, for the periods in the table above. This data is never shown to other users.

Ask Dentakit conversations and their photos are deleted at once with the account. A support request the user sent to the branch from a conversation stays as a separate support record, with the copy of the conversation text removed from it.

Other data, such as ratings, support requests, sign-in and security logs and Firebase usage events, remains after the account is deleted until its period in the table ends, and is then deleted or made no longer identifiable.

User rights

Law No. 151 of 2020 gives users the following rights:

To know what personal data we hold, to access it and to obtain a copy.
To correct, update or complete it.
To have it erased, subject to what the law requires us to keep.
To restrict processing to a defined scope.
To object to processing.
To withdraw consent at any time.
To receive the data in a commonly used format.
To be informed of any personal data breach that affects them.

How to exercise these rights

The name and profile details can be edited inside the app.
To exercise any other right, email support@dentakit.app with the registered phone number.
We verify the requester's identity before acting, and reply within 30 days.
Users may file a complaint with the Personal Data Protection Center.

Deleting the account

Inside the app: Profile → Delete account.
Or by email to support@dentakit.app with the registered phone number.

Details are on the "Delete your Dentakit account" page.

Security

Data is sent over encrypted connections.
Access to data is limited to team members who need it.
One-time sign-in codes and store panel passwords are stored hashed, and a sign-in code expires after 5 minutes.
We log sign-ins and security events to detect misuse.

No system is completely secure. If a breach affects personal data, we notify the Personal Data Protection Center and the affected users as the law requires.

Children

The service is intended for dental students and dentists and is not directed at children. Anyone under 18 may use the app only with the consent of a parent or guardian. If we learn that we collected a child's data without that consent, we delete it.

Analytics and advertising

We use Google Analytics for Firebase to understand how the app is used and to improve it, linked only to an internal account number. We show no third-party ads, use no advertising tools, sell no data and do not track users across other apps.

Notifications

We send notifications about order status and a reminder before the pickup slot. We send marketing notifications about store offers only after the user agrees to them in the app. Notifications can be turned off in the device settings:

iOS: Settings → Notifications → Dentakit.
Android: Settings → Apps → Dentakit → Notifications.

When they are off, the order status still shows in the app, but the pickup reminder will not arrive.

Changes to this policy

We may update this policy. We change the "Last updated" date with every update and inform users in the app of any material change before it takes effect.

Contact

Data controller: Dentakit.
Email: support@dentakit.app
Data protection officer: support@dentakit.app

Contact: support@dentakit.app