Controller for your account, processor for your patients.

This Privacy Policy explains how Grandiosa Vision FZCO, trading as "Faurenis", established in Dubai, United Arab Emirates ("Faurenis", "we", "us"), collects, uses, and protects personal data in connection with the Faurenis website and the Faurenis clinical documentation platform (together, the "Service").

This Policy covers two distinct relationships, described separately below because the legal role we play differs between them: (a) our processing of personal data about you as a website visitor, prospective customer, or account holder, where we act as the data controller; and (b) our processing of patient data your clinic submits to the Service in the course of clinical documentation, where we act as a data processor on your clinic's instructions and your clinic is the data controller.

This Policy is incorporated by reference into the Faurenis Terms of Use. Where you or your clinic have signed a separate Data Processing Agreement, Business Associate Agreement, or order form, the terms of that agreement govern our processing of patient data to the extent they are more specific than this Policy.

When you visit our website, request a demo, register for an account, or manage billing, we act as the data controller — we decide why and how that personal data (yours, or your staff's) is processed, as described in this Policy.

When your clinic uses the Service to document patient care — voice recordings, transcripts, chart entries, treatment notes, images uploaded to the Service — your clinic is the data controller of that patient data and instructs us on how to process it under your Subscription and Data Processing Agreement. We process it only to provide the Service, only under your clinic's instructions, and we do not use it for any other purpose, including training AI models for the benefit of other customers.

If you are a patient of a dental clinic that uses Faurenis, your clinic — not Faurenis — is the appropriate party to contact about your individual privacy rights over your dental records; we act on their instructions. This Policy still describes, transparently, how we process that data as a processor.

Account and billing data: name, professional role, clinic affiliation, email address, phone number (optional), billing contact details, and subscription/payment metadata processed by our payment processor. We do not receive or store full payment card numbers ourselves.

Usage and device data: log data (IP address, browser type, device type, pages visited, timestamps) generated by ordinary use of the website and application, used for security, abuse prevention, and reliability — not for advertising.

Clinical/patient data (processed as a processor, on your clinic's instructions): audio recordings of clinical encounters where voice capture is used, transcripts and AI-drafted clinical notes, periodontal chart data, treatment plans, documents and images uploaded for document intelligence, and any other content your clinic enters into the Service as part of a patient's record.

Communications: messages you send us through the contact form, support channels, or email, including any attachments you choose to include.

The Service does not use third-party advertising or analytics-tracking cookies. We use only the cookies and local storage strictly necessary for the Service to function: session authentication, security tokens, locale/language preference, and the offline caching used by the installable web-app version of Faurenis. None of these are used to track you across other websites, and none are sold or shared with advertisers.

We process account and billing data to provide and maintain the Service, process payments, respond to support requests, and communicate important service updates — necessary for the performance of our contract with you (Article 6(1)(b) GDPR), or, where you are not yet a customer, based on our legitimate interest in responding to your enquiry.

We process usage/device data based on our legitimate interest in keeping the Service secure, reliable, and free of abuse (Article 6(1)(f) GDPR), balanced against your privacy interests.

We process clinical/patient data as a processor, strictly on your clinic's documented instructions, to provide the AI-assisted documentation, charting, and copilot features of the Service. The legal basis for that processing — typically necessity for the provision of healthcare, and/or consent obtained by your clinic from the patient — is your clinic's responsibility as controller, not ours.

Where you have opted in to receive product updates or marketing communications, we process your contact details based on your consent, which you may withdraw at any time.

Faurenis uses large language and speech-recognition models to draft clinical notes, answer chart-grounded questions, and support periodontal charting. AI inference for language features runs on Google Cloud's Vertex AI, pinned to the EU jurisdictional multi-region (EU member states only). Voice transcription runs primarily through Soniox, with an EU-regional Google Cloud Speech-to-Text fallback used only if the primary provider is unavailable.

We do not use your clinic's clinical data to train AI models for the benefit of other customers. Where prompt-level logging is used for debugging and quality purposes, we store a cryptographic hash of the prompt rather than the raw clinical content wherever that is technically sufficient for the purpose.

No AI Output automatically becomes part of your Clinical Record. Every AI-drafted note, chart entry, or summary requires an affirmative review-and-accept action by a licensed clinician before it is treated as part of the official record — this is a deliberate design constraint of the Service, not merely a policy statement, and it is also why AI processing under this Policy does not constitute a solely automated decision producing legal or similarly significant effects on a patient within the meaning of Article 22 GDPR.

We use a limited number of sub-processors to provide the Service. Categories of sub-processor we use, and their role:

• Cloud infrastructure and AI inference (Google Cloud Platform / Vertex AI) — hosting, database, storage, key management, and language-model inference, EU-region pinned as described above. Engaged under a data-processing agreement incorporating Standard Contractual Clauses.
• Speech-to-text transcription (Soniox, with an EU-regional Google Cloud fallback) — converts clinical audio to text for the ambient scribe and voice charting features. Engaged under a data-processing agreement incorporating Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum.
• Payment processing (Stripe) — handles subscription billing and payment; receives billing contact and payment details, never clinical/patient data. Our data-processing agreement with Stripe is being finalized as part of our production billing rollout.

A current, named sub-processor list with each provider's role and data-processing agreement status is available on request at info@faurenis.ai, and is updated with at least 30 days' notice before we add a new sub-processor that will process your clinic's data, consistent with the commitment already published on our Trust Centre.

We do not sell personal data, and we do not share clinical/patient data with any party for that party's own marketing or advertising purposes.

Our infrastructure and AI inference are pinned to EU regions as described in Section 6. Where a sub-processor's support or operational functions require limited processing outside the EU/EEA — for example, time-boxed customer-support access under contractual safeguards — that processing is governed by Standard Contractual Clauses or an equivalent recognised transfer mechanism under the sub-processor's data-processing agreement with us.

Because Grandiosa Vision FZCO is established outside the European Economic Area, our own processing of EU personal data as a controller is subject to Article 3(2) GDPR by virtue of offering services to, and monitoring the behaviour of, individuals in the EU. We are working to appoint an EU representative under Article 27 GDPR; until that appointment is complete, EU data-protection enquiries should be directed to info@faurenis.ai and will be handled directly.

Data in transit is encrypted using TLS 1.3. Clinical/patient data is subject to field-level encryption at the application layer before storage, in addition to the database provider's own encryption at rest using the provider's managed keys. Production clinical/patient data is further encrypted under a per-clinic key: destroying that key renders the clinic's encrypted data unrecoverable, independent of the database's own encryption. Access to clinical data is role-based, with multi-factor authentication required for administrative roles, and access by our own support staff is time-boxed and audited rather than standing.

Actions affecting the clinical record are designed to be captured in an append-only, integrity-verified audit log; the primary write path enforces this at the database level. A fallback path exists for transient failures, and we are hardening its durability — we do not represent the audit trail as complete without exception. We commission an independent penetration test of the Service at least annually and remediate and re-test critical findings.

No security measure is perfect, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal data, we will assess and, where required by applicable law, notify the relevant supervisory authority and affected individuals or your clinic within the timeframe that law requires.

Account and billing data is retained for as long as your account is active, and for a limited period afterward as needed for legitimate business purposes such as accounting, tax, and legal-claim defence, after which it is deleted or anonymised.

Clinical/patient data is retained for as long as your clinic's account with us remains active, plus whatever minimum retention period the health-records law applicable to your clinic requires — that period is set by your clinic's governing law and your agreement with your clinic's patients, not unilaterally by us. On termination of your Subscription, we make Customer Data available for export in a documented format for a reasonable window. Production data is then deleted using the per-clinic key-destruction process described in Section 9, after which it cannot practically be reconstructed from production systems. Backup copies are not separately purged on deletion — they age out and are overwritten on our standard backup-rotation schedule, so a residual copy of deleted data may exist in backups for a limited period after deletion.

Audit-log entries recording who accessed or changed a clinical record are retained for seven years from creation, independent of the retention of the underlying clinical content itself, to support accountability and regulatory audit even after the underlying record has been deleted.

If we act as controller of your personal data (Section 2), and subject to the conditions and exemptions of applicable law, you have the right to:

• access the personal data we hold about you and receive a copy of it;
• request correction of inaccurate or incomplete personal data;
• request erasure of your personal data, where applicable law permits;
• request that we restrict processing of your personal data in certain circumstances;
• receive your personal data in a portable, machine-readable format, where the processing is based on consent or contract and carried out by automated means;
• object to processing based on our legitimate interest;
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
• lodge a complaint with a data-protection supervisory authority — the Croatian Agency for Personal Data Protection (AZOP), or the supervisory authority of your own EU member state, without prejudice to any other administrative or judicial remedy.

To exercise any of these rights, contact us at info@faurenis.ai. If your personal data forms part of a patient record we process as a processor for a dental clinic, please direct your request to that clinic in the first instance, as they are the controller and best placed to action it in the context of your care; we will support them in fulfilling it.

As described in Section 6, the Service does not make solely automated decisions producing legal or similarly significant effects about patients. AI-generated clinical content is a draft that requires review and affirmative acceptance by a licensed clinician before it has any effect on a patient's care or record.

The Service is intended for use by dental professionals and clinics, not directly by children. Where a dental patient whose records are processed through the Service is a minor, that processing is carried out by the clinic (as controller) in the ordinary course of providing dental care to that patient, under the legal bases and parental/guardian consent arrangements applicable to the clinic's own practice — not through any direct relationship between the child and Faurenis.

We may update this Privacy Policy from time to time to reflect changes in the Service, our sub-processors, or applicable law. We will post the updated version here with a revised "Last updated" date, and where a change is material, we will provide additional notice through the Service or by email before it takes effect.

Questions, requests, or complaints about this Privacy Policy or our data practices can be sent to info@faurenis.ai, or in writing to Grandiosa Vision FZCO, Dubai, United Arab Emirates. A formally appointed Data Protection Officer has not yet been designated; data-protection enquiries sent to the address above are handled directly by our compliance team in the interim.