DentalTwin

GDPR overview

GDPR compliance is claimed explicitly. The help centre states that DentalTwin is "fully GDPR-compliant" and follows all GDPR requirements, including lawful processing, consent management and user control over personal data. The controller named in the privacy policy is KOMBO medical solutions UG (haftungsbeschraenkt), Brunnenkamp 1, 38642 Goslar, Germany. No data protection officer is appointed, and no Article 27 representative is needed because the publisher is established inside the European Union. The policy cites Articles 6(1)(a), 6(1)(b), 6(1)(f) and 49(1)(a) GDPR plus Section 25(1) TDDDG, uses Usercentrics for consent, and covers transfers outside the EU by standard contractual clauses or the EU-US Data Privacy Framework. Data subject requests go to the support address and are answered within thirty days. No external audit or certification supports these claims.

Who owns the data?

Under the general terms, ownership of the content and data a customer uploads stays with the customer, together with responsibility for it. The customer grants KOMBO a non-exclusive, non-transferable but sublicensable right, unlimited in territory and scope, to use that content solely to operate the platform and deliver the individual services. KOMBO retains all intellectual property in the platform itself, and the customer acquires none. Separately, KOMBO may analyse usage and content data to improve and further develop its offering, but only in aggregated or anonymised form and only in ways that do not directly disadvantage the customer; that right survives termination of the agreement.

Reuse rights

Reuse of the delivered design is permitted once the invoice is settled. The terms grant the customer an exclusive, non-transferable and non-sublicensable right to use the deliverables after full payment, limited to the purpose set out in the product description; anything beyond that requires KOMBO's written consent. In practice the customer receives an open-format STL file and may edit it, mill it, print it in-house or send it to an external production facility without asking further permission. Two restrictions apply: previews, interim results and unreleased files may not be exported or used before KOMBO approves the download, and the customer alone must review and validate every result before clinical use.

Data retention & training

Hosting summary

Data is hosted in Germany. The help centre states that files sit on secure servers at Hetzner Online GmbH, and the privacy policy identifies that provider as Hetzner Online GmbH, Industriestrasse 25, 91710 Gunzenhausen, Germany, covered by a data processing agreement. An independent DNS and IP check confirms the site resolves to a Hetzner address in Nuremberg, Germany, on real hosting rather than a CDN edge node. The jurisdiction is therefore German and, by extension, European Union law, with the publisher itself established in Goslar. All transmissions are encrypted with SSL/TLS, a Wordfence firewall and malware scanning are in place, server-side security is handled by Hetzner, and staff access to sensitive data is restricted to authorised personnel for legitimate purposes. Payments run through Stripe and no card details are stored by the publisher. Where data does leave the European Union, the vendor relies on standard contractual clauses or the EU-US Data Privacy Framework. No hosting region other than Germany is offered or mentioned, and no independent audit of these arrangements is published.