Skip to main content

Privacy Policy

‍

Effective Date: September 17, 2025

Codenta Inc. ("Codenta," "we," "us," or "our") provides software that helps dental practices audit clinical documentation and CDT coding prior to claim submission. This Privacy Policy explains how we collect, use, disclose, and protect information in connection with our websites, products, and services (collectively, the "Services").

This Policy is intended for: (a) our business customers ("Customers") and their authorized users; and (b) visitors to our marketing websites (codenta.ai)

This privacy policy does not replace patients’ HIPAA rights, which are exercised through their dental providers (our Customers). When we process patient information on behalf of a Customer, we do so as that Customer’s business associate under HIPAA and as a service provider/processor under U.S. state privacy laws.

‍

1) Scope & Roles

  • Platform Services (B2B). This Policy covers the Codenta platform used by dental practices and DSOs to perform pre-claim QA (auditing clinical notes and CDT coding/ledger before claim creation). Codenta is a business-to-business service; patients do not sign up for, or interface with, Codenta directly.
  • Websites. This Policy also covers information collected on our public websites and landing pages.
  • Role Under Law. For the platform, Codenta generally acts as a HIPAA business associate and a service provider/processor under U.S. state privacy laws. For our websites and business operations (e.g., sales outreach), Codenta acts as a business/controller.
  • Geographic Scope (U.S.-Only PHI). We provide and host the Services in the United States and process PHI in the United States only. We do not target users outside the U.S. If you access our websites from outside the U.S., your information will be processed in the U.S., where laws may differ.

‍

2. Definitions (Plain‑English Summary)

  • Customer Data – Electronic data submitted by or for a Customer through the Services, including PHI from PMS/EHR integrations, patient ledgers, clinical notes, claim images, and related metadata.
  • PHI – Protected Health Information under HIPAA.
  • Subprocessor/Service Provider – Third parties we engage to support the Services (e.g., hosting, analytics limited to product operations), bound by written contracts.

‍

3. Information We Collect

  • Site Usage. Standard web logs, basic cookies necessary for site functionality, and aggregated site analytics. We do not use third‑party advertising cookies.
  • Marketing Interactions. Event registrations, demo requests, and preferences you provide.

We do not intentionally collect sensitive personal information from the general public. Patients do not sign up for Codenta directly; their information is processed through their provider’s systems. Personal information processed for customers is subject to your agreements with your provider and your provider’s agreement with us.

‍

4. How We Use Information

Platform (Processor/Service Provider Uses)

We process Customer Data to:

  1. Provide the Services. Analyze clinical notes and billing data to surface missed revenue, miscodes, and documentation gaps; deliver alerts; and, if enabled, transmit Customer‑approved updates back to the PMS/EHR.
  2. Support, Security & Compliance. Operate, maintain, secure, and troubleshoot the Services; monitor performance; prevent, detect, and investigate security incidents; meet legal and contractual obligations (including BAAs).
  3. Service Quality & Improvements. Improve accuracy and user experience, including developing features using only anonymized, de‑identified, or aggregated information. We do not attempt to re‑identify de‑identified data.
Websites and Business Operations (Controller/Business Uses)

We use website and business‑contact information to:

  • respond to inquiries; manage demos and events; send product updates; and measure site engagement.

**Automated Processing. The platform recommends actions (e.g., add, correct, or support codes) based on rules and ML models. Customers retain sole control over whether to accept, post, or act on any recommendation. Codenta does not make automated decisions without human involvement that produce legal effects or similarly significant impacts.

‍

5. How We Disclose Information

We disclose information only as follows:

  • Service Providers. We disclose personal information to vendors for limited and specific business purposes (e.g., hosting, infrastructure, secure file storage, product telemetry, support). Our contracts prohibit selling or sharing, limit use to those purposes, prohibit combining our personal information with information from other sources (except as permitted by law), require legally appropriate safeguards and assistance with consumer requests, and require flow-down of the same terms to any subcontractors.
  • No Sale/Sharing. We do not sell or share personal information as defined by California law. If this changes (for example, if we enable cross-context advertising), we will update this Notice and provide a “Do Not Sell or Share” mechanism and honor opt-out preference signals.
  • Onward Transfers (Service Providers). We disclose personal information to service providers only for limited and specified purposes; require at least the same level of protection; take reasonable and appropriate steps to ensure compliance; require notification if obligations cannot be met; and stop or remediate unauthorized processing.
  • Affiliates & Professional Advisors. For business operations (e.g., accounting, legal, auditing), subject to confidentiality.
  • Business Transfers. In connection with mergers, acquisitions, or similar events, with appropriate safeguards.
  • Legal & Safety. To comply with law, enforce agreements, or protect rights, property, or safety (including fraud prevention and investigation of misuse).

We do not permit subprocessors to retain, use, or disclose Customer Data except to provide Services to Codenta and our Customers or as permitted by law.

‍

6. Data Location, Retention, and Deletion

  • U.S. Only. PHI is stored and processed in the United States.
  • Retention. We retain Customer Data only as necessary to provide the Services and meet legal obligations. 
  • Upon Termination. Upon Customer’s written request within 30 days and after payment of any outstanding amounts, we will make Customer Data available for export. Thereafter, we delete Customer Data unless prohibited by law or required for legitimate business purposes (e.g., dispute resolution), in which case we limit use to those purposes and delete when no longer needed. If Customer data is not subject to retention otherwise but resides on backups, that data will be deleted as relevant backups expire.

‍

7. Security

We maintain an information security program appropriate to the nature and sensitivity of the information we process. However, no method of transmission over the Internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security. If we learn of a security incident that affects personal information, we will notify affected individuals in accordance with applicable law. If you have questions about our security practices, contact us at security@codenta.ai.

‍

8. HIPAA & Patient Rights

  • Business Associate. When we process PHI for a Customer, we do so under a Business Associate Agreement (BAA). We use and disclose PHI only as permitted by the BAA and HIPAA.
  • Patient Requests. Patients should direct HIPAA access, amendment, or accounting requests to their dental provider. If a provider asks for our assistance to fulfill a patient request, we will support the provider consistent with the BAA.
  • No Marketing or Sale of PHI. We do not use PHI for marketing or sell PHI.

‍

9. U.S. State Privacy Rights (Non‑HIPAA Contexts)

For website visitors and business contacts – and for Customer personnel using the platform – you may have rights under applicable state laws (California or others), including to:

  • Know/Access the categories and specific pieces of personal information we collect about you;
  • Correct inaccurate personal information;
  • Delete personal information (subject to exceptions);
  • Portability of certain information; and
  • Opt‑out of sale/sharing/targeted advertising (not applicable because we do not sell/share for such purposes).

How to Exercise. Contact us at the email or address below. We will authenticate your request and respond as required by applicable law. Authorized agents may submit requests where permitted. If we process your information as a service provider/processor for a Customer, we will direct your request to that Customer and support them in responding.

Non‑Discrimination. We will not discriminate against you for exercising your privacy rights.

‍

9A. California Notice at Collection

Categories Collected. In the past 12 months, for our websites, business contacts, and Customer personnel using the platform, Codenta has collected the following categories of personal information (as defined by California law), to the extent applicable:

  • Identifiers (e.g., name, email address, phone number, username);
  • Customer Records (e.g., business contact details, account profile, role/permissions);
  • Commercial Information (e.g., records of Services purchased by a Customer);
  • Internet/Network Activity (e.g., log data, device/browser, interaction with our sites/services);
  • Geolocation Data (approximate, derived from IP address);
  • Professional/Employment Information (e.g., practice affiliation, job title);
  • Inferences (limited product‑operations inferences, not used for cross‑context behavioral advertising);
  • Sensitive Personal Information (solely as part of Customer Data/PHI that we process as a HIPAA business associate/service provider to deliver the Services; we do not use sensitive personal information to infer characteristics or for purposes requiring a right to limit under California law).

Sources. Directly from you or your organization; from your use of our sites/services; and from integrations your organization enables (e.g., PMS/EHR). See Sections 3–4.

Purposes of Collection/Use. To provide and operate the Services; support, security, and compliance; service quality and improvement using de‑identified/aggregated data; business operations and marketing for our own sites (no third‑party ads). See Section 4.

Disclosure for Business Purposes. We disclose personal information to service providers/subprocessors (hosting, infrastructure, support tools), affiliates/professional advisors, and in connection with legal requirements or business transfers, as detailed in Section 5. We do not permit service providers to use personal information except to provide services to Codenta and our Customers.

No Sale/Sharing. Codenta does not sell personal information and does not share it for cross‑context behavioral advertising.

Retention. We retain personal information consistent with Section 6. Rights & Appeals. California residents may exercise rights to know/access, correct, delete, and portability, and to be free from discrimination.

‍

10. Cookies & Do-Not-Track

Our websites use only necessary and limited first-party analytics cookies. We do not use third-party advertising cookies and do not engage in cross-context behavioral advertising.

Cookie Categories:

  • Strictly Necessary – required for core site functionality and security.
  • Analytics/Performance (first-party only) – helps us understand aggregate usage and improve the site.

You can control cookies through your browser settings. Disabling certain cookies may impact site functionality.

Do-Not-Track. At this time, we do not respond to browser “Do-Not-Track” signals.

‍

11. Children’s Privacy

The Services are designed for professional use by dental practices. Our websites are not directed to children under 13, and we do not knowingly collect personal information directly from children. If you believe a child has provided personal information to us via our websites, contact us and we will delete it.

‍

12. Changes to This Policy

We may update this Policy to reflect operational, legal, or regulatory changes. We will post updates here with a new Effective Date and, where changes are material, provide additional notice (e.g., in-product or by email to account owners). Your continued use of the Services after the effective date constitutes acceptance of the revised Policy.

‍

13. Contact Us

Codenta Inc.
1410 Northern Blvd #1052
Manhasset, NY 11030
Email: info@codenta.ai

‍

14. Additional Disclosures

Arbitration & Governing Law for Website Visitors. Disputes related to our websites or this Policy may be subject to the dispute-resolution terms in our Terms of Use. If you access our Services pursuant to a Customer agreement, the governing law and venue are as set out in that agreement.