Privacy Policy

1. Introduction

Karla Soto DDS LLC, doing business as "Key Elements" ("Key Elements," "we," "us," or "our") respects your privacy. This policy explains how we collect, use, and protect information when you use keyelements.ai, member.keyelements.co, and related services (the "Services").

2. Information We Collect

• Account & Profile Data: Name, email address(es), phone number, office name, mailing address, and profile photos/headshots you upload.
• Practice Data: Business information you enter about your dental practice — financial figures (e.g., collections, marketing spend), operational metrics (e.g., operatories, patient counts, case volumes), and related notes.
• Team Member Data: Information you enter about your practice's staff in calculators and forms (e.g., names, roles, compensation figures used for bonus calculations, or attendees you register for events). You are responsible for having your team's consent to enter this data.
• Survey Responses: Answers you submit to intake, event, and program surveys.
• Education & CE Data: Course progress and engagement data from our learning platform (LearnWorlds), continuing-education records, and — if you provide it — your AGD member ID for CE credit reporting.
• Event Data: Event registration, attendance, seating, and related logistics details.
• Payment Data: Payment and transaction records processed by Stripe. We never store your full card numbers — those are held by Stripe.
• Communication Data: Emails or messages you send to us.
• Usage Data: Information on how you interact with our platform (metadata), and essential authentication cookies.

3. How We Use Your Information

We use your information to:

• Generate the reports, briefings, and analyses you request.
• Power calculators and planning tools with the data you enter.
• Administer your membership, events, education, and CE credit reporting (including submitting CE credits to the AGD when you provide your AGD member ID).
• Improve our internal anonymization algorithms and Services.
• Communicate with you regarding your service, events, and membership.

We do not sell your personal information.

4. AI Processing and Disclosure

To provide our Services, we use third-party artificial intelligence providers:

• Anthropic (Claude models) — our primary AI provider for report generation and survey analysis.
• Google (Gemini models) — a fallback AI provider.
• Microsoft Presidio — an open-source PII-detection engine we operate on our own infrastructure as part of anonymization; it is not a data-sharing relationship with Microsoft.
• Anonymization Step: Before sending data to a third-party AI provider, Key Elements applies a two-layer anonymization protocol (deterministic redaction rules plus Presidio NLP detection) that removes direct personal identifiers (e.g., names, contact details).
• Third-Party Processing: Anonymized data is sent to the AI provider solely to generate the requested output. Under the API terms we use, these providers do not use our submitted data to train their models.
• Vendor Policies: We recommend reviewing the privacy policies of our AI partners (Anthropic and Google) to understand how they process data.

Example of our anonymization:

5. Service Providers (Subprocessors)

We share data with service providers only as needed to operate the Services: Supabase (database, authentication, file storage), Vercel (application hosting), Railway (background processing and anonymization service), Anthropic and Google (AI processing, anonymized), Upstash (job queue), Stripe (payments), Resend (transactional email), Flodesk (marketing email), LearnWorlds (learning platform), and Zoom (session attendance). Each provider processes data only to provide its service to us.

6. Data Retention

• Practice & Account Data: Retained while your membership/account is active so your data and history remain available to you, and thereafter until you request deletion.
• Generated Reports: Retained for up to 5 years for your retrieval history.
• Payment & Transaction Records: Retained as required for tax, accounting, and legal obligations.
• CE Records: Retained to support your continuing-education history and PACE/AGD reporting requirements.

7. Data Deletion and Your Rights

You may request at any time that we:

• Provide access to the personal data we hold about you.
• Correct inaccurate personal data.
• Delete your account and associated personal data (subject to records we must retain by law).
• Opt out of marketing communications.

To exercise these rights, email support@keyelements.co. We will respond within 30 days.

California residents: consistent with the CCPA, you have the right to know what personal information we collect (Section 2), to request deletion or correction, and to not be discriminated against for exercising these rights. We do not sell or share your personal information for cross-context behavioral advertising.

8. Cookies

We use essential cookies required for authentication and session management (via Supabase Auth). We do not use third-party advertising or cross-site tracking cookies.

9. Data Security and Storage

We implement industry-standard security measures to protect your information during transmission and storage, including private storage buckets for sensitive files (e.g., event headshots, certificates). Profile photos you upload as your account avatar are served from a public URL so they can display across the platform. We cannot guarantee the absolute security of data transmitted over the internet.

10. Children

The Services are business tools intended for adults and are not directed to children under 18.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be reflected in the version number and date above, and may require re-acceptance in the Services.

12. Contact

Privacy questions or requests: support@keyelements.co.