Privacy Policy

Who is responsible for your data

Zircca is a product of FL Marketing Management LLC, a company formed in Florida, United States. It is the controller of the data described here and the party you address. For any privacy matter: hola@zircca.com.

What we store

• About Zircca users: name, email, phone, and the lab's tax details.
• About cases: the patient reference the lab types in, the requested work, attached files, and amounts.
• About usage: technical access logs, to diagnose problems and detect abuse.
• About browsing: we use Google Analytics to learn which screens get used and where visits come from. We send it the screen path and the campaign parameters of the link the visit arrived through, and nothing else: anything typed into a search box inside the application, email addresses and invitation links are stripped from the address before it is sent, and case and record identifiers are replaced. Google sets its own cookies to count visits, which is why it is not loaded until you accept: the first visit asks, and the answer can be changed at any time.
• About sign-up: when an account is created we store the IP address and browser it was created from. It serves one purpose — detecting chained accounts used to repeat the free trial — and deletes itself after twelve months.

About patients

Zircca is not a clinical record and does not ask for diagnoses or medical history. And it **does not store patient names**: the field accepts initials or an internal reference, and if you type a full name it is reduced to initials when saved. This is not a recommendation or a setting you can change — the database enforces it, at the single point every write passes through.

To fabricate a crown a lab does not need anyone's name: the case code and the tooth chart are enough. The person who knows whose work it is is the dentist, and that lives in their own clinical record, outside Zircca.

The consequence is what matters if you practice in the United States: because it does not handle patient identifiers, Zircca does not act as a business associate under HIPAA and no agreement (BAA) is needed to use it. Cases created before this change may still hold what was typed then; write to us and we will reduce them.

Where data is processed

In the United States. Our infrastructure providers operate there, so if you use Zircca from Chile, Colombia, Mexico, or elsewhere in the region, your data crosses the border. We say so because your local law treats this as an international transfer and you have the right to know.

Who else handles it

To run the service we use providers that process data on our behalf: Supabase (database, authentication, and files), Railway (application hosting), Cloudflare (large file storage), Resend (email delivery), and Google Analytics (site usage measurement). We do not sell data, do not share it with third parties for their own benefit, and do not use it to train models.

Who sees what

Each lab sees only its own data, and that separation is enforced in the database, not just on screen. A dentist working with several labs sees cases from all of them in one inbox, but the commercial terms they have with one lab are invisible to the others.

How long we keep it

As long as the account is active. When it closes, data is deleted after a grace period so it can be exported or the account recovered from an accidental closure. The sign-up IP and browser have their own term: twelve months, and sooner if the account is deleted.

Your rights

You can request access, correction, deletion, or a portable copy of your personal data by writing to hola@zircca.com. We respond within the deadlines applicable law requires, and we will not treat you differently for asking.

This standard applies to everyone, wherever you live. Your country may also grant you its own rights — Chile (Law 21.719), Colombia (Law 1581), Mexico (LFPDPPP), Brazil (LGPD), or Argentina (Law 25.326), among others — and we honor those too.

If you live in California

The CCPA/CPRA gives you the right to know what personal information we collect and why, to request its deletion or correction, and not to be discriminated against for exercising those rights.

We do not sell or share personal information, as those laws define “sell” and “share.” Nor do we use it for cross-context behavioral advertising.

Changes

If this policy changes in a material way, we notify each account's administrators by email before it takes effect.