Privacy policy

1. Responsibility and contact

The portal is used by Dentalni laboratorij Matej Vidić, Rijeka, Croatia, to work with its clients. Contact for the portal and data-related requests: nalog@labmatejvidic.hr.

This notice describes the Lab Vidić portal and its Gmail connection. Its information pages are hosted on ildentecariato.com; it does not cover the separate processing of training applications. For health records, you may also contact the practice that supplied the information.

2. Data processed by the portal

The laboratory and authorised client enter patient and work information. The portal processes:

• Patient name, order reference, work-order content and PDFs, including necessary information about the dental work.
• Try-in and final-work dates, notes, authors and timestamps of changes.
• Client name and email, laboratory email, and the signed-in user’s name, email and identifier.
• Outgoing message content, recipients, sending status, message identifiers and Gmail conversation identifiers.
• The connected Google email address, authorisation tokens and OAuth client credentials entered by the administrator.

3. Google permissions and purpose

The administrator grants gmail.send to send orders, notes and reminders, and userinfo.email to identify the connected account’s email address. The portal does not request permission to read the inbox, contacts, Google Drive or Calendar.

Messages and PDF attachments are sent from the laboratory’s account to the configured laboratory address and the assigned client’s email. The patient name and order reference appear in the subject. Identifiers returned by Gmail after sending are used to link later messages to the patient’s conversation.

Connecting is optional. Drafts can be prepared without an active connection, but sending orders, notes and reminders is unavailable.

4. Reasons for processing

Data supports preparation and record-keeping of work orders, business communication, appointment tracking and access security. Business contact details are used for the agreed collaboration; access and sending records support security and service reliability.

The laboratory and practice must have an appropriate legal basis for each order, including the conditions for processing health information. Google permission to send mail is not patient consent and does not replace that basis. The portal does not make automated treatment decisions or profile patients.

5. Recipients and service providers

Order data is accessible to the laboratory and the assigned authorised client. Sending involves Google/Gmail and recipients’ email providers. The portal uses OpenAI Sites for access and hosting, with Cloudflare infrastructure for application operation and storage.

Infrastructure providers may process technical data needed to operate and protect their services under their own policies. Exclusive storage in Croatia or the EEA is not guaranteed. Contact the laboratory for information on the specific providers, processing locations and applicable safeguards.

The portal does not sell data or use it for advertising, credit assessments or training general-purpose AI models. Technical support access is limited to authorised maintenance, security or legal requirements.

6. Protection and retention

Connections to the portal and Google use HTTPS. OAuth secrets and authorisation tokens are encrypted on the server. Server-side checks enforce access according to the user’s role and assigned client.

Orders, PDFs, notes and sending records are kept according to the laboratory’s record-keeping needs and applicable obligations. The portal currently has no automatic deletion period; the necessary retention and removal are determined by the purpose of each order and any mandatory retention requirements. Ask the laboratory about retention or request removal.

These information pages have no patient-data submission form. The portal stores the selected language locally; the sign-in platform manages its own session. No advertising trackers have been added to these information pages.

7. Disconnecting Google and deleting data

The administrator can open Settings in the portal and select Disconnect. The portal then requests revocation from Google and removes the saved tokens and connected Gmail account record. You can also revoke access in your Google Account’s third-party connections settings.

Disconnecting stops further sending until the account is reconnected. Work orders and records remain in the portal; OAuth client credentials remain separately stored for future connection. Contact the laboratory to remove these credentials or other data.

Disconnecting or deleting portal data does not retract emails already sent to the laboratory or client. Those copies are managed by the owners of the respective email accounts.

8. Your requests and policy changes

For access, correction, erasure, restriction, objection or data portability, where applicable, contact nalog@labmatejvidic.hr. Identity checks may be necessary to protect the data. Legal retention obligations may limit erasure. You can also contact Croatia’s Personal Data Protection Agency (AZOP).

The update date is shown on this page. If a new use of Google data or broader access is introduced, this notice will be updated and new authorisation will be requested before that use.