Privacy policy

Atlas is HIPAA compliant. It is operated by Casaway Capital, LLC, DBA Dental Document, the same company as Dental Document, under the same business associate agreement and the same Delve-managed security program. The security program is SOC 2 aligned.

Every Atlas customer signs that business associate agreement at signup, before any use, on either plan. Signup runs through the Dental Document process, which is where the agreement is signed. It is not an upgrade and it is not offered later.

Protected patient information is isolated in a protected clinical space, reached only through controlled and monitored paths, and logged on every access. Your practice management system remains the source of truth. Atlas runs on dedicated infrastructure, not shared consumer cloud.

The plans do not differ in compliance. They differ in whether Atlas reaches patient data at all.

Connect reaches patient data through the practice management connection, and processes the scheduling, production, ledger, and patient records needed to perform the work you direct.

Core has no practice management connection, so no patient record reaches Atlas and no agent contacts a patient. It processes what you choose to give it: the documents you upload, the protocols and scripts you write, the figures you paste in, the content of connected business accounts where you connect them, and your account and billing information.

How the practice management connection is provisioned. It runs on an established integration relationship held under the Dental Document brand. Because Atlas is part of Dental Document and you sign up through it, your account already sits there.

Account data. Name, work email, practice name, role, and authentication records. Used to run your account and to secure it.

Billing data. Plan, billing period, and payment status. Card details are handled by our payment processor and are not stored by Atlas.

Practice content. The documents, protocols, notes, and files you put into your second brain, and the content of business accounts you connect.

Operational records. Task history, approvals, the audit log of agent actions, and usage counts against your monthly allowance.

Product analytics and errors. How the product is used and what breaks, so we can fix it.

Your content is used to do your work and for nothing else. It is kept in your own workspace, is not pooled with other practices, and is not used to train general models.

Each practice runs in its own isolated environment. Agent work runs in single-use workspaces that do not persist between jobs.

Atlas runs on infrastructure in the United States. Agent execution, the application database, hosting, payments, transactional email, analytics, and error monitoring are performed by the providers listed on the subprocessors page, which is split by plan because a Core customer's data never reaches the practice management rail.

Practice content, meaning your second brain and the documents and protocols in it, is retained for as long as your account is active, because it is the working memory the product runs on.

Operational records are retained on a schedule by class. These are the defaults, and you can change any of them in the product within the platform limits:

You can set any class between 7 and 730 days. You can also place a class on legal hold, which suspends deletion entirely until you release it.

Connection health and status history is pruned after 30 days.

Your second brain is stored as plain, portable files. You can request a full export at any time from inside the product. The export is delivered as a download link that expires, so an old link cannot be reused.

Deleting the workspace. You can schedule deletion from inside the product. Deletion runs after a grace period that defaults to 7 days and that you can set anywhere from 1 to 30 days. During the grace period nothing is destroyed and you can cancel. When the grace period ends the workspace and its content are purged and a deletion certificate is recorded.

The grace period exists so an accidental or disputed deletion is recoverable. If you want it gone immediately, an owner can purge without waiting.

You can also reach us at support@dentalatlasai.com. Deletion removes practice content and operational records, subject to any records we are required to retain for legal or accounting purposes.

Atlas does not sell your data. We share it only with the subprocessors listed on the subprocessors page, acting on our instructions, and where we are legally required to.

If we make a material change to this policy we will say so on this page and update the date above. Questions go to support@dentalatlasai.com.