Patient data, handled like the clinic handles instruments.
Encrypted in transit and at rest, isolated per practice, logged on every sensitive action — and covered by a BAA the practice accepts before it goes live.
Patient data is the most sensitive thing your practice holds. Dentovox treats it that way — encrypted, isolated, and minimized at every step.
Start free → Book a demo →Protected health information is encrypted at rest (AES-256) and in transit (TLS 1.3).
Row-Level Security in force mode on every table holding patient data. One practice physically cannot read another practice's records.
Only a first name and the reason for the call reach the voice agent — never a full patient record.
STOP is honored across every channel, and quiet hours are enforced on outbound messaging — built in before the first message is ever sent.
Every sensitive action — campaign launches, imports, call events — is logged and attributable.
A Business Associate Agreement is available, and a practice must accept it before it can go live.
A caller dials your practice number and the call forwards to Dentovox. The voice agent receives the caller's first name, the reason for the call and the appointment slots it is allowed to offer — not a chart, not clinical notes, not insurance or payment details. When the patient agrees to a time, the appointment is written into Dentrix, Open Dental or Eaglesoft through NexHealth during the call, and a note recording what the caller said is attached to it. Your practice management system stays the source of truth; Dentovox holds a record of the call, not a second patient chart.
Phone numbers are looked up by a keyed hash rather than by the number itself, so a lookup never has to scan plaintext phone data across the database. Error monitoring runs with personal data turned off and a scrubbing filter in front of it — an exception report reaches us without the patient in it.
"Isolated per practice" is a claim worth making concrete. Dentovox enforces PostgreSQL Row-Level Security in force mode on every table that holds patient data — patients, calls, bookings, callback requests, waitlist entries, invitations, BAA acceptances, and the three reactivation tables. Force mode matters: it applies to the table owner too, so a query that forgets its practice filter returns nothing rather than someone else's rows. Billing records — subscriptions, invoices and usage — are not patient data and are isolated by an explicit practice filter in the API instead, which is a weaker mechanism and worth knowing about rather than glossing over. Every sensitive action — a campaign launch, a list import, a call event, a credential change — is written to an audit log and attributable to the account that performed it.
Call transcripts and recording references are scrubbed 365 days after the call. The call's metadata — time, duration, outcome and the appointment that resulted — is kept, because that is what the dashboard and billing are built on. The webhook deduplication ledger is pruned after 90 days. A practice can request an export or deletion of its data at any time by writing to info@dentovox.com.
Anyone who can touch patient data, and why:
The current list, with the status of each agreement, goes to every practice during onboarding — before any patient data flows. Ask for it, and for our security questionnaire, at any point in the evaluation.
Dentovox runs on providers that publish their own SOC 2 reports, but Dentovox itself has not completed a SOC 2 audit, and we would rather say so than point at somebody else's badge. There is no HITRUST certification and no on-premise deployment. If your group's procurement requires a vendor SOC 2 today, we are not that vendor yet.
Compliance is shared. Dentovox handles encryption, isolation, minimization, logging and the BAA. The practice remains responsible for who on its team has an account and what they can see, for the accuracy of the patient data it imports for reactivation, for its own notice of privacy practices, and for the clinical decisions on every call — Dentovox books appointments and records urgent callback requests, it does not triage or give clinical advice. In a genuine medical or dental emergency the AI directs the caller to call 911.
No software is HIPAA compliant on its own — compliance is shared between the practice and its vendors. What Dentovox provides is the vendor half: protected health information encrypted in transit (TLS 1.3) and at rest (AES-256), per-practice isolation enforced in the database, audit logging of sensitive actions, data minimization on every AI call, and a Business Associate Agreement that the practice accepts before it can go live.
Only what the conversation needs: the caller's first name, the reason for the call, and the appointment options being offered. The voice agent is never handed a full patient chart, clinical notes, insurance details or payment data. The appointment it books is written into the practice management system, which stays the source of truth.
Call transcripts and recording references are scrubbed 365 days after the call; the call's metadata — time, duration, outcome, which appointment resulted — is kept for analytics and billing. The webhook deduplication ledger is pruned after 90 days. A practice can ask for its data to be exported or deleted at any time by writing to info@dentovox.com.
Not of its own. Dentovox runs on infrastructure providers — Railway, Vercel and Clerk — that publish their own SOC 2 reports, but Dentovox itself has not completed a SOC 2 audit, and we will say so plainly rather than point at a provider's badge. There is also no HITRUST certification and no on-premise deployment.
Retell AI carries the live call and the speech recognition in it, and Cartesia is the voice the patient hears; NexHealth is the bridge to Dentrix, Open Dental and Eaglesoft; Railway hosts the database and Vercel the dashboard; Clerk handles sign-in. Email to the practice is sent through Resend and deliberately carries no patient information. The current subprocessor list, with the status of each agreement, is provided to every practice during onboarding, before any patient data flows.
Encrypted in transit and at rest, isolated per practice, logged on every sensitive action — and covered by a BAA the practice accepts before it goes live.