Privacy Policy

Miss Floss Inc. ("Miss Floss", "we", "our", or "us") operates an AI-powered voice receptionist service designed for Canadian dental clinics. Our registered office is in Toronto, Ontario, Canada. You can reach our Privacy Officer at hello@missfloss.ai.

This Privacy Policy applies to all personal information collected through (a) our website at missfloss.ai, (b) our AI voice receptionist platform, and (c) any associated mobile or web applications. It describes what data we collect, why we collect it, how we use and protect it, and the rights you have over it — in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

We collect only the information necessary to provide our service: Clinic Information: Business name, address, phone number, operating hours, service offerings, staff roster, and billing information provided during onboarding and account management. Patient Call Data: Inbound and outbound call recordings, transcripts, caller phone numbers, appointment requests, and conversational data generated when Miss Floss interacts with patients on behalf of your clinic. This data is collected for the sole purpose of completing the requested action (booking, rescheduling, confirming appointments, or answering FAQs). Appointment and Scheduling Data: Appointment times, patient names, contact numbers, procedure types, and any scheduling notes relayed to your practice management system. Website Usage Data: IP addresses, browser type, pages visited, referral URLs, and session duration collected via standard server logs and analytics tools. We do not use third-party advertising cookies. Communications: Emails and messages you send to our support team.

We use collected information to: — Operate, configure, and improve the Miss Floss AI receptionist for your clinic — Book, confirm, reschedule, and cancel appointments on behalf of patients — Send appointment reminder messages (SMS or voice) to patients at your direction — Process subscription payments and manage your account — Provide customer support and respond to inquiries — Monitor system performance, detect errors, and prevent abuse — Comply with applicable laws and regulatory requirements We do not sell, rent, or trade personal information to any third party for marketing purposes. Ever.

Under PIPEDA, we collect and use personal information based on: Consent: Patient callers interact with Miss Floss with the knowledge that an AI system is handling their call. Clinics are required to disclose AI-assisted call handling to patients. Consent is obtained at the point of interaction. Contractual Necessity: Processing is necessary to fulfil our service agreement with the clinic (your subscription contract). Legitimate Interests: System monitoring, security, and fraud prevention, balanced against your privacy rights. Legal Obligation: Where required by Canadian federal or provincial law.

All data is stored exclusively in Canadian data centres located in Toronto, Ontario. We do not transfer personal information outside of Canada without explicit written consent except where strictly required by law. We implement the following safeguards: — End-to-end encryption for all data in transit (TLS 1.3) and at rest (AES-256) — Role-based access controls with multi-factor authentication for all internal staff — Regular third-party penetration testing and vulnerability assessments — Audit logs for all access to patient call data — Automatic deletion of raw call recordings after 90 days unless your clinic requires a longer retention period for compliance — Business continuity and disaster recovery procedures tested semi-annually Despite our robust controls, no method of transmission over the internet is completely secure. We encourage clinics to report any suspected security incidents to hello@missfloss.ai immediately.

We retain personal information only as long as necessary for the purposes described above: — Call recordings and transcripts: 90 days by default, configurable up to 7 years to meet provincial dental records legislation — Appointment data synced to your practice management system: not retained by Miss Floss after synchronisation — Account and billing data: duration of your subscription plus 7 years as required by Canadian tax law — Website analytics: 26 months in aggregate, anonymised form When retention periods expire, data is securely deleted or anonymised so it can no longer be linked to an individual.

We work with a small number of trusted sub-processors to deliver our service: Vercel Inc. (vercel.com): Hosts our marketing website and web application dashboard. Data processed by Vercel is governed by their Data Processing Agreement and is hosted in Canadian or US regions as configured. Vercel is GDPR and SOC 2 Type II certified. Cal.com Inc. (cal.com): Powers our demo booking page. When you book a demo, Cal.com collects your name, email address, and selected time slot. This data is subject to Cal.com's own privacy policy. Payment Processor: Subscription billing is handled by a PCI-DSS Level 1 certified payment processor. Miss Floss does not store raw credit card numbers. Practice Management System Integrations (Dentrix, Eaglesoft, Curve Dental, ABELDent, etc.): Miss Floss reads and writes appointment data directly to your practice management system via secure API connections. This data never leaves your infrastructure except as explicitly required to complete a booking action. We enter into Data Processing Agreements with all sub-processors and require them to maintain equivalent privacy and security standards.

You — and patients whose data flows through our platform — have the following rights: Right of Access: You may request a copy of all personal information we hold about you or your clinic. Right to Correction: You may request that inaccurate or incomplete information be corrected. Right to Withdrawal of Consent: You may withdraw consent for optional processing at any time without penalty, though this may limit certain features. Right to Erasure: You may request deletion of personal information where we are not required by law to retain it. Right to Lodge a Complaint: If you believe we have violated PIPEDA, you may file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca. To exercise any of these rights, email our Privacy Officer at hello@missfloss.ai. We will respond within 30 days.

Our marketing website uses a minimal number of cookies: Essential Cookies: Required for the site to function (session management, security tokens). These cannot be disabled. Analytics Cookies: We use privacy-respecting analytics to understand aggregate traffic patterns. No personally identifiable data is shared with third-party ad networks. You may opt out by enabling "Do Not Track" in your browser. We do not use retargeting pixels, Facebook Pixel, Google Ads tags, or any cross-site tracking technology.

Miss Floss is a business-to-business service intended for dental clinics and their adult staff. We do not knowingly collect personal information from individuals under the age of 18 except incidentally where a minor patient calls the clinic. Such call data is handled with the same security standards as all other patient data and is subject to parental/guardian consent requirements consistent with applicable law.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify clinic administrators by email at least 14 days before material changes take effect. The "Last Updated" date at the top of this page reflects the most recent revision. Continued use of our service after the effective date of a change constitutes acceptance of the revised policy.

If you have any questions, concerns, or requests relating to this Privacy Policy, please contact: Privacy Officer Miss Floss Inc. Toronto, Ontario, Canada hello@missfloss.ai We are committed to resolving privacy concerns promptly and transparently.