Privacy policy (extended)

1. Operator and important note

This document is a DRAFT, subject to review by a qualified lawyer, and is not a final legal document.

Personal data operator: BAHA AI LLC (BAHA AI MChJ), the Dentum (dentum.uz) service. Contact: info@dentum.uz. Registration details — [details to be specified]. Dentum is an independent information and reference service; it is not a clinic and does not provide medical services.

Revision date: 12 July 2026.

2. What data we collect

Through forms and the bot: your name and phone number, as well as the language, the page you are on, and technical metadata (e.g. the time of the request).

Via the AI assistant (the website chat and the Telegram bot dialog): the text of your messages and service metadata (language, time). The website chat opens only after a separate confirmation (see section 6).

Automatically via analytics: the Google Analytics 4 and Yandex.Metrika services may collect data about your interaction with the site (e.g. visits, device type) through cookies and identifiers.

3. Purposes and legal bases

We use your name and phone to book you at the clinic you choose. The legal basis is consent under the ZRU-547 "On Personal Data" law.

We send advertising and informational messages via Telegram/SMS only with separate, voluntary consent. The legal basis is ZRU-776 "On Advertising". This consent is optional and can be withdrawn at any time.

4. To whom we transfer data

We pass your name and phone only to the clinic you have chosen — for booking. If you asked us to suggest options or request terms from several clinics, the data is passed to exactly those clinics you selected.

We do not sell your data to third parties and do not use it for advertising without your consent. The clinic must use this data only for booking/providing the service (see the DPA concluded with the Clinic).

Infrastructure contractors (processors) we engage: Telegram (bot and notifications), Google Analytics 4 and Yandex.Metrika/Webvisor (analytics), the hosting provider (server hosting), the AI provider kie.ai (Anthropic Claude models — processing of assistant message text), and the payment service Multicard/Rahmat (invoices of partner clinics). Each receives only the data necessary for its function. From the open outcomes registry (section 10), external researchers receive de-identified records only — under a data use agreement (DUA) that prohibits re-identification.

5. Retention periods

We store request data for the period necessary for the booking purpose and up to the period required by law.

Indicative periods: request data — up to 24 months from your last contact; AI assistant dialogs — up to 12 months; payment and accounting documents (B2B) — for the periods set by accounting legislation; analytics data — per the GA4/Metrika retention settings.

Once the purpose is achieved or when you withdraw your consent (and in the absence of a lawful basis to retain), we delete or anonymize your data.

6. AI assistant and health information

The Dentum AI assistant (the website chat and the assistant in the @dentumuzbot bot) helps with choosing a clinic, prices and booking. It does not diagnose, does not prescribe treatment and is not a substitute for a dentist; if signs of an emergency appear, the assistant directs you to the 103 service.

Message text is processed automatically with the involvement of an external AI provider (the kie.ai API, Anthropic Claude models); the provider's servers may be located outside the Republic of Uzbekistan — by sending a message you consent to such cross-border processing of its text. Messages may contain health information that you share voluntarily; the website chat opens only after your separate explicit confirmation, and in the bot you continue after the assistant's greeting with a notice.

Do not include your full name, phone number or other identifiers in chat messages: booking uses a separate form — its data is processed within the Dentum contour and is not passed to the external AI provider. Dialogs are stored for up to 12 months (or until consent is withdrawn) for quality control and safety. Chat fields are excluded from Webvisor session recording.

7. Your rights under ZRU-547

In accordance with the ZRU-547 "On Personal Data" law, you have the following rights: — access to your data (obtaining information about it); — correction of inaccurate data; — deletion of your data; — withdrawal of consent.

How to withdraw consent: write to info@dentum.uz (stating the name/phone from your request) or message the @dentumuzbot bot. We will stop the processing and delete the data for which no other lawful basis exists within 30 days at the latest. You also have the right to lodge a complaint with the personal data protection authority.

8. Analytics and cookies

To improve the site, we use the Google Analytics 4 and Yandex.Metrika services. They may use cookies and identifiers.

Yandex.Metrika includes Webvisor (session recording). Personal data fields in forms and the AI chat fields are excluded from recording. Analytics services may process data outside Uzbekistan in accordance with their policies.

You can disable or block cookies in your browser settings. In that case, some features of the site may not work fully.

9. Policy changes and contacts

We may update this policy from time to time. Material changes are announced on the site; the current version is always on this page.

For questions and requests: info@dentum.uz. Operator: BAHA AI LLC. This policy is governed by the law of the Republic of Uzbekistan.

10. Open outcomes registry (ODIN)

Dentum runs ODIN, an open scientific registry of implant outcomes (dentum.uz/registry/). Only DE-IDENTIFIED data enters the registry, submitted by the clinic with the patient’s written informed consent: age (no birth date), sex, risk factors, procedure parameters, de-identified images and the outcome. Name, phone, address and other identifiers never enter the registry; each record gets a random code (study_uuid). Images are de-identified BEFORE storage (embedded metadata stripped; the face surface is removed from 3D scans); when sent via the Telegram bot, the file briefly transits Telegram’s servers. The clinic is the operator of the patient’s personal data; BAHA AI LLC operates the de-identified registry. Consent can be withdrawn in full or per scope at dentum.uz/registry/consent/ using the record code — the record is excluded from further use within 30 days. De-identified records are kept indefinitely for scientific reproducibility. Until the consent text passes legal review, the registry runs in demo mode: no real patient data is collected.