Privacy Policy

How we collect, use, and protect your practice data.

Effective: 2026-05-20 · Last Updated: 2026-05-20 · Version 1.3

1. Introduction

This Privacy Policy describes how Jaxson Software LLC, a Washington limited liability company ("Jaxson," "we," "us," or "our"), collects, uses, shares, and protects information in connection with the Jaxson software-as-a-service product, the marketing website at https://jaxson.io, and the application at https://app.jaxson.io (collectively, the "Service").

Jaxson provides AI-powered tools for dental practices and their authorized staff to manage practice documents and retrieve answers to operational questions. This Policy applies to personal information we collect about:

authorized users of the Service (practice staff);
visitors to our marketing website at https://jaxson.io;
individuals whose information appears in documents or chat interactions our practice customers submit to the Service.

If you are a Washington resident, please also review our Consumer Health Data Privacy Policy, published in compliance with the Washington My Health My Data Act.

2. Information We Collect

2.1 Information You Provide

Account information. Name, email address, role within your practice (Admin, Document Manager, or Employee), authentication credentials (managed through Amazon Cognito; passwords are never stored in plaintext), and your affiliation with a Jaxson customer organization.
Organization information. Practice legal name, doing-business-as name, primary location address, billing contact, subscription tier, and other information necessary to provision and bill the Service.
Documents you upload. Files you upload to the Service, including PDFs, Microsoft Word documents, spreadsheets, presentations, images, and text files.
Connected sources. Content accessible through third-party integrations you authorize. Currently supported integrations are Google Drive (via Google OAuth) and Microsoft 365, including SharePoint and OneDrive (via Microsoft Entra OAuth). We access only what you specifically authorize.
Chat interactions. Questions you submit to the Service and the responses generated.
Feedback, support, and form submissions. Information you provide when contacting us, requesting a demo, submitting feedback, or interacting with our support team.
Legal consents. When you sign up for a paid subscription, we record the version of each legal document you accept (Terms of Service, BAA, Privacy Policy, and any program addendum), the timestamp, and the IP address from which the consent was given, in order to maintain a verifiable record.

2.2 Information Collected Automatically

Usage data. Pages viewed, features used, timestamps, session identifiers, and similar interaction data.
Device and technical data. IP address, browser type, operating system, and referring URL. Where you visit our marketing website or our application's pre-authentication account-creation page (https://app.jaxson.io/register), our analytics provider may also derive an approximate geographic region from your IP address (city or country level, not precise location). Authenticated areas of the application do not derive geolocation from IP address.
Log and security data. Authentication attempts, error logs, application API calls, and audit records. These logs do not contain Protected Health Information, document contents, or chat message contents.

2.3 Derived Information

Search indexes. We process document content to create vector embeddings (stored in AWS S3 Vectors via Amazon Bedrock) and keyword indexes (stored in Amazon DynamoDB) so that the Service can retrieve relevant material in response to your queries. Embeddings are mathematical representations derived from your content and do not, on their own, reconstitute the original content.
Aggregated and de-identified analytics. Service-wide operational and usage metrics that do not identify any individual, practice, or patient.

2.4 Information from Third Parties

Payment information. Stripe, Inc. processes subscription payments on our behalf. We receive transaction metadata (such as a Stripe customer identifier, plan, and last four digits of the payment instrument) but do not store full payment card numbers.
Connected sources. When you connect Google Drive or Microsoft 365, we receive metadata and file content for the items you authorize, scoped to the OAuth permissions you grant. Information received from Google Workspace APIs is additionally subject to the Limited Use commitments described in Section 16.

3. How We Use Information

We use information to:

provide, maintain, secure, and improve the Service;
authenticate users and protect accounts against unauthorized access;
generate AI-powered responses to your queries using content you have provided or authorized;
communicate service updates, security notices, billing notices, and other administrative messages;
respond to support requests, demo requests, and feedback;
detect, prevent, and respond to fraud, abuse, and security incidents;
comply with legal obligations, enforce our agreements, and defend our rights;
generate aggregated and de-identified analytics about Service performance.

We do not use customer document contents or chat interactions to train foundation models, and our AI subprocessor (Amazon Bedrock) is contractually prohibited from using customer inputs to train its models.

4. Artificial Intelligence Disclosures

4.1 AI is used to generate responses. The Service uses large language models hosted on Amazon Bedrock — currently the Anthropic Claude family of models — to generate responses based on your queries and the content you have provided. All inference is performed within AWS's HIPAA-eligible Bedrock service under the Business Associate Addendum we have executed with Amazon Web Services, Inc.

4.2 AI output can be inaccurate. AI-generated responses may contain errors, omissions, or fabrications. You should not rely on AI output as the sole basis for clinical, financial, legal, or other consequential decisions. Clinical decisions remain the responsibility of licensed professionals and require independent human review.

4.3 Customer content is not used to train AI models. Document contents and chat messages submitted to the Service are not used to train, fine-tune, or improve any foundation model. Amazon Bedrock does not use customer inputs to train its base models.

4.4 AI processing is performed only through Amazon Bedrock. All AI inference, including image text extraction (OCR) for scanned documents, is performed through Amazon Bedrock within AWS. We do not transmit customer document contents or chat messages directly to OpenAI, Anthropic (outside of AWS Bedrock), Google, or any other AI provider.

5. How We Share Information

5.1 We do not sell your information. We do not sell or rent personal information, customer content, or chat interactions, and we do not share any of the foregoing for cross-context behavioral advertising.

5.2 Service providers (subprocessors). We share information with subprocessors who help us operate the Service, each bound by written data-protection obligations. Our current subprocessors are:

Subprocessor	Role	Data
Amazon Web Services, Inc.	Cloud infrastructure and AI inference — compute (Lambda), storage (S3 and DynamoDB), AI inference (Bedrock), identity (Cognito), CDN (CloudFront), email delivery (Simple Email Service), and related services	All categories described in Section 2, including PHI under our executed Business Associate Addendum
Stripe, Inc.	Subscription payment processing	Account holder name, billing contact information, payment-instrument tokens. Stripe stores card data; Jaxson does not.
Google LLC	Google Drive integration when the customer connects a Google Workspace account	File metadata and content the customer authorizes
Microsoft Corporation	Microsoft 365 / SharePoint / OneDrive integration when the customer connects a Microsoft 365 tenant	File metadata and content the customer authorizes
PostHog, Inc.	Product analytics on our marketing website at https://jaxson.io and on our pre-authentication account-creation page at https://app.jaxson.io/register	Anonymous interaction data (pageviews, link/button clicks, scroll depth, signup-funnel events). Form field contents (name, email, password, billing address) are excluded from collection. PostHog is not loaded in authenticated areas of the application.

We notify customers of material changes to this list in accordance with the Data Processing Addendum.

5.3 Within your organization. Account administrators within your practice can view users and certain activity within their organization. Authorized users can view content shared within their organization according to role-based permissions enforced by the Service.

5.4 Jaxson personnel. Access to production systems by Jaxson personnel is least-privilege and role-based, requires multi-factor authentication, and is logged. We do not access customer content except as reasonably necessary to operate, troubleshoot, or secure the Service, or as required by law.

5.5 Legal and safety. We may disclose information where required by law, subpoena, or other valid legal process, or where we believe in good faith that disclosure is necessary to protect rights, property, or safety.

5.6 Business transfers. In the event of a merger, acquisition, reorganization, or sale of assets, information may be transferred to the successor entity, subject to this Policy or a successor policy with materially equivalent protections.

6. HIPAA and Protected Health Information

6.1 Business Associate status. Where our customer is a HIPAA covered entity (which includes most dental practices), Jaxson acts as a Business Associate. Acceptance of a Business Associate Agreement is required at signup, and our Terms of Service require Customer not to upload Protected Health Information ("PHI") to the Service unless a BAA is in effect. We comply with the HIPAA Privacy, Security, and Breach Notification Rules in that capacity.

6.2 Breach notification. In the event of a breach of unsecured PHI, we will notify the affected customer in writing without unreasonable delay and in no event later than thirty (30) calendar days after discovery, with the content elements required by 45 CFR § 164.404(c). This commitment is stricter than HIPAA's 60-day statutory ceiling and is mirrored in the BAA we sign with each customer.

6.3 PHI in non-HIPAA contexts. If you are not a HIPAA covered entity (for example, an individual completing the marketing-site contact form), please do not submit PHI through unauthenticated channels. If you do, we will handle it in accordance with this Policy and applicable law and will not retain it longer than reasonably necessary to address the matter you raised.

7. Washington Consumer Health Data (MHMDA)

If you are a Washington consumer, the Washington My Health My Data Act ("MHMDA") provides additional rights regarding "Consumer Health Data." Most information Jaxson processes on behalf of dental practice customers is PHI governed by HIPAA and is therefore expressly excluded from the MHMDA definition of Consumer Health Data. For data flows that fall within MHMDA, our Consumer Health Data Privacy Policy describes:

the categories of Consumer Health Data we collect and the sources from which we collect it;
the specific purposes for which we collect and use Consumer Health Data;
the categories of third parties with whom we share Consumer Health Data;
how to exercise your rights to confirm, access, delete, or withdraw consent with respect to your Consumer Health Data;
how to appeal a denial of a rights request.

To exercise these rights, contact privacy@jaxson.io.

8. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), provides the following rights:

Right to know what personal information we have collected about you, including categories, sources, purposes, and categories of third parties with whom we have shared it;
Right to access the specific pieces of personal information we have collected;
Right to delete personal information we have collected from you, subject to statutory exceptions;
Right to correct inaccurate personal information;
Right to opt out of sale or sharing of personal information — we do not sell personal information and we do not share personal information for cross-context behavioral advertising;
Right to limit use of sensitive personal information — we use sensitive personal information only for the purposes permitted by CCPA without additional consent;
Right to non-discrimination for exercising any of the foregoing rights.

To exercise any of these rights, contact privacy@jaxson.io. We will verify your identity, and where the request is made by an authorized agent, we may also require proof of the agent's authority before responding.

Global Privacy Control (GPC). We treat a Global Privacy Control browser signal as a valid opt-out-of-sale-and-sharing request for the visitor's session and any persistent identifier we associate with that session, regardless of the visitor's state of residence.

9. Cookies and Similar Technologies

9.1 Marketing website (https://jaxson.io). Our marketing website uses standard web analytics provided by PostHog, Inc. PostHog persists data using browser localStorage rather than cookies and does not collect personal information beyond standard analytics events. We do not use third-party advertising or retargeting technologies on the marketing site.

9.2 Account-creation page (https://app.jaxson.io/register). Our pre-authentication account-creation page uses the same PostHog product analytics described in Section 9.1, scoped to this single page so we can measure and improve the signup experience (pageviews, link/button clicks, scroll depth, and signup-funnel events such as state selection and waitlist submissions). Form field contents (name, email, password, billing address) are excluded from collection by configuration, and session video recording is not enabled. We do not use third-party advertising or retargeting technologies on this page.

9.3 Authenticated application (https://app.jaxson.io, signed-in). Once you sign in, the Jaxson application uses cookies and browser storage strictly necessary for authentication and security (for example, to maintain your signed-in session). We do not deploy third-party analytics or advertising technologies inside the authenticated areas of the application.

9.4 Managing cookies and storage. You can control cookies and clear localStorage through your browser's settings. Disabling these mechanisms may prevent you from authenticating to or using the Service.

10. Data Security

10.1 We implement administrative, physical, and technical safeguards designed to protect information, including:

encryption of data in transit using TLS 1.2 or higher on every endpoint;
encryption of data at rest using AWS Key Management Service (typically AES-256) on all persistent stores that may contain customer content, including S3, DynamoDB, SQS, EBS, and CloudWatch Logs;
role-based access controls and per-organization data isolation enforced on every request;
multi-factor authentication for administrative access to production systems;
least-privilege IAM policies with no wildcard resource access on systems holding PHI;
account-wide audit logging via AWS CloudTrail, with object-locked retention in production;
automated security tooling, including continuous vulnerability scanning of deployed code and dependencies (Amazon Inspector), daily HIPAA compliance scans (Prowler), pre-commit secret detection, and infrastructure-policy checks that block non-compliant changes from reaching production;
a documented incident-response process and workforce training on privacy and security obligations.

10.2 No system is perfectly secure. In the event of a breach affecting customer information, we will notify affected customers, individuals, and regulators as required by applicable law. For breaches of unsecured PHI, the 30-day notice commitment described in Section 6.2 applies.

11. Data Retention

We retain information for as long as necessary to provide the Service and to comply with legal obligations.

Category	Retention
Account records	Duration of subscription, plus a reasonable period after cancellation to handle billing reconciliation, dispute resolution, and legal-hold obligations
Customer documents	Duration of subscription. Upon cancellation, the practice's authorized administrator may request export or deletion of customer documents by contacting privacy@jaxson.io. We will respond within forty-five (45) days of receipt and complete return or destruction within sixty (60) days of receipt, consistent with Section 6.3 of the BAA. If no such request is made, we will continue to safeguard customer documents under the protections of the BAA. Residual copies in standard backup and disaster-recovery systems persist for up to thirty-five (35) days after deletion, after which they are purged.
Chat interactions (first 90 days)	The original message content is retained for ninety (90) days after the message is sent. During this window the chat record is treated as PHI and protected under the technical safeguards described in Section 10.
Chat interactions (after day 90)	At day 90, an automated process inspects every chat record for the eighteen (18) HIPAA Safe Harbor identifiers (names, dates more granular than year, contact information, account numbers, etc., per 45 CFR § 164.514(b)(2)). When any are detected, the record's body is span-redacted with type-tagged tokens (e.g., `[NAME]`, `[DATE]`) and the record's timestamp is generalized to year-only — Safe Harbor de-identification. When the process detects no identifiers, the record is left as written. Either way, the record is retained thereafter as non-PHI for service-improvement analytics, subject to the same email-based deletion path described above for Customer documents.
Billing records	Seven (7) years, to comply with federal and state tax and financial recordkeeping obligations
HIPAA-required audit logs	At least six (6) years, as required by 45 CFR § 164.316(b)(2)(i). These logs do not contain document contents, chat message contents, or patient information.
Application diagnostic logs	Up to thirteen (13) months on a rolling basis. These logs do not contain PHI.

A customer's authorized administrator may request earlier deletion of the practice's data at any time by contacting privacy@jaxson.io, subject to the limited categories of records we are legally required to retain.

12. Your Controls

12.1 Account data. You can access and update your individual account information through the Service. To remove your individual user account, contact your practice administrator, who can delete user accounts via the Service's user-management screen. If you are the practice administrator and wish to close your own account or the practice's entire account, see Section 12.3.

12.2 Document deletion. Authorized users with appropriate permissions can delete documents from the Service. Deleted documents are removed from production systems promptly and from associated search indexes and backups in the ordinary course.

12.3 Organization-wide deletion. A practice administrator may request deletion of the practice's entire account and associated customer content by contacting privacy@jaxson.io. We will respond within forty-five (45) days of receipt.

12.4 Data export. A practice administrator may request export of the practice's documents and chat history by contacting privacy@jaxson.io. We will respond within forty-five (45) days of receipt.

12.5 Communications preferences. You can opt out of non-essential marketing communications at any time using the unsubscribe link in those messages or by contacting us. Transactional and service communications (security notices, billing notices, and other administrative messages) will continue while you have an active account.

13. International Users and Data Residency

The Service is hosted entirely in the United States. Production infrastructure is anchored in a single AWS region (us-west-2), and we do not replicate customer content across borders. If you access the Service from outside the United States, your information will be processed in the United States, which may provide different privacy protections than your jurisdiction. By using the Service, you consent to that transfer and processing.

14. Children's Privacy

The Service is intended for use by adult dental-practice staff. Consistent with our Terms of Service, you must be at least eighteen (18) years old to use the Service. We do not knowingly collect personal information from children under 13, and the Service is not directed to children. If you believe a child has provided personal information to us, contact privacy@jaxson.io and we will investigate and take appropriate action.

15. Changes to This Policy

We may update this Policy from time to time. Material changes will be communicated by email to the administrator on file for each customer and by an updated "Last Updated" date above. We will provide at least thirty (30) days' advance notice before material changes take effect, except where a shorter notice period is necessary to address a security, legal, or regulatory issue.

16. Google Workspace Limited Use Disclosure

When you connect Google Drive to the Service, Jaxson accesses Google user data through the Google Workspace APIs to enable the integration features described in Section 2 (Information We Collect) and Section 3 (How We Use Information).

Jaxson's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

Permitted uses. We use information received from Google Workspace APIs only to provide and improve user-facing features of the Service that are prominent in the application — namely, ingesting files the customer has explicitly authorized so the customer's authorized staff can ask questions about that content within Jaxson.
No transfer to third parties. We do not transfer Google user data to any third party except (a) as necessary to provide or improve the user-facing features above (for example, storage and retrieval infrastructure operated by our subprocessors listed in Section 5, each bound by written data-protection obligations consistent with this Policy); (b) to comply with applicable law; or (c) as part of a merger, acquisition, or sale of assets, with user notice and consent where required.
No human reading. Jaxson personnel do not read Google user data except (a) with the affirmative agreement of the user for specific messages or files (such as a support request the user has explicitly directed us to investigate); (b) where necessary for security purposes (such as investigating abuse); (c) to comply with applicable law; or (d) where the data has been aggregated and anonymized for internal operations and is used in accordance with applicable privacy and confidentiality obligations.
No advertising. We do not use Google user data, or any data derived from Google user data, to serve advertisements, including retargeting, personalized, or interest-based advertising. Jaxson does not display third-party advertising in the Service.

These commitments apply equally to data that has been transformed or derived from the original Google Workspace API output — for example, text extracted from a Google Doc you have authorized, or search-index embeddings derived from that text. The Limited Use restrictions follow the data through every stage of processing within the Service.

If you have questions about how Jaxson handles data received from Google Workspace APIs, please contact us at privacy@jaxson.io.

17. Contact Us

Jaxson Software LLC Attn: Privacy Officer c/o Northwest Registered Agent 522 W Riverside Ave, Ste N Spokane, WA 99201 Email: privacy@jaxson.io

For legal notices under the Terms of Service, contact legal@jaxson.io.