1. Who we are

This policy describes how NACHGPT, operated for Innovate Dental Lab, handles information when you use the public site, the portal, or when a laboratory-authorized Google account is connected.

This policy does not claim HIPAA certification, Google verification or approval, or medical-device authorization.

2. Scope

NACHGPT is a dental laboratory management platform. It processes case information, authorized employee or client account information, and, when a laboratory administrator authorizes it, data from a laboratory Google account.

3. Information we may process

• Access identity: PIN, employee session, or invited client access.
• Operational case data: case identity, instructions, files, status, and messages related to laboratory work.
• Basic technical usage data needed to operate and protect the service.
• Google data only when a laboratory administrator connects or separately configures a Google account, as described below.

4. Google user data

NACHGPT may connect to a laboratory-authorized Google account.

• The interactive mailbox OAuth flow requests Gmail read-only access to read laboratory-authorized messages needed for case intake and processing.
• Certain separately configured system functions may use Gmail sending to send operational or client-access messages.
• Certain separately configured system functions may use Google Drive read-only access to retrieve files explicitly linked to laboratory cases.
• The current implementation does not request Google Drive full read/write scope.

Google OAuth credentials and tokens are not exposed to employees. Mailbox OAuth refresh tokens are stored using the application's encrypted credential storage mechanism.

5. Use of information received from Google APIs

NACHGPT uses information received from Google APIs to provide the user-facing case-intake, linked-file retrieval, and operational messaging features described in this policy. Authorized laboratory personnel may view case records created from processed messages or linked files because that is the product feature the laboratory authorized. NACHGPT does not use Google user data to serve advertisements or for sale to data brokers.

NACHGPT's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Retention and deletion

Case records and related communications are retained according to laboratory operational needs. Disconnecting a Google mailbox stops future authorized reading; it does not automatically delete historical case records already created from previously processed messages.

To request review or deletion of data associated with a Google connection, contact the laboratory administrator through NACHGPT or Innovate Dental Lab's existing support channel. Requests will be handled reasonably and conservatively, subject to the laboratory's operational and legal record-retention obligations.

7. Sharing

Case data is shown to authorized users of the same laboratory or client portal. Infrastructure providers needed to host or deliver the service may process data as part of that hosting. We do not sell Google user data.

8. Security

We apply access controls and encrypted storage for mailbox credentials. No system can guarantee absolute security.

9. Contact

Questions about this policy: the laboratory administrator through NACHGPT, or Innovate Dental Lab's existing support channel.