Last updated: 11 August 2026
Patient records never reach us. ADIR is software you install on your practice’s own computers. Statements, patient names, procedure codes, amounts and your ledger are read and written only there. What travels to our servers is what is needed to run your licence and your subscription, together with a few counters describing how much work ADIR did for you — counts and durations, never content.
ADIR is published by Dakota Code Lab (“ADIR”, “we”, “us”), established in Ontario, Canada. This policy explains what we do with personal information, and — because ADIR is used inside dental practices — what we deliberately never touch.
Two very different kinds of information appear below, and the distinction runs through this whole policy:
Insurance statements, patient names, procedure codes, amounts, your practice management ledger, daily reports and the audit trail are read, written and stored only on the computers and network folder you choose during setup. They are not transmitted to us and we hold no copy of them.
Credentials for your mailbox and for insurer portals are stored in your own ADIR configuration folder, in the network location you choose during setup, alongside ADIR’s other settings. They are never transmitted to us and we cannot read them. Because they sit in your own file storage, protect that folder with the same access controls you apply to patient records — anyone who can read it can read them.
This is an architectural fact, not a promise about our conduct. ADIR reads your mailbox and insurer portals from your own machine, and writes into your own practice management software on that machine. There is no step in which patient data is uploaded to us, so there is no copy of it for us to lose, disclose or be compelled to produce.
ADIR checks its licence over the internet. That check sends, and we store:
We also hold the account and billing information described under Billing, and whatever you choose to send us when you contact support.
The licence check never sends statements, patient information, dollar amounts, insurer names, or any content read from your practice management software.
We use those counters to understand how well ADIR is working across the practices that use it, and to describe that publicly — only ever as a combined figure across many practices, never as your practice’s own numbers.
You can ask us to stop collecting these counters at any time. Email privacy@adirdental.com. We stop collecting them, and we delete the ones we have already collected for your practice. Nothing else about your licence or the software changes.
We collect this information to give you the software, enforce the number of computers your subscription covers, tell you when an update is required, take payment, and answer you when you get in touch. We do not sell personal information, we do not share it for advertising, and we do not profile you.
Under Canadian federal law we rely on your consent, given when you activate a licence and accept our Terms. You can withdraw it by cancelling your subscription; the practical consequence is that the software stops being licensed, because the licence check is the thing that consent covers.
ADIR watches one mailbox for insurer statements, and it does so from your own computer over a standard encrypted IMAP connection — the same protocol your mail program uses. We are not in the middle of that connection, and no part of it passes through our servers.
What it does, precisely:
Most practices point ADIR at a dedicated mailbox or a folder fed by a filter, so it never sees general correspondence at all. You can revoke its access at any time by changing the password or removing the app password in your mail provider — nothing needs to be cancelled with us for that to take effect immediately.
Subscriptions are processed by Stripe. Card numbers are handled by Stripe and are never seen or stored by us. We receive the billing email address, subscription status and invoice history needed to run the account.
If you contact support we receive whatever you send us. Please do not include patient information in a support message — not in the text, not in a screenshot, not in an attached log. We do not need it, and we ask that you describe the issue without it. If patient information reaches us anyway, we delete it once the issue is resolved and do not copy it elsewhere.
We use a small number of providers to run the licensing service and this website. Each receives only what its job requires:
None of them receives patient information, because we do not have any.
Our licensing database is hosted in Canada. Some of the providers above process information outside Canada, principally in the United States — payments through Stripe and account email through Resend in particular. Information held by a provider in another country is subject to the laws of that country, and may be accessible to its courts and law enforcement.
This applies only to practice and billing information. It does not apply to patient information, which never leaves your own equipment.
Traffic between ADIR and our servers is encrypted in transit. Entitlements are cryptographically signed, so an installed copy can tell a genuine licence response from a forged one. Access to the licensing database is restricted to those who need it. Portal and mailbox credentials are encrypted on your own machine using the operating system’s key store, which ties them to that machine.
No safeguard is perfect, and we do not claim otherwise. What we can say is that the most sensitive category of data in this product — your patients’ records — is not in our custody to be breached.
If personal information we hold is lost or accessed without authorisation, and it creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as the law requires, and we will keep a record of the breach. We will tell you what happened, what was affected and what we are doing about it, without waiting to be asked.
Licence and billing records are kept while your account is active, and afterwards for as long as tax and accounting rules require. Support correspondence is kept while it is useful for supporting you. If you cancel, the data on your own machines is unaffected — statements, reports and audit history remain yours, on your equipment, readable with the installed software.
You may ask us what we hold about your account, ask for a copy, ask us to correct it, ask us to delete it once no legal reason to keep it remains, or withdraw your consent. Write to privacy@adirdental.com and we will respond within thirty days.
Requests about patient information are a matter for your own records, because that information is in your custody and not ours. If a patient asks you what a software vendor holds about them, the answer is: nothing.
If you are not satisfied with our response you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), or, on a matter of personal health information in Ontario, to the Information and Privacy Commissioner of Ontario (ipc.on.ca).
Our handling of your practice’s information is governed by the federal Personal Information Protection and Electronic Documents Act (PIPEDA), and this policy is written to satisfy its ten fair information principles: accountability, identifying purposes, consent, limiting collection, limiting use and disclosure and retention, accuracy, safeguards, openness, individual access, and the right to challenge our compliance. Dakota Code Lab is accountable for the information in its custody, including information passed to the service providers named above.
Our approach to limiting collection is the strong one: the product is built so that the information we would otherwise have to protect is never collected in the first place.
In Ontario, a dental practice is a health information custodian under the Personal Health Information Protection Act, 2004 (PHIPA), and is responsible for the personal health information in its custody. Software vendors normally enter that picture as an agent or as a supplier of goods and services, and a custodian must be able to account for what its agents do with patient information.
ADIR is designed so that this question has the simplest possible answer. Because patient information is processed only on the practice’s own computers and its own network folder, and is never transmitted to us, we do not receive personal health information and do not hold any as your agent. Your PHIPA obligations for that data are met on your own equipment, under your own control, with your own safeguards.
What that does not do is relieve you of your own duties. You remain the custodian. Keeping the computers ADIR runs on secure, controlling who can open the shared folder, and reviewing what ADIR posts before you rely on it are yours, and PHIPA expects you to be able to show it. ADIR’s audit trail and Safe Mode exist partly to make that showing easy.
If you require a written agreement covering a vendor’s handling of personal health information, ask us and we will sign one.
For practices in the United States, the Health Insurance Portability and Accountability Act (HIPAA) governs protected health information (PHI), and a vendor that creates, receives, maintains or transmits PHI on a covered entity’s behalf is a business associate and must sign a Business Associate Agreement.
ADIR’s architecture is the reason this is straightforward: because the software runs entirely on the practice’s own equipment and no PHI is transmitted to us, maintained by us or accessible to us, we do not act as a conduit or custodian for PHI. Where a covered entity nonetheless requires a Business Associate Agreement before deploying a vendor’s software — which is a reasonable and common position — we will enter into one on request. Write to privacy@adirdental.com.
Nothing in this section is a representation that your practice is HIPAA compliant. Compliance is an attribute of your organisation and its whole environment, not of any one piece of software.
If you ask to be told when ADIR supports your practice management software, the form on our home page opens your own mail program with a message ready to send. Nothing is submitted to a server by the page itself — you press send, and it arrives as an ordinary email to hello@adirdental.com.
We use your address for one thing: telling you when that software is supported, or answering you if you asked something. We do not add you to a marketing list, we do not sell or rent the list, and we do not share it. Ask us to remove you at any time and we will, immediately and without asking why.
If we later move this to a mailing service — which is likely as the list grows — that provider will process the addresses on our behalf under contract, it will still not be sold or shared, and we will name the provider on this page before the change takes effect.
Today this website sets no analytics, advertising or tracking cookies at all, and we run no analytics product on it. The only cookies it can set are the ones behind the password prompt on our restricted pages, which remember that a password was entered correctly. Those are strictly necessary and cannot be turned off without breaking the page they protect.
We expect to add basic traffic analytics — how many people visit, which pages they read, roughly where they arrive from — so we can tell which parts of the site are doing their job. When we do:
We will name the analytics provider here before switching it on, and update the date at the top of this page. Cookies are only ever set by this website — the ADIR software you install sets none, because it is not a website.
Pages load typefaces from Google Fonts, which means Google receives the IP address of visitors as part of serving those files. Our hosting and network providers keep ordinary server logs for security and reliability.
ADIR is sold to dental practices and is not directed at children. We do not knowingly collect personal information from children through this website or the software.
If this policy changes materially we will say so on this page and update the date above. Where the change affects information we already hold about you, we will tell you directly.
Questions, requests or complaints about privacy: privacy@adirdental.com. That address reaches a person, and it is also the address to use for a PHIPA agreement or a HIPAA Business Associate Agreement.