Reenev Privacy Policy

Effective date: November 5, 2026

Last updated: November 5, 2026

1. About this policy

Reenev is a dental laboratory management service for laboratories, dental professionals, and their authorized personnel. This Privacy Policy explains how Colideas Inc. (“we,” “us,” or “our”) collects, uses, shares, protects, and deletes personal information through the Reenev Android app, iOS app, web application, and related services.

Our contact details are listed in Section 13. This policy covers our handling of personal information. A laboratory or dental practice may also provide its own privacy notice for the patient and business records it manages through Reenev.

2. Our role and your organization’s role

We determine how personal information is used to operate Reenev accounts, manage our customer relationships, secure the service, and provide support. When a laboratory or dental practice uploads patient, employee, or client information, we generally process that information on its behalf and according to its instructions and our service agreement. The organization determines the purpose of those records, who may access them, and any applicable recordkeeping obligations.

Organizations and users must have appropriate authority and a lawful basis to upload and share information, including sensitive patient information. They should use patient codes or other limited identifiers where practical and upload only information needed for the work.

3. Information we collect

The information processed depends on your role, the features enabled by your organization, and what you or authorized users provide:

• Account and contact information: names, email addresses, telephone numbers, login credentials, user identifiers, roles, and organization or laboratory details.

• Dental case and patient information: patient names or identifiers, relevant demographic details, prescriptions, dental instructions, tooth and restoration details, case notes, photographs, scans, models, and other uploaded files. These records may contain sensitive health information.

• Operational information: job orders, production stages, assignments, deadlines, pickup and delivery details, addresses, inventory transactions, and activity histories.

• GPS and location information: precise or approximate device location, collection timestamps, and associated work activity when an applicable package or company setting enables location collection and the required permissions are granted, as explained in Section 4.

• Communications and support: messages, comments, attachments, support requests, and information you provide when contacting us.

• Billing information: billing contacts, subscription details, invoices, and payment references or status. Reenev receives only payment references for payment transactions. Card details do not pass through Reenev and are not stored by Reenev.

• Technical and security information: IP addresses, app and operating system versions, device or installation identifiers, push notification tokens, access times, audit logs, and error or crash information, to the extent collected by the deployed app and its providers. Crash analytics may be collected to identify errors and improve app reliability.

We receive information directly from you, from your organization and authorized collaborators, and from service activity. Connected systems may provide information when an authorized user enables an integration.

4. App permissions and device access

Where the released app offers these functions, it may request:

• Camera access to photograph case materials or scan QR codes.

• Photo or file access to attach files you select or save exported records.

• Notification permission to deliver case updates, assignments, messages, and service alerts.

You can manage permissions through device settings. Refusing a permission may prevent the related feature from working. Files and photographs you submit are uploaded to the service and made available according to the record’s access settings.

GPS and location collection

Some Reenev packages and company settings enable location-based features. When an applicable feature is enabled for your account and you grant the required device permissions, Reenev may collect your device’s precise GPS location or approximate location, together with the date, time, and associated user or work activity. Collection depends on the feature in use, your organization’s configuration, and your device permissions.

Location information is used to monitor employee performance and track field activities. Collection occurs only while the employee is timed in and the applicable location feature and permissions are enabled. Collection stops when the employee times out. Reenev does not collect device location for these features outside the timed-in work session.

Before collecting location, Reenev provides an in-app disclosure explaining the purpose of collection and requests the required permission. Enabling a package or company setting does not replace the required user disclosure and permission. Location collection is limited to the time when the app is in use during a timed-in work session.

Reenev does not collect GPS location in the background. Location collection stops when the app moves to the background or the employee times out.

Location records are transmitted to Reenev and may be accessed by authorized company administrators, supervisors, or operational personnel according to their roles. Service providers may process these records as needed to operate the feature. Sharing location with another organization follows the authorized sharing rules described in Section 6.

You can refuse or revoke location permission through your device settings. Doing so may prevent location-dependent features from working. Your organization controls whether the relevant package or company feature is enabled. Revoking permission prevents further device location collection through that permission but does not automatically delete records already collected. You may request access to or deletion of those records as described in Section 9.

5. How we use information

• Create and authenticate accounts and manage organization access.

• Process dental laboratory cases, coordinate production, and arrange pickups and deliveries.

• Enable authorized communications, file sharing, notifications, and connected workflows.

• Monitor employee performance and track field activities during timed-in work sessions where location features are enabled, as described in Section 4.

• Manage subscriptions, billing, customer service, and support.

• Maintain service reliability, investigate errors, prevent misuse, and protect accounts and records.

• Meet applicable legal obligations and resolve disputes.

Where applicable, processing is based on performing our agreements, complying with legal obligations, legitimate operational interests, or consent. Sensitive information requires an appropriate legal basis, which may include explicit consent or another basis permitted by applicable law. A device permission alone does not replace the legal basis needed to process patient information.

6. Sharing and service providers

Information may be shared with:

• Your organization and authorized collaborators: administrators, laboratory personnel, dental professionals, and other recipients given access to the relevant records.

• Connected organizations: a selected laboratory, practice, or other connected organization when an authorized user submits a request, shares a case, or initiates a connected workflow. The receiving organization handles received records under its own responsibilities and privacy notice.

• Service providers: providers of hosting, storage, email, SMS, push notifications, payments, diagnostics, and support, only as needed for their services and subject to appropriate contractual protections.

• Legal or business recipients: competent authorities where legally required, parties needed to protect rights or security, or parties involved in a merger or business transfer subject to appropriate safeguards and applicable notice requirements.

Advertising, sale, and tracking: We do not sell personal information or track users across other companies’ apps or websites. GPS collection for enabled employee and field activity functions is described separately in Section 4.

7. Optional artificial intelligence features

When you choose an AI feature, Reenev displays a confirmation screen before submitting your question for AI processing. You may decline by not confirming the request. Reenev logs AI questions; personal details, patient records, and case attachments are not sent to AI services.

Do not include names, contact details, patient identifiers, or other personal information in AI questions.

8. Retention

Account and profile information, organization and patient records, case files and attachments, GPS history, logs, support records, and billing records are retained until deleted by an authorized user or through an approved deletion request, subject to applicable legal retention requirements. Account deletion requests are processed within 48 hours, as described in Section 9.

Where a record must be retained to meet a legal obligation, access and use are limited to that purpose. We explain the reason and applicable retention period when handling the deletion request.

9. Account deletion and privacy requests

To request deletion of your Reenev account and associated personal information, email support@reenev.app with the subject Attention: Account Removal. Include the email address associated with your Reenev account so we can identify the account. We may reasonably verify your identity before acting on a request. You do not need to reinstall the app to submit an email request.

We complete deletion within 48 hours, subject to applicable legal requirements. Deactivation alone is not deletion. We also instruct our service providers to delete applicable information processed on our behalf.

Deleting your account does not automatically erase every record lawfully maintained by a laboratory or practice, such as a patient case record that must be retained under an applicable legal obligation. We assess requests for those records with the responsible organization, remove personal information where appropriate, and explain any information retained, the reason, and the retention period. An organization’s preference alone does not justify keeping information indefinitely.

Subject to applicable law, you may request access, correction, deletion, restriction, objection, or a copy of your information, and withdraw consent where processing depends on consent. Withdrawing consent does not affect earlier lawful processing. For organization-controlled patient records, contact the relevant laboratory or practice; we can help direct your request.

10. Security

We use safeguards appropriate to the information processed, including role-based access controls and encrypted HTTPS connections for data transmitted between the app and our service. No system can guarantee complete security. Users should protect their credentials and promptly report suspected unauthorized access.

11. Children and patient records

Reenev is intended for authorized professional and organizational users and is not directed to children. Authorized professionals may enter records relating to minor patients where permitted by law and with any required parent or guardian authorization. Such records receive the protections described in this policy. Contact us if you believe a child has created an account or information has been submitted without appropriate authority.

12. Changes to this policy

We may update this policy as the service or our practices change. We will publish the revised policy with an updated date and provide additional notice or obtain consent where required for material changes.

13. Contact us

Reenev privacy contact

Operator: Colideas Inc.

Email: privacy@colideas.com

Account deletion: support@reenev.app

Email subject: Attention: Account Removal

If Philippine data protection law applies, you may also raise privacy concerns with the National Privacy Commission. This does not prevent you from exercising rights before another competent data protection authority.