Privacy policy

Home Privacy policy

Table Of Contents

show

Privacy Policy

Part A — Privacy Policy

Last updated: 28 October 2026

This policy explains what personal data eZtain Lab collects, why, how long it keeps it, who receives it and how you can exercise your rights. It applies to the eztain.com website, the practitioner area, orders for devices, our forms, our telephone message service and our business communications. Our use of cookies is described in our Cookie Policy.

1. Who is responsible for your data?

eZtain Lab, a French simplified joint-stock company (SAS) with share capital of €31,000, 3 rue Marie Hamm, 67000 Strasbourg, France. Registered with the Strasbourg Trade and Companies Register (RCS) under number 951 635 143. EU VAT number FR83 951 635 143.

eZtain Lab has not appointed a data protection officer. For any question about your data, or to exercise your rights, write to contact@eztain.com (subject: “Personal data”) or by post to the address above. Telephone: +33 9 87 39 43 80.

2. The data we process, depending on who you are

For each category of people, we state the data, what we use it for (the purpose), what allows us to process it (the legal basis, under Article 6 GDPR) and how long we keep it. The table in section 3 summarises retention periods.

2.1 Practitioner customers and users of the practitioner area

Data: first name, last name, company or practice, email address, WhatsApp number, delivery and billing addresses, SIREN and VAT number (or foreign equivalent), password (stored in encrypted form by the website), technical preferences (for example how to handle a deep bite), chosen payment method, order history, invoices and payments, exchanges with our team (email, WhatsApp, telephone), and your choice whether to receive our notifications and communications.
Purposes and legal bases:
- creating and managing your account, checking that you are a dental professional, processing your orders, manufacturing and delivering your devices, keeping you informed of your orders, customer service: performance of the contract (Art. 6(1)(b));
- invoicing, collecting payments, bookkeeping, and the traceability required of a manufacturer of custom-made medical devices: legal obligations (Art. 6(1)(c));
- sending you information about our products and services, securing the website, preventing fraud, recovering unpaid invoices, improving our services: eZtain Lab’s legitimate interest (Art. 6(1)(f)). You can object to marketing communications at any time, free of charge, using the link in each email or by writing to us.
Retention: as long as your account is open, and no longer than 10 years after your last order, so that you keep access to the traceability records of your devices. After the account is closed, the data needed for the manufacturing documentation are kept for 10 years after the last manufacture; other data are deleted. Invoices and accounting records are kept for 10 years from the end of the financial year (Article L123-22 of the French Commercial Code).

2.2 Practitioner map

From their first order, a practitioner customer appears on the map of practices offering the eZtain retainer, so that patients can find a practitioner near them.

Data published: title (Dr), first and last name of the practitioner, address of the practice.
Legal basis: the legitimate interest of eZtain Lab and of its practitioner customers in making known the practices that offer its devices (Art. 6(1)(f)).
Your right: you can ask at any time to be removed from the map, by simple email to contact@eztain.com. We remove you without undue delay, without you having to give reasons and with no effect on your orders (right to object, Art. 21).
Retention: as long as your account is open and you have not objected.

2.3 Practitioner prospects

Data: last name, first name, practice, profession, city, email address, telephone number, approximate number of retainers fitted per month, exchanges with our team. We receive this data through our forms, through lead forms in social media advertising (Meta; LinkedIn where applicable), at trade shows and conferences, or when you book an appointment online.
Purposes: answering your request, presenting our devices, sending you professional information by email, telephone or WhatsApp.
Legal basis: pre-contractual steps taken at your request (Art. 6(1)(b)) and our legitimate interest in contacting professionals about a subject related to their work (Art. 6(1)(f)). You can object at any time, free of charge (Article L34-5 of the French Post and Electronic Communications Code).
Retention: 3 years after your last contact with us.

2.4 Patients and parents who fill in our information form

Our “eZtain retainer” page offers a form to receive information about our retainers, for yourself or for your child. Similar forms may appear in our social media advertising (Meta).

Data:
- first name, last name, email address;
- who you are enquiring for (yourself or your child);
- information about the treatment: stage of orthodontic treatment, problems experienced with a retainer (debonding, breakage, tartar, irritation, reaction to metal, teeth moving…) and how often. This is health data, and it may concern a child;
- the name or city of your orthodontist;
- the date of your request and your consent choices;
- where your visit came from: landing page, referring website, campaign parameters (UTM) and, if you have accepted advertising cookies, the identifier of the ad click that brought you to the website (gclid for Google, fbclid for Meta, li_fat_id for LinkedIn).
Purposes:
- sending you by email, for 2 months (1 month for the English sequence), information and advice about retainers suited to your situation;
- if you separately agree, letting your orthodontist know that you are interested in the eZtain retainer;
- measuring the effectiveness of our advertising and producing anonymous statistics on patients’ needs.
Legal basis: your consent, given by ticking separate boxes that are not pre-ticked:
- a box required to send the form, covering the use of your treatment information and the sending of emails (explicit consent for health data, Art. 9(2)(a) GDPR, and consent to email marketing, Article L34-5 of the French Post and Electronic Communications Code);
- an optional box for us to inform your orthodontist.
You can withdraw your consent at any time, without giving reasons: unsubscribe link in each email, or email to contact@eztain.com. Withdrawal does not affect what was done before.
What we do not do: we do not pass your answers about your treatment to advertising platforms (Google, Meta, LinkedIn, OpenAI). Only the fact that a form was sent may be reported to them, and only if you have accepted the relevant cookies. We do not pass your email address to advertising platforms. We do not upload our contact lists to them. We only inform your orthodontist if you have ticked the box provided.
Retention:
- in our email tool (Pipedrive): until the last email of the sequence, i.e. 2 months (1 month in English), then automatic deletion;
- in our tracking spreadsheet: your first name, last name and email address are erased after 2 months (1 month in English), or after 12 months if you agreed that we may inform your orthodontist. Only anonymous answers then remain, which no longer identify you and are used for our statistics.
Minors: if you are under 15, the form must be filled in with one of your parents (see section 10).

2.5 Patients whose data is sent to us by their practitioner

This section concerns you if your practitioner has ordered from eZtain Lab a custom-made retainer or aligner for you. This data is not collected from you: we inform you here under Article 14 GDPR.

Data received: a patient identifier chosen by your practitioner (a file number, or sometimes your first and last name), the digital impression of your teeth (intraoral scan) and the prescription (type of retainer, arch, options). We ask for no photograph, no date of birth and no address. This is health data.
Source: your practitioner, through the order form on our website or through the Digilab platform, which collects the impressions sent by practices’ intraoral scanners.
Purposes: designing and manufacturing your custom-made device, checking its quality, delivering it to your practitioner, keeping the manufacturing documentation required of a manufacturer of custom-made medical devices (Regulation (EU) 2017/745, Annex XIII), handling any complaint or incident.
Legal bases:
- under Article 6 GDPR: our legal obligations as a manufacturer (Art. 6(1)(c)) and our legitimate interest in fulfilling the orders of our practitioner customers (Art. 6(1)(f));
- under Article 9 (health data): the processing is necessary for your care, on the basis of the contract with your practitioner, a health professional (Art. 9(2)(h)), and for the quality and safety of medical devices (Art. 9(2)(i)). Our staff are bound by confidentiality.
Our role: for manufacturing and its obligations as a manufacturer, eZtain Lab acts as controller. Your practitioner remains responsible for the data processed in their practice and for their prescription.
Data minimisation: internally, we work with the order number, not your name. Your name does not appear in our sales management tool, on shipping labels or in our messaging tools. When we use an online impression-editing software (Medit), the scan is uploaded under the order number only. We recommend that our practitioners use a non-nominative identifier.
Hosting: impressions sent through our website are hosted by OVH, a provider certified for hosting health data (HDS) in France, as certified by our technical provider. Digilab states that it hosts data in France on HDS-certified infrastructure. Files are then kept on a storage server located on our premises, in a secured server room.
Retention: 10 years after the device is manufactured, then deletion at the annual purge following that date. This period matches the minimum set for documentation of custom-made devices (Annex XIII of Regulation 2017/745) and the 10-year period of liability for defective products (Article 1245-15 of the French Civil Code). During that period, impressions from which we have removed any name and any patient identifier may be used to improve our design tools, on our local servers.
Your rights: you can exercise them through your practitioner, who will pass on your request, or directly with us (section 8). If your practitioner used a file number, we cannot identify you without their help: give us your practitioner’s name and the approximate date the device was fitted.

2.6 People who call us (voice message service)

When you call the laboratory, you may be greeted by eZtain’s virtual assistant, an artificial intelligence system that tells you so at the start of the call. It works like a message service: it records your message, can answer simple questions and sends a summary to our team so that they can call you back.

Data: your telephone number, the recording of your voice, the transcript and summary of the call, and the information you give (name, practice, reason for calling).
Purposes: taking your message, answering common questions, calling you back.
Legal basis: eZtain Lab’s legitimate interest in handling calls received when the team is unavailable (Art. 6(1)(f)), and pre-contractual steps or performance of the contract when you are a prospect or customer (Art. 6(1)(b)).
Retention: recordings and transcripts: 90 days at our provider. Summary sent to the team: 1 month, deleted automatically. Information useful to the business relationship is then added to your customer or prospect record (sections 2.1 and 2.3).
Tip: do not leave medical information about a patient in your message. Give the order number instead.

Data: last name, first name, telephone number, email address, message; for online appointment booking (Calendly): the chosen time slot and your answers to the questions asked; for our social media accounts: your public comments and messages.
Purposes: answering your request, organising the appointment, replying to comments on our accounts.
Legal basis: pre-contractual steps taken at your request (Art. 6(1)(b)) or our legitimate interest in answering people who contact us (Art. 6(1)(f)).
Retention: the time needed to handle your request. If you are a professional interested in our devices, your data then joins our prospect file (section 2.3). Please do not send medical information through this form.

2.8 Website visitors

Data: technical connection data (IP address, browser, pages viewed, date and time), recorded by our hosting provider for website security; cookie-related data, depending on your choices.
Purposes and legal bases: running and securing the website: legitimate interest (Art. 6(1)(f)). Audience measurement, advertising and third-party content: your consent, collected through our cookie banner (see the Cookie Policy).
Retention: technical logs: 12 months at most. Cookies: see the Cookie Policy.

3. Retention periods

Data	Period	Then
Account and relationship with a practitioner customer	As long as the account is open, and no longer than 10 years after the last order	Deletion, except the manufacturing documentation (10 years after the last manufacture)
Invoices and accounting records	10 years from the end of the financial year	Deletion
Impressions, prescriptions and manufacturing documentation	10 years after manufacture	Deletion at the annual purge
Listing on the practitioner map	As long as the practitioner’s account is open and they have not objected	Removal from the map
Practitioner prospects	3 years after their last contact	Deletion
Patient prospects: email tool	2 months (FR) or 1 month (EN), end of the sequence	Automatic deletion
Patient prospects: tracking spreadsheet, without agreement to inform the orthodontist	2 months (FR) or 1 month (EN)	Identity erased, answers kept in anonymous form
Patient prospects: tracking spreadsheet, with agreement to inform the orthodontist	12 months after the request	Identity erased, answers kept in anonymous form
Call recordings and transcripts	90 days	Deletion by the provider
Contact form requests	Time needed to handle the request	Deletion, or prospect file
Record of your cookie choice	6 months	New consent request
Website technical logs	12 months at most	Deletion

These periods may be extended if data is needed to establish, exercise or defend legal claims, for the duration of the proceedings.

4. Health data: our commitments

We process two types of health data: impressions and prescriptions received from our practitioners (section 2.5), and patients’ answers to our information form (section 2.4). For this data:

we collect only what is necessary: an identifier chosen by the practitioner, the scan and the prescription; no photograph, no date of birth;
internally we work with the order number, and the patient’s name does not circulate in our sales tools, our messaging tools or with our carriers;
impressions are hosted by providers certified for health data (OVH, Digilab), then on a server located on our premises, in a secured room;
our design and manufacturing software runs locally, in the laboratory; our artificial intelligence tools applied to impressions also run locally, without sending data to an online service;
we do not use impressions for research. To improve our design tools, we only use impressions without any name or patient identifier, processed locally;
we never pass the answers to the patient form to an advertising platform.

5. Who receives your data?

Your data is processed by the eZtain Lab team, limited to what each person needs. We do not sell your data.

It may be shared with:

our processors, who process it on our behalf and on our instructions, under a contract that complies with Article 28 GDPR (table below);
partners acting on their own behalf: carriers (TNT/FedEx, UPS, La Poste/Colissimo) to deliver parcels, payment providers for their own obligations, and advertising platforms (Google, Meta, LinkedIn, OpenAI) for the cookies you have accepted;
your orthodontist, only if you have agreed (section 2.4);
our advisers and our chartered accountant, who are bound by professional secrecy, and authorities that request it in the cases provided by law;
our authorised representative in Switzerland or the United Kingdom, where applicable, for regulatory information about the devices only.

Category	Provider	Data concerned	Location and safeguards
Hosting of the website and impressions	OVH (France)	All website data, impressions and prescriptions	France, HDS-certified host
Impression aggregation	Digilab	Impressions, patient identifier, prescription	France, HDS-certified infrastructure (according to Digilab)
Impression editing	Medit (Medit Corp., South Korea)	Impressions under the order number only	South Korea (EU adequacy decision); storage with Amazon Web Services, in the United States or Europe according to Medit
Email	IONOS (France / Germany)	Emails exchanged	European Union
Sales management and emailing	Pipedrive (Estonia)	Practitioners, prospects, patient prospects (first name, last name, email)	European Union (Frankfurt or Dublin data centres); sub-processors outside the EU covered by Pipedrive (Data Privacy Framework or standard contractual clauses)
Task automation	Make (Celonis group)	Data passing between our tools	European data zone; some services, including AI-assisted web search, run in the United States. Celonis Inc. is certified under the EU–US Data Privacy Framework
Patient request tracking spreadsheet	Google (Google Sheets)	Answers to the patient form	Business Google Workspace account under a processing agreement; Google LLC certified under the Data Privacy Framework
Artificial intelligence	OpenAI (OpenAI Ireland Ltd, via Make)	Practitioner registration data; business questions	Transfers outside the EU covered by standard contractual clauses
Voice assistant	Autocalls (MULTICODE S.R.L., Romania)	Calls, recordings, transcripts	European Economic Area and/or United States, with the Data Privacy Framework or standard contractual clauses (according to Autocalls)
Internal notifications	Telegram (Telegram Messenger Inc.)	Call summaries and internal alerts (order numbers, business contact details)	Data of European accounts stored in the Netherlands (according to Telegram); company located outside the EU, with no specific processing agreement
Automatic WhatsApp messages	Green-API (Kazakhstan)	WhatsApp number and service messages to practitioners	See section 6
WhatsApp messaging	WhatsApp (Meta group)	Number, messages, files exchanged	European Union and United States, under WhatsApp’s terms
Accounting and invoicing	Pennylane (France)	Invoices, billing details	Ireland (AWS) and France; sub-processors outside the EU covered by standard contractual clauses (according to Pennylane)
Card payment	Stripe	Payment data (eZtain does not store card numbers)	Transfers to the United States covered by the Data Privacy Framework and standard contractual clauses
SEPA direct debit	GoCardless (GoCardless SAS, Paris)	IBAN, mandate, contact details	European Union. Possible transfers to the United Kingdom.
Shipping labels	Sendcloud (Sendcloud B.V., Netherlands)	Practitioner and practice name, address, telephone, email	European Union; some sub-processors in the United States
Accounting	In Extenso (chartered accountant, Colmar)	Invoices, payments, accounting records	France
Appointment booking	Calendly (Calendly LLC, United States)	Name, email, time slot, answers	United States; Data Privacy Framework and standard contractual clauses
Cookie management	Axeptio (France)	Your consent choices	France, HDS-certified host
Website and advertising	MEDIWEB (website design and maintenance); Guillaume Lang – ACQLY (management of our advertising campaigns)	Technical access to the website and advertising tools	France

6. Transfers of data outside the European Union

Some providers are located, or use sub-processors located, outside the European Union. A transfer is only allowed if the country offers a level of protection recognised by the European Commission (adequacy decision) or if appropriate safeguards are in place, such as the Commission’s standard contractual clauses (Articles 44 to 49 GDPR).

United States: transfers to companies certified under the EU–US Data Privacy Framework benefit from the European Commission’s adequacy decision of 10 July 2023. Other transfers rely on standard contractual clauses.
South Korea (Medit): European Commission adequacy decision.
Kazakhstan (Green-API): our tool for sending automatic WhatsApp messages to practitioners is provided by Green-API LLC, a company established in Kazakhstan, whose servers may be located in Germany, Russia, Brazil or India. This country does not benefit from an adequacy decision and this provider does not currently offer standard contractual clauses. Only the practitioner’s business WhatsApp number and service messages (welcome, incomplete prescription) pass through it, with no patient data. We are working on replacing this service with a compliant solution.

You can obtain a copy of the applicable safeguards by writing to contact@eztain.com.

7. Artificial intelligence and automated decisions

We use artificial intelligence tools to save time on administrative tasks:

voice assistant (Autocalls): it takes messages from callers and answers simple questions. It introduces itself as a virtual assistant;
OpenAI, via Make: formatting practitioners’ registration data and preparing draft answers to business questions, which our team reviews;
AI-assisted web search (Make): identifying the practice of the orthodontist named in the patient form;
local tools: our AI tools applied to impressions run on our own machines, without sending data to an online service.

None of these tools makes a decision that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR. Decisions (opening an account, accepting an order, answering a complaint) are made by our team.

8. Your rights

You have the following rights over your data (Articles 15 to 22 GDPR):

access: to know whether we process your data and obtain a copy;
rectification: to correct inaccurate or incomplete data;
erasure: to have your data deleted, unless we must keep it, for example under our obligations as a manufacturer or our accounting obligations;
restriction: to temporarily freeze the use of your data;
portability: to receive the data you provided to us in a common format, where processing is based on your consent or on a contract;
objection: to object to processing based on our legitimate interest, and at any time to marketing;
withdrawal of consent, at any time, without affecting what was done before;
instructions on what happens to your data after your death (Article 85 of the French Data Protection Act).

How to exercise them: by email to contact@eztain.com or by post to eZtain Lab, 3 rue Marie Hamm, 67000 Strasbourg, France. We reply within one month, which may be extended by two months for a complex request; in that case we will let you know. We may ask for additional information if we have reasonable doubts about your identity.

Complaints: if you consider that your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority: online at cnil.fr/fr/plaintes, or by post to CNIL, Service des plaintes, 3 place de Fontenoy, 75007 Paris, France. You may also contact the supervisory authority of the EU country where you live or work.

People in Switzerland: the Federal Act on Data Protection (FADP) applies to processing that has effects in Switzerland (Art. 3 FADP). You have the rights it provides, which you can exercise with us in the same way, and you can contact the Federal Data Protection and Information Commissioner (FDPIC), who may open an investigation following a report (Art. 49 FADP).

9. Security

We protect your data with measures suited to its sensitivity: hosting of impressions by HDS-certified providers, local storage server in a secured server room, access limited to the team members who need it, working with order numbers rather than names, encrypted connection to the website (HTTPS), and contracts with our processors. The local server and its backups are encrypted, and two-factor authentication is enabled on our tools. In the event of a data breach presenting a risk, we notify the CNIL and, if the risk is high, the people concerned (Articles 33 and 34 GDPR).

10. Minors

Our practitioner area and our sales are intended exclusively for professionals. Our patient information form may be filled in by a parent for their child: the parent then gives consent. In France, a minor may consent alone from the age of 15; below that age, consent must be given jointly by the minor and the holder(s) of parental authority (Article 45 of the French Data Protection Act). Impressions of minor patients received from their practitioner are processed in the same way as those of adults (section 2.5).

11. Changes

We may change this policy to reflect changes to our services, our providers or the law. The date of the last update appears at the top of the page. In the event of a significant change, we will inform our practitioner customers by email.

12. Language

This policy is available in French and English. In the event of any discrepancy, the French version prevails.

Last updated: 28 October 2026

This policy explains which cookies and other trackers the eztain.com website uses, what they are for and how you can accept or refuse them. It supplements our Privacy Policy. The controller is eZtain Lab, 3 rue Marie Hamm, 67000 Strasbourg, France (contact@eztain.com).

A cookie is a small file stored in your browser when you visit a website. Other techniques work in the same way, such as the browser’s local storage or pixels. We call them all “trackers”. Some are necessary for the website to work; the others are only placed or read with your agreement (Article 82 of the French Data Protection Act).

2. Your choice

On your first visit, a banner (Axeptio) lets you accept or refuse trackers, all at once or service by service. Refusing is as easy as accepting, and refusing does not prevent you from using the website.

Until you have made a choice, no tracker requiring consent is placed or read.
Your choice is kept for 6 months. We then ask you again, as recommended by the CNIL.
You can change your mind at any time using the “Manage my cookies” link at the bottom of each page. If you withdraw your agreement, the trackers concerned stop being used.
You can also block or delete cookies in your browser settings.

We limit the lifetime of the trackers we configure to 13 months at most. The lifetimes of third-party trackers are shown in the table below.

3. Categories of trackers

Strictly necessary: they allow the website to work (login to the practitioner area, language, form security) and remember your cookie choice. They do not require your agreement.
Audience measurement: they tell us how many people visit the website, where they come from and which pages they view. They require your agreement.
Advertising and campaign measurement: they tell us whether a visit or a form submission follows one of our ads (Google, YouTube, Meta, LinkedIn, ChatGPT), and let us show you our ads again on Facebook and Instagram. They require your agreement.
Third-party content: the Google Maps map, the Calendly booking module and the WhatsApp button may place their own trackers. They require your agreement; if you refuse, this content may not be displayed and a direct link is offered instead.

4. List of trackers

Service	Category	Provider	Purpose	Main trackers	Lifetime
Axeptio	Strictly necessary	Axeptio (France)	Remember your cookie choices	axeptio_cookies, axeptio_authorized_vendors, axeptio_all_vendors	6 months
WPML	Strictly necessary	eZtain Lab (website plugin)	Remember the website language	wp-wpml_current_language, _icl_visitor_lang_js	Short lifetime set by WPML (not published by the vendor)
Practitioner area	Strictly necessary	eZtain Lab	Keep you logged in	WordPress session cookies	End of the browsing session, or 14 days if you tick “Remember me”
Practitioner list (patient form)	Strictly necessary	eZtain Lab	Suggest your orthodontist’s name as you type	Local storage ez_prat_v6	Refreshed every 24 hours
Google reCAPTCHA	Strictly necessary (security)	Google	Protect forms against bots	_GRECAPTCHA (cookie and local storage)	6 months
Google Tag Manager	—	Google	Tool that triggers the other tags according to your choices; places no cookie itself	—	—
Google Analytics 4	Audience measurement	Google	Visit statistics, traffic sources, browsing paths	_ga, ga<identifier>	13 months
Google Ads	Advertising	Google	Measure visits and forms resulting from our Google and YouTube ads	_gcl_au, _gcl_aw, local storage _gcl_ls; IDE (doubleclick.net)	90 days; IDE: 13 months
Meta Pixel	Advertising	Meta (Facebook, Instagram)	Measure the effectiveness of our ads and show them to you again	_fbp, _fbc; fr (facebook.com)	90 days
LinkedIn Insight Tag	Advertising	LinkedIn	Measure visits resulting from our LinkedIn ads	li_fat_id and other LinkedIn cookies, local storage li_adsId	li_fat_id: 30 days; others: up to 1 year according to LinkedIn
OpenAI pixel	Advertising	OpenAI	Measure visits resulting from our ads in ChatGPT	__oppref, __obref	30 days; 12 months
Origin of your visit (form)	Advertising	eZtain Lab	Link a form submission to the ad that brought you	Local storage: ez_gclid, ez_fbclid, ez_li_fat_id, ez_utm_*, ez_landing_page, ez_referrer	Erased if you refuse or withdraw your agreement; 13 months at most
Google Maps	Third-party content	Google	Display the practitioner map	Google cookies	As set by Google
Calendly	Third-party content	Calendly	Online appointment booking	Calendly cookies	As set by Calendly
WhatsApp	Third-party content	WhatsApp (Meta)	Write to us on WhatsApp	WhatsApp cookies	As set by WhatsApp

The lifetimes given for third-party services are those published by their providers, who may change them.

5. Third-party trackers

Google, Meta, LinkedIn and OpenAI also use the data from these trackers for their own purposes, under their own policies. For the collection and transmission of data through their pixel, eZtain Lab and the provider may be regarded as joint controllers. Some of these providers transfer data to the United States, under the conditions described in section 6 of our Privacy Policy.

Find out more:

6. Language