How we handle website information.

Aya Speciality Dental Clinic, also presented on this website as Aya Dental Studio, is responsible for deciding why and how personal information submitted through this website is used.

The clinic is located at Bole Atlas Traffic Light, Landmark Plaza, 2nd Floor, Addis Ababa. Privacy questions and requests may be made by calling +251 985 200 000, contacting the clinic through its published channels, or visiting the clinic in person. Do not send medical records or detailed health information through social media or WhatsApp.

This policy applies to visits to this website, use of its contact and appointment request forms, and interactions with the embedded map and bot-protection features. It does not replace the clinic's separate notices and consent processes for dental care, patient records, imaging, prescriptions, billing, or treatment.

Depending on how you use the website, we may process:

• Your name and telephone number.
• Your preferred contact method.
• The dental service and appointment date you request.
• A short message that you choose to provide.
• Your confirmation that you have read and accepted this privacy notice.
• Technical and security information such as request time, IP address, request headers, rate-limit identifiers, Turnstile tokens, and the result of bot verification.
• Basic device or browser signals processed by Cloudflare when its hosting, security, or Turnstile services are used.

The website does not request payment-card details, government identification numbers, passwords, full medical histories, diagnostic records, or dental images through its public forms.

Physical or mental health information is sensitive personal data under Ethiopia's Personal Data Protection Proclamation No. 1321/2024. Please keep form messages brief and do not submit diagnoses, medical histories, test results, prescriptions, or other detailed clinical information through this website.

If a message incidentally contains health information, the clinic will limit its use to responding to the request, arranging appropriate follow-up, protecting vital interests, or meeting applicable legal and professional obligations. The forms are not monitored as emergency services. For urgent concerns, call the clinic or seek appropriate emergency care.

We use website information only as reasonably necessary to:

• Respond to questions and appointment requests.
• Contact you through the method you selected.
• Confirm clinic availability and prepare for a requested visit.
• Protect the forms and website from spam, abuse, fraud, and security threats.
• Operate, troubleshoot, and maintain the website.
• Comply with legal, regulatory, professional, and record-keeping obligations.
• Establish, exercise, or defend legal claims when necessary.

Processing is based, as applicable, on your consent, steps you request before receiving a service, the clinic's legitimate security and operational interests where permitted, protection of vital interests, medical-treatment grounds, and compliance with law.

The website currently relies on the following service providers:

• Cloudflare: hosts, delivers, and protects the website. Cloudflare may process IP addresses, request headers, request metadata, and browser or device signals needed to serve requests and apply security controls.
• Cloudflare Turnstile: evaluates network, browser, and device signals and issues a short-lived verification token. The website verifies that token and uses the verification result before accepting a form request.
• Upstash: provides Redis-based rate limiting. The application sends HMAC-derived rate-limit identifiers, counters, and expiry information to Upstash. It does not send raw IP addresses, names, phone numbers, messages, appointment details, or Turnstile tokens to Upstash.
• Resend: delivers successful, validated form submissions to the clinic inbox. Resend processes the submitted contact details, message, submission reference, and, for appointment requests, the selected service and preferred date, together with the email delivery metadata needed to send the message.
• Google Maps: an embedded clinic map on the contact page. Google receives information directly from your browser when the map loads.

Access inside the clinic is limited to people who need the information to respond or administer the requested service. Information may also be disclosed when required by law, to regulators or professional advisers, to protect a person's vital interests, or in connection with a lawful organizational transfer. We do not sell personal information or provide it to advertisers.

Cloudflare, Turnstile, Upstash, Resend, and Google may process technical or submitted information in countries outside Ethiopia. Aya Dental Studio will use such providers only where the clinic has assessed the processing, documented an applicable legal transfer basis, and adopted the contractual, technical, and organizational safeguards required by Ethiopian law. Locally collected personal data will be handled in accordance with applicable Ethiopian data-sovereignty and transfer requirements.

• Unsuccessful general inquiries and appointment requests are normally deleted within six months of the last related communication.
• Short-lived verification tokens are used to validate a request and are not retained by the website as patient records.
• Security and rate-limit records are kept only for the period needed to prevent abuse, investigate an incident, or meet legal obligations.
• If a request leads to treatment, relevant information may be transferred into the clinic's separate clinical record and retained under applicable clinical and legal requirements.

Information may be kept longer when required by law, necessary for a dispute or legal claim, or requested by a competent authority. It is then deleted, anonymized, or securely archived when the applicable purpose ends.

The website uses encrypted HTTPS connections, restrictive security headers, same-origin request checks, input validation, request-size limits, bot verification, rate limiting, and restricted administrative access. No internet transmission or storage system can be guaranteed completely secure.

Suspected personal-data incidents are assessed, contained, documented, and reported to the Ethiopian Communications Authority and affected individuals when notification is required by applicable law.

Subject to applicable exceptions, Ethiopian law may give you rights to be informed; to request access, correction, erasure, restriction, or portability; to object to certain processing; to withdraw consent without affecting earlier lawful processing; and not to be subject to qualifying solely automated decisions. This website does not make treatment or eligibility decisions using automated profiling.

To exercise a right, contact the clinic using the details in section 1. We may need to verify your identity and authority before acting. You may also submit a complaint to the Ethiopian Communications Authority Personal Data Protection service.

A parent or legal guardian should submit website requests for a child who cannot legally provide valid consent. The clinic will confirm identity, authority, service suitability, and any additional consent requirements before processing a child's clinical data or providing treatment.

We may update this policy when the website, providers, legal requirements, or clinic practices change. The effective date at the top identifies the current version. Material changes affecting existing information will be communicated when required by law.