Privacy policy
Effective 19 October 2026
This policy covers Zabcho: the web app at app.zabcho.com and the Zabcho for doctors app for Android (Зъбчо за лекари). It explains what data we collect, what we use it for, who we share it with and what your rights are.
Who we are
Zabcho (zabcho.com) provides software for dental practices. For any question about privacy, email us at asavchev@wedo.today.
Zabcho is for the doctors, coordinators and administrators of dental practices. Patients don't use the app, and it is not meant for children.
Who is responsible for the data
Patient data is entered by the dental practice. The practice is the controller of that data; Zabcho processes it on the practice's behalf and only on its instructions.
User data (doctors' and coordinators' accounts) is processed by Zabcho as the controller.
What data we collect
- Account: first, middle and last name, username, email, phone, UIN, profile photo, practice or clinic and role. Passwords are kept only as a one-way hash (bcrypt).
- Patient data entered by the practice: names, personal ID number (ЕГН), phone, email, notes, allergies and other health data, treatments, prices and payments, tooth charts and appointments.
- Technical data: sign-in sessions (when, and from which browser or device), failed sign-in attempts and an audit log of actions (who changed what, and when).
- Notifications: if you allow them, your device's Firebase Cloud Messaging address, its platform and language.
We don't collect your location, contacts or files from your device. We use no advertising, analytics or tracking, and we don't sell data.
What we use it for
- to run the service: sign-in, patient records, treatments, tooth charts and the schedule;
- to notify you of upcoming and changed appointments, if you allowed notifications;
- for security: locking accounts after repeated wrong passwords, the audit log and investigating abuse;
- for support: at your request a Zabcho administrator can sign in as a doctor; such a session is short and every action in it is written to the audit log.
The legal bases are our contract with the practice, our legitimate interest in keeping the service secure, and our legal obligations. For patient data, the practice determines the basis.
Who we share it with
- Google (Firebase Cloud Messaging) delivers notifications to phones and browsers. A notification contains the patient's name and the time of the visit. Google may process this data outside the European Union under standard contractual clauses.
- Hosting and database providers, which store the data on our behalf and on our instructions.
- Public authorities, only when the law requires us to.
Each doctor sees only their own patients, and coordinators see the patients of the practices in their clinic.
How we protect it
Connections use HTTPS only. Sign-in sessions expire after 15 minutes and renew automatically, and a stolen renewal token is detected and ends the session. The mobile app keeps the session in the device's secure storage.
Cookies and browser storage
The web app uses one necessary cookie for the sign-in session (HttpOnly, not readable by scripts) and keeps your chosen language and theme in the browser. The zabcho.com site uses no cookies.
How long we keep it
- accounts: while active; after a deletion request, up to 30 days;
- patient data: as long as the practice decides and the law on medical records requires;
- deleted records: in the bin, restorable for 30 days, until deleted for good;
- the audit log: 12 months;
- backups: up to 30 days.
Your rights
You have the right to access your data, to have it corrected or deleted, to restrict its processing, to data portability and to object. Email us at asavchev@wedo.today; we reply within 30 days. How to request deletion of your account or some of your data is described in “Delete your account and data”.
If you are a patient, please contact your dentist: the practice decides on your data, and we act on its instructions.
You have the right to complain to the Bulgarian Commission for Personal Data Protection (www.cpdp.bg).
Changes
When we change this policy, we publish the new version here with its new effective date.