Use a device you control
Local drafts are browser storage. Anyone who can use that browser may be able to access them. Use a clinic-managed device, protect its login and screen lock, and discard drafts you no longer need.
How your treatment
plans are stored.
The saved server copy contains treatment details, without the patient’s name or your personal message. Drafts stay in your browser; downloaded PDFs are yours to store and share.
What is stored, and where.
Local drafts and saved plans serve different purposes. Patient names and personal messages are excluded from the saved server copy.
| Information | Where it lives | What happens to it |
|---|---|---|
| Your working draft | The current browser on your device, including the patient’s first name, personal message and plan details. | Expires 48 hours after the last edit. The local draft is cleared after a successful final PDF, or when you discard it. |
| Saved treatment plan | A pseudonymised server copy associated with your clinic and a hashed plan code. It includes treatment details, quantities, proposed timings, prices and display choices. | Retained for one year from generation. An authorised clinic user with the plan code can recall or delete the saved copy. |
| Generated PDF | Created in your browser and downloaded to your device. | planner.clinic does not retain the PDF. Your clinic decides how to store and share the downloaded document. |
| Account and clinic information | Stored to operate your account, clinic workspace, team access, treatment library and service usage. | Kept while the account is active, and afterwards as reasonably necessary for security, support and legal obligations, as explained in the Privacy Policy. |
Recalling a plan requires
clinic access and its code.
To recall a saved plan, you need to be signed in as a member of the clinic that created it and enter its plan code. A code on its own does not grant access.
The server stores a one-way hash of the code. When a plan is recalled, you add the patient’s first name and any personal message again because those fields were not saved with it.
Editing a recalled plan creates a working copy. Generating a new final PDF gives that copy a new code and its own one-year retention period. The original saved plan keeps its original expiry date.
Protecting information in your clinic.
Keep identifying details out of plan fields
Enter only the patient’s first name in the name field. Avoid surnames, dates of birth, contact details, medical histories, photographs and other identifiers in descriptions, timings or messages. Keep clinical records in your usual clinical record system.
Manage access and downloaded documents
Protect account credentials, limit workspace access to authorised team members and handle downloaded PDFs under your clinic’s own policies. Deleting a saved plan from planner.clinic does not remove copies already downloaded or shared.
Pseudonymised still means personal data.
A treatment plan may identify a patient when combined with its code or information held by the clinic. Generic treatment information is not automatically health data, but linked records may still be personal data. Keep clinical records and patient-specific health information on your own clinical platforms. We do not describe saved plans as anonymous.
Security controls and policies.
planner.clinic uses access controls, encryption in transit and restricted administrative access. Hosting, authentication and data services include Vercel and Supabase.
The Privacy Policy explains account information, service providers, retention and your rights. The Terms set out account security, appropriate use and clinical responsibilities. The Clinic Data Processing Agreement describes how we process personal information on your clinic’s behalf.