Summary: GetInventy collects only the data needed to operate the service. We do not sell your data, we do not share it with advertisers, and we store all data on servers located in the European Union.
GetInventy is a medical and dental inventory management platform operated by Mobingo ("we", "us", "our"). Our registered contact is [email protected]. When we refer to "the service", we mean the GetInventy application at dentalinventory.mobingo.net and any associated pages at getinventy.com.
When a clinic is onboarded, we collect the clinic's name, primary contact name, and email address for the administrator account. Each user account stores a username, full name, email address, role, and location assignment.
The service stores inventory records you create — items, batches, stock movements, transfers, and reports. This data belongs to your clinic and is processed solely to provide the service.
If your clinic uses the Implant Manager module, patient-level data (patient name, chart ID, tooth number, placement date) is stored in association with implant placement records. This constitutes Protected Health Information under HIPAA.
We store hashed passwords (bcrypt), email OTP hashes for two-factor authentication, and trusted-device tokens. Plaintext passwords are never stored or logged.
Our servers log standard HTTP request metadata — IP address, browser user-agent, and timestamp — for security monitoring and abuse prevention. These logs are retained for 90 days and then deleted.
We do not use your data for advertising, profiling, or any purpose unrelated to operating the service.
We do not sell, rent, or trade your data. We share data only in the following limited circumstances:
If your clinic is a Covered Entity under the Health Insurance Portability and Accountability Act (HIPAA), Mobingo acts as a Business Associate. A Business Associate Agreement (BAA) must be executed before any PHI is entered into the system. Please contact [email protected] to request a BAA.
Our HIPAA-oriented technical safeguards include HTTPS everywhere, automatic session inactivity timeout, column-level PHI encryption, role-based PHI access control, soft-delete patient records (6-year retention), and encrypted daily backups stored off-server.
The service has undergone seven rounds of independent security auditing and achieved an A+ grade. Security measures include HTTPS with HSTS, httpOnly JWT authentication cookies, Cloudflare Turnstile bot prevention, two-factor authentication via email OTP, trusted-device tokens, and a comprehensive audit log. We conduct regular security reviews and apply patches promptly.
Depending on your jurisdiction, you may have rights regarding your personal data, including the right to access, correct, or request deletion of data we hold about you. To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
For patient data held on behalf of your clinic, the clinic (as the Covered Entity) is responsible for responding to patient requests. We will assist your clinic in doing so upon written request.
We use two first-party cookies: an auth_token cookie (httpOnly, Secure, 24-hour expiry) for session authentication, and a device_token cookie (httpOnly, Secure, 90-day expiry) for trusted-device recognition. We do not use advertising cookies, third-party tracking, or analytics cookies.
We may update this policy from time to time. We will notify clinic administrators by email before material changes take effect. The "Last updated" date at the top of this page always reflects the current version.
Questions about this policy or data requests: [email protected]
Phone: +1 571 661 1200