Privacy Policy

Effective: 2026-09-24 · Version: 2026-09-24

This policy explains how Bluemill Digital, LLC ("Keen", "we") handles personal information. It covers two different relationships, and it matters which one you are in:

• If you are a dental practice using Keen to build and host your website, we are the controller of your account information and we explain below what we do with it.
• If you submitted a form on a website Keen hosts for a practice, that practice decides what happens to your information. We hold it on their behalf as their service provider and, under HIPAA, as their business associate. Contact the practice directly with requests about your information — or write to us at privacy@keen.dental and we will pass you to them.

This policy is not the privacy policy of any practice's website. Each practice publishes its own.

1. Information we collect

From practices (our customers):

• Account information — name, email address, password (stored hashed by our authentication provider, never by us in readable form), and, for Google sign-in, the profile information Google returns.
• Practice information you give us to build your site — practice name, location, hours, services, staff details, photographs and documents you upload, your existing website address, and anything you type into the builder. If you give us your existing website we read it to ground your new site, and we show you the photographs on it so you can choose which ones to bring across; we copy only the ones you tick.
• Billing information — your subscription state, invoices, and usage. Card numbers go directly to our payment processor; we never see or store them.
• Usage and technical data — build history, pages generated, log-in events, error reports, IP address and browser information from requests to the application.

From visitors to practice websites:

• Form submissions — whatever the practice's form asks for, typically name, email or phone, and a message, plus the page it was submitted from and a timestamp. We hold this for the practice, under their instructions.
• Request data at the edge — IP address and user agent, used transiently to serve the page and to block abuse (spam and rate limiting). We do not build visitor profiles and we do not run advertising or cross-site tracking on hosted sites.

2. How we use it

We use practice information to provide the service: to generate and host your site, to run builds, to deliver your form submissions to you, to bill you, to support you, and to keep the platform secure and working. We use aggregate, non-identifying usage data to improve Keen.

We do not sell personal information. We do not share it with advertisers. We do not use form submissions — or any patient or prospective-patient information — to train AI models.

AI and your content. Building your site sends your practice's marketing content to an AI model provider under a commercial agreement that prohibits using it to train their models. Form submissions are never sent to an AI model; the build system has no access to them. This separation is structural, not a setting.

3. Who we share it with

We may also disclose information where required by law, to enforce our Terms, or to a successor in a merger or sale — in which case this policy continues to apply until it is replaced with notice to you.

4. Where information is stored

In the United States. We do not transfer practice or visitor information outside the United States in the ordinary course of providing the service.

5. How we protect it

Information is encrypted in transit and at rest. Access to a practice's data requires authentication and membership of that practice's account, enforced at the database layer. Each person uses their own login; shared logins are not permitted. Form submission content is never written to application logs, analytics, or any vendor that has not signed a business associate agreement. Our staff do not access practice form submissions in the ordinary course; access for support or incident response happens on request or necessity and is limited to what the task requires.

If we learn of a breach of unsecured protected health information, we notify the affected practice without unreasonable delay and within five business days, and support their notification obligations. Report a suspected incident to security@keen.dental.

6. How long we keep it

• Form submissions (leads) — 24 months from the date we receive them, then permanently deleted. A practice can set a shorter limit (3, 6, or 12 months) in its settings, and can delete an individual submission at any time. Deletion is real deletion, not archiving. Practices who need to keep an enquiry longer should record it in their own patient record system — the system of record for a patient relationship is the practice's, not Keen's.
• Practice account and site content — for as long as the account is open.
• A deactivated site — form submissions are deleted 30 days after deactivation. Billing records, usage history, and build metadata are kept, because we need them for accounting and audit; they contain no patient information.
• After you leave — you have 30 days from termination to export your submissions, after which they are destroyed. Billing records are kept as long as tax and accounting law requires.
• Backups — deleted data ages out of backups within 35 days.

7. Cookies

We use cookies only to make the application work: to keep you signed in, to remember which site you are working on, and to keep your onboarding answers if you refresh. We do not use advertising or cross-site tracking cookies, and the application has no third-party analytics that follow you. Sites Keen generates ship with no tracking cookies by default; a practice that later adds its own analytics is responsible for disclosing them in its own privacy policy and for any consent that requires.

8. Your choices and rights

Practices can view and correct account and practice information in the application, export leads, set a shorter retention limit, deactivate a site, or ask us to close the account and delete its data by writing to privacy@keen.dental.

Site visitors should contact the practice whose website they used. Because that information is protected health information held for the practice, we act on the practice's instruction rather than deleting it ourselves — we will route your request to them and follow their direction.

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information, and to be free from discrimination for exercising them. Where an exercise is available to us we honour it; where the information is PHI held for a practice, HIPAA's individual-rights process applies and runs through the practice. We do not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of. Write to privacy@keen.dental; we respond within 45 days.

Texas residents: Keen is a covered entity under Texas Health & Safety Code Chapter 181 (HB 300) with respect to the information it holds for practices, and complies with its access, training, and notification requirements. Complaints may also be directed to the Texas Attorney General.

9. Children

Keen is a business service and is not directed to children. A practice's website may receive an enquiry concerning a child patient submitted by a parent or guardian; we hold it for the practice under the same protections as any other submission, and do not knowingly collect information directly from children.

10. Changes

We will post any change here with a new version number and effective date, and will notify practices by email or in the app before a material change takes effect.

11. Contact

Privacy questions and requests: privacy@keen.dental Security incidents: security@keen.dental Legal notices: legal@keen.dental

Bluemill Digital, LLC (trading as Keen) is a limited liability company organized under the laws of the State of Indiana.