What we keep, and why.

TrainingDen.ai (“TrainingDen”, “we”, “us”) is operated by Bucktooth Marketing Inc, a Texas corporation based in Richardson, Texas. We are the data controller for the information described here. Questions, requests and complaints go to hello@trainingden.ai.

This policy covers the TrainingDen website and app at trainingden.ai. It applies to two kinds of people: practice admins, who create a practice and pay for it, and coordinators, whom an admin invites into that practice.

Every patient in TrainingDen is simulated. The service does not connect to your practice management system, your scheduling software or your records, and it is not designed to hold protected health information (PHI). Do not type real patients’ names, conditions, quotes or any other identifying details into a session. TrainingDen is not a HIPAA business associate and we do not sign business associate agreements.

Account details. Your name, email address and password (stored only as a hash), your job title, your practice’s name and, if you give it at signup, a phone number.

Training activity. The text of every practice session you run with a simulated patient, the scores and coaching reports generated from it, your level, XP, streaks and flags you raise on a conversation. This is the product; it is what your dashboard is built from.

Billing. Payments are handled by Stripe. Your card number never reaches our servers. We keep Stripe’s customer and subscription identifiers, your plan status and trial dates.

Contributor applications. If you apply to contribute scenarios, we keep what you enter on that form: name, email, experience and the consult story you tell us.

Technical data. Standard server logs (IP address, browser type, pages requested, timestamps) and short-lived rate-limit counters keyed by IP address and account. We do not run advertising trackers or third-party analytics on the site.

• To run the service: sign you in, generate simulated patients, score and coach your sessions, and show your practice’s dashboards.
• To bill the practice and send the emails the service needs: confirmations, invitations, password resets and receipts.
• To keep the service safe: rate limiting, abuse prevention, debugging and security monitoring.
• To improve TrainingDen, using aggregated or de-identified information that does not identify a person or practice.
• To answer you when you contact us.

Simulated patients and coaching reports are generated by Anthropic’s Claude. To produce each reply, the text of the current session is sent, together with the scenario details, to Anthropic’s API through OpenRouter, a routing service that we restrict to Anthropic’s own endpoint; if that route is unavailable, it is sent to Anthropic’s API directly. Both process it under their commercial API terms and do not use API inputs or outputs to train their models.

We do not use your session transcripts to train AI models either. The models’ output is a training aid: it can be wrong, and it is not clinical, legal or financial advice.

TrainingDen is a team tool. Admins of your practice can read every coordinator’s session transcripts, scores, coaching reports, level and activity, and can deactivate or remove members. Coordinators see only their own history. Nobody outside your practice can see your practice’s data.

If you were invited by a practice, the practice admin decided to create your account. Direct requests about how your practice uses this information to them first; we will help either of you on request.

We use a small number of providers, each only for the purpose listed:

• Supabase — database and authentication. Data is stored in Supabase’s Canada (Central) region.
• OpenRouter — routing of AI requests to Anthropic, as described above.
• Anthropic — AI generation of patient replies and coaching, as described above.
• Stripe — payments, subscriptions and receipts.
• Resend — delivery of the transactional emails the service sends.
• Oracle Cloud — hosting for the application server.
• Google Fonts — typefaces; your browser requests them directly from Google.
• An error-monitoring service may receive technical details of application errors, including the page and account involved.

We do not sell personal information and we do not share it with advertisers. We may disclose information when the law requires it, to protect the rights and safety of users or the public, or as part of a merger or sale of the business, in which case this policy continues to apply.

The app keeps your sign-in token in your browser’s local storage so you stay signed in, and a single cookie that remembers whether the sidebar is open. Signing out clears the token. There are no advertising or cross-site tracking cookies.

Account and training data stay for as long as the practice’s account exists, so your history and levels are there when you come back. Server logs are kept for a short period for security and debugging. Billing records are kept as long as tax and accounting law requires.

When a practice closes its account, or a person asks us to delete their account, we delete the associated personal data within 30 days, except what we must keep for legal or accounting reasons or what exists only in encrypted backups that expire on their own schedule.

You can update your name and title from your profile. Practice admins can rename the practice, manage members and cancel the subscription from the billing page. For anything else — a copy of your data, a correction, deletion of your account, or an objection to how we use information — email hello@trainingden.ai from the address on the account. We respond within 30 days and never charge for these requests.

Depending on where you live you may have additional rights under laws such as the California Consumer Privacy Act or the GDPR, including the right to lodge a complaint with a supervisory authority. We honor those rights for everyone, wherever they are.

All traffic is encrypted in transit. Data is separated by practice at the database layer, so one practice’s queries cannot reach another’s rows. Passwords are hashed and never stored in clear text. Card details go straight to Stripe. No system is perfectly secure; if we learn of a breach affecting your data we will tell you without undue delay.

TrainingDen is a workplace tool for dental practices and is not directed at anyone under 18. We do not knowingly collect information from children. If you believe a child has created an account, contact us and we will remove it.

We may update this policy as the service changes. The effective date at the top always reflects the current version. For material changes we will email practice admins before the change takes effect.