Draft — pending legal review
Privacy Policy
Last updated 29 September 2026
This policy explains what personal data Dr. Alaseo collects from clinics in Singapore and Vietnam, why, where it goes and how long we keep it. Dr. Alaseo is operated by ICLO Co., Ltd., C11, Building A, 330 Cheomdan-ro, Jeju-si, Jeju-do, Republic of Korea(“we”). Questions: dralaseo@gmail.com.
1. What we collect and why
| When | What | Why | How long |
|---|---|---|---|
| Free AI visibility check | Clinic name, address, website, Google Maps link, the email address for the report | Run the check and email the report | 1 year |
| Sign-up and log-in | Email, password (stored only as a one-way hash), display name. With Google sign-in we store the Google account ID and email instead of a password. | Create your account and confirm it is you | 30 days after you close the account |
| Google Search Console connection (optional) | Email of the connected Google account, an encrypted access token, the property you choose and its aggregated search statistics | Show your search performance in your dashboard | Deleted when you disconnect |
| Patient feedback through the clinic QR stand | Star rating, options chosen on screen, the review text. No name or phone number. The treatment type is optional; clinics see it only in aggregate. The gift roulette, which asks for a phone number, runs only at clinics in Korea. | Let the clinic see patient satisfaction and help the patient write a review | 1 year |
| All public pages (automatic) | Browser type, referring page, and an irreversible hash of the IP address | Block abuse and investigate errors | Same as the related record |
We use personal data only for the purposes above. We do not sell it and do not use it for advertising. Where a clinic website we operate collects patient enquiries, the clinic decides how that data is used and we process it on the clinic’s behalf.
2. Service providers and transfers abroad
We use the providers below. They may store or process data outside Singapore and Vietnam, including in South Korea and the United States. We share only what each provider needs.
| Provider | Data | Purpose |
|---|---|---|
| Supabase | All data listed above | Database hosting |
| Vercel | Access logs (IP, browser, requested path) | Website hosting |
| Resend | Recipient email address and message body | Sending reports and account emails |
| Google LLC | Email and account ID when you sign in with Google | Google sign-in |
| AI answer collection (our own collector) | Question text only, e.g. "best dentist for implants near Tampines" | Collecting ChatGPT and Gemini answers. No names, phone numbers or emails are sent. |
| AI model providers | Public text from your clinic website and reviews; patient feedback text from the QR stand | Drafting content and review suggestions |
3. Cookies
| Name | Purpose | Lifetime |
|---|---|---|
homeden_auth | Keeps you logged in | 7 days from last use (max 30 days) |
site_locale | Remembers your language | 1 year |
dr_oauth_nonce | Protects Google sign-in against forged requests | 10 minutes |
dr_signup_pending | Holds sign-up details while you sign in with Google | 10 minutes |
dr_invite_token | Accepting a team invitation | 10–30 minutes |
dr_alaseo_review_gw | Prevents duplicate QR feedback | 3 hours |
We do not use advertising cookies.
4. Your choices and rights
- Ask what personal data we hold about you and get a copy.
- Ask us to correct data that is wrong or incomplete.
- Withdraw consent. We will stop the related processing; some features may stop working.
- Ask us to delete your data, or close your account from the billing screen.
Email dralaseo@gmail.com. We reply within 30 days and may need to confirm who you are first.
5. Singapore (Personal Data Protection Act 2012)
For users in Singapore we collect, use and disclose personal data with your consent or as the PDPA otherwise allows, and only for purposes we have told you about. You can contact our Data Protection Officer at the email above for access, correction or withdrawal of consent. If a data breach is likely to cause significant harm, we will notify the Personal Data Protection Commission and affected individuals as the PDPA requires.
6. Vietnam (Decree No. 13/2023/ND-CP)
For users in Vietnam we process personal data on the basis of your consent, given when you submit a form or create an account. You may ask to access, correct, delete or restrict the processing of your data, withdraw consent, or object to processing. Health information (the optional treatment type in QR feedback) is sensitive personal data; we collect it only if the patient chooses to provide it. Data may be transferred outside Vietnam to the providers listed in section 2.
7. Security
Passwords are stored as one-way hashes. Access tokens for connected services are encrypted at rest. Access to our database is limited to staff who need it.
8. Changes
If we change this policy we will update the date above and, for material changes, tell account holders by email before the change takes effect.