Privacy standards and verified patient data controls

Effective Date and Policy Scope

This privacy policy took effect on October 27, 2026. It applies to all electronic communications, visit scheduling requests, website interactions, and digital records submitted to Orlinexan through orlinexan.com.

We update this document whenever clinical software, state statutory mandates, or paid platform advertising technical specifications are revised. Continued engagement with our LaSalle Street practice constitutes acknowledgment of these stated operational standards.

Data Controller Identification

The legal data controller responsible for the processing of personal information gathered on this website is:

Orlinexan, trading at orlinexan.com
Postal address: 400 South LaSalle Street, Chicago, Illinois 60605, Chicago, Illinois, United States
Telephone: +1 (203) 555-7404
Practice Email: [email protected]
Licensing: State of Illinois License active since 2024.

Categories of Personal Data Collected

Orlinexan collects only information required to coordinate dental checkups, routine teeth cleanings, composite restorations, and deep periodontal scaling at our LaSalle Street office. We do not maintain customer login accounts, do not require passwords, and never capture credit card numbers or payment details through this website.

Specifically, our technical architecture records:

• Scheduling Inquiry Details: Patient full name, telephone number, email address, physical postal address, requested visit category (such as examination, cleaning, filling, or periodontal scaling), clinical timing notes, and explicit consent checkmarks submitted via our intake gateway.
• Support Chat Communications: Message text exchanged with our LaSalle Street desk through the chat widget, timestamp logs, and a local browser storage token enabling conversational continuity.
• Automated Telemetry: Originating IP address, browser user-agent header, screen resolution, referring website URL, form load timestamp (since parameter), and transmission completion timing.
• Advertising Click Identifiers: Marketing campaign parameters appended to incoming web requests, including the Google Click Identifier (gclid), Microsoft Advertising Click Identifier (msclkid), and Meta Click Identifier (fbclid).
• Consent Records: Affirmative cookie and privacy permissions recorded in the browser storage key site_consent_v2.

Purposes of Processing

We process personal information for explicit, defined practice operations:

• Coordinating single-chair appointment blocks and confirming scheduled visit times without overlapping waiting queues.
• Delivering itemized self-pay fee breakdowns and preparation guidance prior to clinical chair entry.
• Reviewing general contraindications, including verifying physician clearance for patients on anticoagulant or antiresorptive medications before scaling.
• Measuring the performance and cost efficiency of paid search and social campaigns across Google Ads, Microsoft Advertising, and Meta Ads.
• Protecting our communications infrastructure against automated spam, denial-of-service abuse, and fraudulent form submissions.

Legal Bases for Processing

Under applicable United States state laws and international standards including the European General Data Protection Regulation, Orlinexan processes data under three distinct legal grounds:

• Contractual Necessity: Collecting contact information and requested dental services is necessary to prepare an appointment schedule, estimate clinical chair time, and deliver requested restorative or preventive dental services.
• Affirmative Consent: Storing browser tracking cookies, processing advertising identifiers, and sending marketing measurement pings occurs exclusively upon affirmative user opt-in via our consent banner.
• Legitimate Interests: Maintaining server security logs, defending against distributed automated abuse, and verifying infrastructure integrity represent legitimate business interests that do not override patient privacy rights.

Advertising Platform Integration

Orlinexan runs paid search and targeted digital acquisition campaigns. Live traffic arriving at this site is directed through Google Ads, Microsoft Advertising, and Meta Ads.

When a prospective patient clicks a sponsored advertisement, the landing page URL carries specific tracking parameters:

• google ads: Appends the gclid token to monitor keyword relevance and campaign conversion performance.
• microsoft advertising: Appends the msclkid token to evaluate search engagement across Bing and partner networks.
• Meta Ads: Appends the fbclid parameter to attribute inquiries generated from sponsored social placements.

No clinical findings, radiograph notes, or personal health histories are ever transmitted to advertising networks. Tracking parameters are evaluated solely for anonymous conversion accounting.

Google Consent Mode v2 Compliance

Our digital infrastructure integrates Google Consent Mode v2 as a foundational privacy control. By default, before any interaction with our cookie banner, four core storage and personalization signals are explicitly held in a denied state:

• ad_storage: 'denied'
• ad_user_data: 'denied'
• ad_personalization: 'denied'
• analytics_storage: 'denied'

When a visitor selects “Allow Storage” on our consent banner, these signals transition to granted, permitting conversion measurement tags to execute. If a visitor selects “Keep Denied” or subsequently revokes consent via our preferences toggle, all four signals instantly revert to denied, and browser cookies associated with advertising measurement are blocked.

Third-Party Data Processors

Orlinexan transfers specific operational data elements to vetted technical service providers under binding confidentiality and data protection agreements:

• Google LLC / Google Ireland Ltd: Advertising attribution and search measurement infrastructure.
• Microsoft Ireland Operations Ltd: Search campaign tracking and Bing network analytics. Microsoft processes user telemetry under the terms detailed at privacy.microsoft.com.
• Meta Platforms Ireland Ltd / Meta Platforms, Inc.: Sponsored social placement attribution and ad delivery analysis.
• Dedicated Web Hosting Provider: Secure domestic data center hosting our web application server, static assets, and encrypted SQL inquiry database.
• Transactional Email Relay Provider: Encrypted SMTP relay delivering patient inquiry notifications directly to our LaSalle Street clinical administrative inbox.

Cross-Border Data Transfers

Orlinexan operates primarily within the United States, maintaining servers situated domestically. Where international visitors access our website from Europe or other global jurisdictions, personal data is transferred to the United States.

Such international transfers rely on Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent adequacy frameworks maintained by domestic enterprise service providers, ensuring rigorous protection equivalent to European standards.

Data Retention Timelines

Orlinexan establishes rigid chronological limits on all stored electronic records rather than keeping records indefinitely:

• Appointment Inquiries and Email Copies: Stored securely for 18 months from the date of submission to facilitate treatment schedule records, after which they are permanently purged.
• Support Chat Logs and Transcripts: Maintained for 18 months to resolve patient inquiries and audit front-desk scheduling responsiveness.
• Server Access Logs: IP records, transmission error logs, and visitor access strings are purged automatically on a rolling 30-day lifecycle.
• Consent Decision Tokens: The site_consent_v2 cookie choice stored in your browser persists for exactly 12 months before prompting re-authorization.

Technical and Organizational Security Measures

We implement defense-in-depth safeguards to protect patient contact details:

• Full TLS 1.3 cryptographic transit encryption across all web traffic with mandatory HTTP Strict Transport Security (HSTS).
• Automated server honeypot fields (office and domain) that intercept and block automated injection scripts before data enters storage.
• Strict database access control restricted to authorized clinical personnel via encrypted SSH keys and multi-factor authentication.
• Isolation of web scheduling inquiries from internal clinical dental radiography databases and physical operatory computers.

European Data Subject Rights (GDPR)

For individuals visiting our website from the European Union, European Economic Area, or United Kingdom, the gdpr grants comprehensive individual controls:

• Right to Access: You may request a verified copy of all personal records maintained by Orlinexan.
• Right to Rectification: You may correct inaccurate or incomplete contact details.
• Right to Erasure (Right to Be Forgotten): You may demand the permanent deletion of your inquiry logs, subject to statutory healthcare retention obligations.
• Right to Restriction: You may restrict processing while a data dispute is evaluated.
• Right to Data Portability: You may obtain your inquiry history in a structured, machine-readable format.
• Right to Object: You may object at any time to data processing grounded in legitimate interests.
• Right to Withdraw Consent: You may retract cookie and tracking permissions at any moment without affecting prior lawful processing.

United States State Privacy Rights (CCPA / CPRA)

Residents of California, Colorado, Connecticut, Virginia, Utah, and other jurisdictions with active comprehensive consumer privacy legislation enjoy statutory protections under the ccpa and related frameworks:

• Right to Know: The right to discover the categories, sources, commercial purposes, and third parties associated with collected personal data.
• Right to Delete: The right to require deletion of personal information captured through our web properties.
• Right to Correct: The right to mandate corrections to inaccurate personal records.
• Right to Opt Out of Sale or Sharing: Orlinexan does not sell personal information for monetary payment. However, because paid campaign measurement via Google, Microsoft, and Meta may constitute “sharing” under CCPA definitions, you may opt out freely using our consent banner or Global Privacy Control signal.
• Right to Non-Discrimination: Exercising your privacy rights will never result in altered appointment fees, reduced service quality, or modified dental chair access.

Global Privacy Control (GPC)

Orlinexan respects and automatically honours global privacy control signals transmitted by user browsers via the Sec-GPC request header.

When our server detects an active GPC opt-out signal, marketing measurement cookies and third-party advertising scripts are blocked immediately without requiring manual interaction with our consent dialog.

Protection of Children’s Privacy

Our digital properties and web scheduling forms are directed exclusively to adults aged 18 and older. In accordance with the Children’s Online Privacy Protection Act (COPPA), we never knowingly gather, solicit, or maintain personal records from minors under the age of 13.

Parents or legal guardians coordinating dental care for dependent minors must submit appointment inquiries under the adult guardian’s verified contact details. If we discover inadvertent receipt of minor personal data without verified parental authorization, records are deleted immediately.

Regulatory Complaints and Supervisory Authorities

If you believe Orlinexan has failed to handle your personal information in accordance with state or federal regulations, you hold the right to lodge a formal complaint with appropriate supervisory agencies:

• Illinois Residents: Office of the Illinois Attorney General, Consumer Protection Division, 100 West Randolph Street, Chicago, IL 60601.
• California Residents: California Privacy Protection Agency (CPPA), 915 Capitol Mall, Suite 350A, Sacramento, CA 95814.
• European Residents: The competent Data Protection Authority in your EU Member State of habitual residence or workplace.

Submit a Formal Data Subject Request (DSAR)

To exercise your statutory rights regarding access, deletion, rectification, or export of your records, you may submit a formal request using the verified form below or by writing directly to [email protected].

Our compliance officer will acknowledge your request and deliver a written response within 7 business days. We verify requester identity before releasing records to protect confidentiality.

Policy Modification and Notification Protocol

Orlinexan reserves the authority to update this privacy policy periodically to reflect revisions in clinical scheduling tools, digital encryption standards, or advertising platform policies.

Substantial modifications will be highlighted on this page alongside an updated effective date. We encourage regular review of this statement when coordinating visit schedules.

Privacy Officer and Contact Information

For inquiries regarding data protection protocols, record retention horizons, or our LaSalle Street office operations, contact our privacy desk directly:

Orlinexan Privacy & Records Desk
400 South LaSalle Street, Chicago, Illinois 60605, Chicago, Illinois, United States
Telephone: +1 (203) 555-7404
Email: [email protected]
Office Hours: Monday – Thursday 8:00 AM – 5:00 PM, Friday 8:00 AM – 2:00 PM (Central Time)