Lustre is clinic management software for dental practices. This page says what it handles, where that is kept, and what is done with access to a Google account. It also covers this website.
Lustre is built and maintained by Youssef Hany Galal. It is offered to dental practices and set up at each one in person. There is no public sign-up and no shared online service: every clinic runs its own copy, on a computer that clinic owns, used by its own dentist and secretary. One clinic's copy has no connection to another's.
Each clinic's records — patients, appointments, visits, procedures and payments — are stored in a database on a computer inside that clinic. That computer belongs to the clinic.
The one exception is the off-site backup described next, and it is encrypted.
Exactly one permission: https://www.googleapis.com/auth/drive.file.
This permission is limited by Google to files the application itself created. Lustre cannot list, read, alter or delete anything else in the account's Google Drive, and does not ask for any permission that would let it.
Nothing else. Google account data is not used for analytics, advertising, profiling, training any model, or any purpose unrelated to storing and pruning these backups.
A backup is a copy of the clinic's database, so it contains patient records. It is encrypted on the clinic computer before it is uploaded. The encryption key is not kept on that computer, is not uploaded with the backup, and is not known to Google or to the developer. What is stored in Drive is ciphertext.
When a clinic's dentist signs in, Google issues a refresh token. That token is stored on the clinic's own server, in a file readable only by the account the server runs as. It is not transmitted to the developer and is not stored on any phone. Short-lived access tokens are held in memory only and never written to disk.
Google account data and backup contents are not sold, rented, or shared with anyone. There are no third-party analytics, advertising or tracking services in the application.
Lustre's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
The signed-in account can revoke Lustre's access at any time at myaccount.google.com/permissions. Backups already in Drive are unaffected and remain the account holder's to keep or delete. Once revoked, the clinic's off-site copies stop; the software reports this so it is noticed rather than discovered later.
Backups in Drive are pruned automatically on the schedule above. Deleting the Lustre Clinic Backups folder removes them all. Records held on the clinic's own server are retained by the practice according to its own obligations.
Errors from the phone application are collected to diagnose faults. They are sent to software running on the clinic's own server, not to any third-party service, and are limited to error codes, screen names and application version. Patient names, phone numbers, notes and amounts are excluded.
clinics.lustresystems.com sets no cookies and runs no analytics, advertising or tracking. It remembers a light or dark choice in your own browser, and nothing else. Its fonts come from Google Fonts and its icons from unpkg, which, like any web server, see your IP address when they send them.
If you write to us by email or WhatsApp, we use what you send only to reply and to talk with you about setting Lustre up at your clinic. It is not shared, sold, or added to any mailing list.
If what the software does with Google account data changes, this page changes with it, and the date at the top is updated.