Trust needs architecture.
FirstFill is a private dental member network with persistent Boards, social messages, a privacy-safe dental-school network map, events, The First Fill Show, notifications, a structured CV, and reviewed opportunities. Organization contacts receive only their isolated workspace, eligible hiring conversations, and CVs deliberately shared for a role or by an explicit grant.
After sign-in, FirstFill stores the member profile you submit. An eligible dental-school email may activate membership automatically; other identities move to a manual eligibility review. School-email verification proves control of that address, not enrollment, graduation, licensure, or another professional credential.
An organization request does not unlock member content. It enters a separate verification workflow and never subscribes the requester to marketing. Open requests can be withdrawn from the same signed-in flow.
- 01
Collect less
Member setup stores the authenticated email, name, dental path, affiliation, city, optional graduation year, and the answers a person chooses to provide. Member data may also include profiles, structured CV details, saved roles, job applications, invitations, connections, Board activity, social and hiring messages, event RSVP/waitlist state, saved episodes, listening progress, notifications, safety reports, and a limited security audit trail. Organization requests store the authenticated contact, organization identity, location, intended use, and verification evidence supplied.
- 02
Separate roles
The owner, members, applicants, organization contacts, and public visitors are separated by server-enforced permissions. Organization contacts cannot enter member Boards, the member directory, or social direct messages. Member email addresses are not returned in career or directory responses.
- 03
Privacy-safe school map
The optional school field is self-reported and is not credential, enrollment, or alumni verification. For the member-only network map, FirstFill may normalize that field to the current CODA-accredited U.S. dental-program catalog and calculate school bands using only active members who accepted the current terms. The map never publishes an exact school count: its bands begin at five, so zero through four produce the same no-band result. Organization contacts cannot access the member map or its school bands. Clearing the school field removes it from future map calculations.
- 04
No sale of member data
FirstFill’s business model must not depend on exporting, brokering, or reselling member profiles or conversations.
- 05
Private does not mean end-to-end encrypted
Social-conversation access is restricted to its two members; hiring-conversation access is restricted to the eligible applicant and authorized organization team. Hosted data may still require tightly controlled administrative or safety access; FirstFill does not claim end-to-end encryption.
- 06
No patient data
Do not post patient names, images, records, radiographs, or any other identifying clinical information. FirstFill is not designed to receive protected health information.
- 07
Purpose-limited CV sharing
Browsing and saving a role share nothing. Applying requires an explicit confirmation of the exact CV version and organization. FirstFill stores that application snapshot, an expiring or revocable access grant, and organization access events. Withdrawing, declining, closing, or suspending the organization revokes future in-product access; an organization may still have lawful copies it received outside FirstFill.
- 08
Programming activity and external media
An event RSVP stores going, waitlisted, promoted, or cancelled state and related timestamps so capacity and receipts remain truthful. Podcast saves and listening position stay in the member account. Opening an episode does not preload audio; pressing play contacts the reviewed external HTTPS media host, which receives the ordinary network request under its own privacy terms. FirstFill stores the publication record, media address, transcript address, and rights acknowledgement, but does not host the audio.
- 09
No calls, no microphone, no camera
FirstFill does not provide audio or video calling. The product never requests microphone or camera access, browser permissions for both are denied by policy on every page, and no call provider processes member media. Members who want to talk arrange it on a channel of their own choosing.
- 10
Member control
Applicants can update or withdraw a pending member profile. Members can edit their profile and structured CV, keep the CV private, publish or unpublish it, control non-essential in-app notifications, review and revoke organization shares, download a structured data copy including career access history, submit correction or deletion requests, block contact, and file a structured safety report. A completed deletion removes or anonymizes the member identity across member, organization-application, and matching organization-contact records; provider deletion is tracked separately and remains retryable on failure.
- 11
Retention with unfinished-work protection
Expired or revoked sessions are eligible for deletion after 30 days; read notifications after 90 days; closed data requests after 365 days; and expired, unclaimed, unreferenced invitations after 90 days. Unread notifications, open requests, safety/accountability records, and deletion requests with pending or failed system work are not removed by that routine purge. Legal or safety obligations may require narrower exceptions.
- 12
Prove the controls
FirstFill uses identity-gated routes, participant checks, one-time hashed invitations, rate limits, no-store responses, audit events, and adversarial API tests. Access and sharing decisions are enforced on the server rather than trusted to hidden buttons.