Privacy Notice (UK GDPR / DPA 2018)

Last Updated: 16 September 2026

1) Who We Are

DentiEasy Solutions LTD ("DentiEasy", "we", "us", "our") provides the DentiPlanner application and related services (the "Service").

Registered office: 128 City Road, London, EC1V 2NX, United Kingdom Company number: 16811814 Contact email: [email protected]

Privacy lead/contact: Isaac Alseyoury, [email protected]

UK representative: Not applicable; DentiEasy Solutions LTD is established in the United Kingdom.

2) Scope

This Policy applies to:

• Visitors to our websites and marketing pages.
• Users who create accounts in the Service (dentists, clinics, labs, staff, and other authorised users).
• Patients who use a patient portal account or whose data is uploaded into the Service by a clinic or practitioner (together, "Patient Data").

This Policy does not apply to third-party websites, apps, or services that we do not control (including third-party payment or messaging providers), even if they integrate with the Service.

3) Key Definitions

“Personal Data” means information relating to an identified or identifiable individual. “Special Category Data” includes health information and clinical/dental records. “Controller” decides why and how Personal Data is processed. “Processor” processes Personal Data on behalf of a Controller.

4) Controller vs Processor Roles (Important)

4.1 Patient Data uploaded by clinics/practitioners

For Patient Data uploaded by a clinic/practitioner (e.g., clinical notes, charts, images, treatment plans, billing statements for a patient):

• The clinic/practitioner is typically the Controller.
• DentiEasy is typically the Processor.

In this context, the clinic/practitioner is responsible for:

• Determining the lawful basis for processing Patient Data.
• Providing required notices to patients (including privacy notices).
• Obtaining any required consents and authorisations.
• Responding to patient requests (access/correction/erasure), subject to applicable laws and clinical record retention obligations.

We process Patient Data on the Controller’s instructions, subject to this Policy and any data processing terms you have with us.

4.2 Account, billing, and platform operations data

For certain data needed to run the Service (e.g., account details, admin/security logs, billing/subscription status, and platform communications you initiate), DentiEasy acts as a Controller.

4.3 Patient portal access

Where a clinic/practitioner invites a patient to use a patient portal account, that clinic/practitioner typically remains the Controller of Patient Data shown in the portal, and DentiEasy typically remains the Processor. DentiEasy may act as a Controller for the patient’s portal account credentials and security/usage logs needed to operate the Service.

5) Information We Collect

We may collect and process the following categories of data:

5.1 Account and profile data

Examples:

• Name, clinic/lab name, email address, phone number, billing address, professional role, basic profile settings, subscription and account details.
• Login/session metadata (e.g., timestamps).

5.2 Professional and business information

Examples:

• Professional credentials you choose to provide or that are needed for verification (e.g., licence number, specialty, certifications, and verification details).
• Clinic contact details and branding you upload.
• Business profile information, logos/images, service descriptions, product/listing details, and similar content you choose to publish in professional listing or showcase features.

5.3 Patient Data (Special Category Data)

Examples (depending on features used by the Controller):

• Dental/clinical records: charting entries, medical history, allergies, treatment notes, referrals, consents, lab values.
• Clinical images (including x-rays) and files uploaded for patient care.
• Patient identifiers entered by the Controller (e.g., name, phone, email, date of birth, address).
• Patient billing, invoices, statements, payments history, and ledger entries.

5.4 Payments and subscription data

Examples:

• Subscription status, plan details, invoices/receipts, payment events, payment method metadata such as last 4 digits and expiry date where provided by the payment processor, billing address, and related billing metadata.
• Note: Payment card details are typically processed by the payment provider, not stored by us as raw card numbers.

5.5 Communications data

Examples:

• Messages or content you send through the Service (e.g., notifications, reminders, and emails you initiate).
• Delivery metadata (sent, delivered, failed).
• Lab case collaboration data, such as case numbers, prescriptions, fabrication details, design files, and status updates shared between authorised clinical users.

5.6 Device, usage, and security data

Examples:

• IP address, device identifiers, browser/app version, access timestamps, crash logs, error logs, audit logs, and access logs.
• Security signals to help prevent fraud and abuse.

6) How We Use Personal Data

We use Personal Data to:

• Provide, operate, maintain, and improve the Service.
• Store, transmit, back up, and process Patient Data on behalf of Controllers.
• Authenticate users and enforce access controls.
• Process subscriptions, payments, and billing (as applicable).
• Send transactional communications (e.g., reminders, security alerts, service messages).
• Provide customer support.
• Monitor and protect the security and integrity of the Service.
• Comply with legal obligations and enforce our terms.
• Perform aggregated analytics and reporting (in a manner intended not to identify individuals).
• Enforce billing-delinquency workflows, account suspension, reactivation, and data-export processes.

We do not sell Personal Data.

6.1 Billing country verification and regional pricing

When you start or manage a paid subscription, we may receive billing-country information verified by our payment provider (such as Stripe). We use this information to determine the pricing region applicable to your account, manage subscriptions, help prevent abuse of regional pricing, investigate billing issues, and support compliance obligations. Once successfully verified, the billing country may be locked to your account for pricing purposes and reused for future subscription purchases unless it is reset and re-verified through an authorised support process. We do not store full payment card numbers.

6.2 Google Calendar integration and Google OAuth data

Dental professionals may optionally connect a Google Account to synchronize DentiPlanner appointments with Google Calendar. This Calendar connection is separate from any Google Sign-In used only to authenticate a DentiPlanner account.

Google data we access and permission requested. When you choose to connect Google Calendar, DentiPlanner requests the Google Calendar `calendar.events` OAuth scope. Google describes this scope as permitting an application to view and edit events on all calendars you can access. DentiPlanner uses this permission only for the Calendar synchronization feature described below and does not use it to access unrelated Google services.

How we use the data. We use the authorized access to create, update, delete, list, and reconcile appointment events associated with DentiPlanner in the configured Google Calendar (currently the connected account's primary calendar). Calendar events created by DentiPlanner contain generic scheduling information: the title “Appointment”, the description “Reserved”, the location “Clinic”, and the appointment start time, end time, duration, and time zone. We do not place patient names, patient identifiers, clinical notes, treatment details, or DentiPlanner record identifiers in the Google Calendar event title, description, or location. We store the Google event identifier returned by Google so that the corresponding event can be updated or removed when the DentiPlanner appointment changes, is cancelled, or is deleted.

OAuth credentials and connection data we store. After you authorize the connection, we store the Google OAuth refresh token, the configured Calendar identifier, whether synchronization is enabled, limited connection-error information, and Google event identifiers linked to synchronized DentiPlanner appointments. The refresh token is used by our secured backend to obtain short-lived access tokens as needed to operate the synchronization. Short-lived Google access tokens are not written to our application database. Google OAuth credentials are not exposed to other DentiPlanner users.

Sharing and transfers. Google Calendar data and OAuth credentials are exchanged only between Google, DentiPlanner's secured backend, and infrastructure providers used to operate and secure the Service, including Supabase as described in section 9.1. We do not sell Google user data, use it for advertising or unrelated profiling, allow humans to read it except where necessary for security, support, legal compliance, or with the user's affirmative agreement, or use it to develop, improve, or train generalised or non-personalised artificial intelligence or machine-learning models.

User control, retention, and deletion. You can pause Google Calendar synchronization within DentiPlanner. Pausing stops active synchronization but retains the connection credentials and may queue appointment changes so synchronization can resume if you enable it again. To revoke DentiPlanner's authorization, you can remove its access in your Google Account's third-party connections or permissions settings. We retain the Google refresh token and related connection metadata only while needed to provide the connected feature, maintain security, resolve errors, or comply with legal obligations. When an eligible DentiPlanner account-deletion request is executed, the stored Google OAuth token record is deleted, subject to the limitations and retention obligations described in sections 14 and 15. Revoking Google access does not itself delete appointment information already stored in DentiPlanner, and deleting a DentiPlanner account does not necessarily delete events already present in Google Calendar; those records remain subject to the controls of the service in which they are stored.

DentiPlanner's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

7) Lawful Bases (UK GDPR)

Where DentiEasy acts as a Controller, we rely on one or more of the following lawful bases:

• Contract: to provide the Service you requested and manage your account/subscription.
• Legitimate Interests: to secure, improve, and operate the Service (balanced against your rights).
• Legal Obligation: to comply with applicable laws (e.g., accounting/tax recordkeeping, lawful requests).
• Consent: where required (for example, certain marketing communications where applicable).

Where we act as a Processor for Patient Data, the Controller determines the lawful basis and we process under the Controller’s instructions.

8) Special Category Data (Health/Clinical Data)

Patient Data may include Special Category Data. When we process such data:

• As a Processor, we process it under the Controller’s instructions and appropriate security measures.
• As a Controller (if applicable for certain features), we process it only where an appropriate condition under UK GDPR applies.

9) Sharing and Disclosure

We may share Personal Data:

9.1 With service providers (sub-processors)

We use vetted service providers to host and operate the Service and support communications and billing. Our current production sub-processors are:

We require service providers to protect Personal Data and only process it for the purposes we specify. Where appropriate, third parties that receive Personal Data must follow applicable data protection and confidentiality obligations.

9.2 With authorised collaborators

If you invite staff, collaborate with labs, or enable portal access, we will share data according to your permissions and settings.

Laboratory case data shared with dental laboratories through the Service may be pseudonymised and may not directly identify a patient to the lab. However, where the data can be linked to an identifiable individual by the clinic, it remains Personal Data processed on behalf of the clinic/practitioner as Controller. Dental laboratories using the Service may act as processors or sub-processors for such data and must process it only for authorised clinical or operational purposes.

If you use laboratory showcase, supplier listing, or similar professional directory features, we may process and display the business profile information, logo/profile image, product or service details, pricing, and content you choose to publish. Listings are intended for authorised users within the Service, such as authenticated dentist users where applicable, and are not intended to be publicly accessible or searchable unless a feature clearly states otherwise.

9.3 For legal and compliance reasons

We may disclose information if we reasonably believe it is necessary to:

• Comply with law, regulation, court order, or lawful request.
• Protect the rights, safety, and security of users, patients, and our systems.
• Investigate and prevent fraud, abuse, or security incidents.

9.4 Business transfers

If we are involved in a merger, acquisition, reorganisation, or asset sale, we may transfer data as part of that transaction, subject to applicable law.

10) International Transfers

Our production infrastructure uses Supabase for the application database, backend storage, authentication-related platform services, and service logs, hosted in the EU, Frankfurt, Germany. We also use Cloudflare for website/app hosting, CDN/security routing, static asset delivery, and limited edge Worker functionality. Some service providers may process data outside the UK or EEA as described in the sub-processor table above.

When Personal Data is transferred internationally, we will use appropriate safeguards, such as:

• UK International Data Transfer Agreement (IDTA) or UK Addendum to EU Standard Contractual Clauses (SCCs), as applicable.
• Additional technical and organisational measures where appropriate.

For UK international transfers, we assess whether the protection for individuals after transfer is not materially lower than under UK data protection law. We assess this reasonably and proportionately, taking into account the destination, provider role, data categories, safeguards, contracts, security controls, and transfer risk.

11) Data Security

We use technical and organisational measures designed to protect Personal Data, including:

• encryption in transit using TLS;
• encryption at rest where supported by our infrastructure providers;
• row-level and role-based access controls to separate dentist, lab, patient, and admin access;
• private storage buckets and signed/authorised access for clinical, financial, export, and other sensitive files where applicable;
• audit logging for sensitive workflows, including export, erasure, admin, billing, and breach-response actions;
• administrative access restrictions, including MFA for sensitive admin workflows where configured;
• monitoring, security-event detection, incident-response workflows, and breach notification processes where legally required.

No system is 100% secure. You are responsible for keeping your login credentials confidential and using strong authentication settings where available.

If we become aware of a Personal Data breach affecting your information, we will notify affected users, Controllers, and/or regulators where required by applicable law, and will take reasonable steps to investigate, contain, and mitigate the incident.

12) Device Storage and Exports

The Service is designed to keep Patient Data within the Service’s access controls.

If you export, download, print, or otherwise store records outside the Service (for example, using device “Save as PDF” or file export features), you are responsible for:

• Securing those files appropriately.
• Limiting access to authorised persons.
• Complying with your legal and professional obligations (including any patient record retention and confidentiality requirements).

DentiEasy is not responsible for the security of Personal Data once it has been exported, downloaded, printed, or stored outside the Service by you or at your direction.

13) Website Forms, Marketing Communications, and Cookies

13.1 Website, support, and privacy request forms

If you submit details through our website, support channels, account deletion page, privacy request forms, or similar forms, we may process:

• your name, email address, account identifier, and contact details;
• the content of your message or request;
• information needed to verify, investigate, or respond to your request; and
• technical metadata such as submission time, IP address, device/browser details, and security logs.

We use this information to respond to you, provide support, handle account deletion or privacy rights requests, maintain security records, and comply with legal obligations.

Please do not send clinical records, dental images, treatment details, or other sensitive health information through website forms or ordinary email unless we specifically ask you to do so through a secure process.

We do not use Personal Data collected through the Service, including account, patient, clinic, billing, support, or health-related data, for direct marketing or advertising targeting.

We do not send marketing emails, SMS, push notifications, or other direct electronic marketing to Service users using contact details collected through the Service.

DentiEasy may carry out separate public advertising or brand marketing outside the Service, for example through online advertising platforms. This does not involve uploading, matching, or otherwise using Service user, customer, patient, clinic, or health-related data for advertising audiences, retargeting, lookalike audiences, or similar marketing purposes.

If we introduce direct electronic marketing, advertising cookies, tracking pixels, retargeting, custom audiences, lookalike audiences, or any use of Personal Data collected through the Service for marketing, we will assess the Privacy and Electronic Communications Regulations 2003 (PECR), UK GDPR, and any consent or transparency requirements before launch.

13.2 Cookies and analytics

Our website and app may use cookies, local storage, device identifiers, and similar technologies where needed to:

• keep users signed in and maintain secure sessions;
• remember app preferences and operate core Service features;
• support security, fraud-prevention, rate-limiting, and abuse-prevention controls, including controls provided by infrastructure providers such as Cloudflare;
• deliver push notifications where a user has enabled them; and
• understand basic Service usage and performance in an aggregated manner.

We do not currently use advertising cookies, third-party behavioural advertising pixels, or direct-marketing tracking technologies in the Service. If we introduce non-essential analytics, advertising, marketing cookies, or similar storage/access technologies, we will assess PECR and UK GDPR requirements, provide notice, and obtain consent where required before enabling them.

You can control cookies through your browser settings and app/device permissions. Blocking essential cookies, local storage, or device identifiers may prevent login, security checks, push notifications, or other core Service features from working correctly.

14) Data Retention

We retain data for as long as necessary to provide the Service and for legitimate and legal purposes, including maintaining security, supporting customers, complying with legal obligations, resolving disputes, enforcing our agreements, and establishing, exercising, or defending legal claims. Retention may vary by data category and by whether we act as Controller or Processor.

14.1 Retention categories (high-level)

Subject to applicable law and Controller instructions:

• Billing/accounting records: retained for 6 years, unless applicable law requires a longer period. Where an erasure request is executed, these records may be de-identified or minimised where appropriate.
• Clinical records: retention is primarily determined by the clinic/practitioner as Controller and by applicable clinical recordkeeping obligations. DentiEasy supports retention, deletion, and de-identification according to Controller instructions and legal requirements.
• Security and audit logs: ordinary security and access logs are retained for up to 24 months. Incident, fraud, legal, or accountability evidence may be retained for up to 6 years where needed.
• Suspended or non-payment workspaces: if an account is suspended for non-payment, workspace data may be kept in an archived and recoverable state for up to 90 days from the effective suspension date to allow reactivation, billing resolution, support handling, legal compliance, and data export. During this period, normal Service access may remain blocked or limited, but billing-recovery, support, and data-export tools may remain available.
• Backups: Supabase database backups are retained on a limited rolling provider schedule. Current Supabase daily backup access is 7 days for Pro, 14 days for Team, and up to 30 days for Enterprise plans; if Point-in-Time Recovery is enabled, the configured recovery period controls the available restore window. Backups are access-restricted, used only for disaster recovery, and overwritten or expired through the provider backup process.

14.2 Deletion vs de-identification

When an erasure request is executed, we may:

• Delete data that does not need to be retained; and/or
• De-identify (anonymise/minimise) certain records that must be retained for legal, regulatory, or accounting purposes, while removing direct identifiers and access to those records through normal user interfaces.

After any applicable archived recovery period ends, we may delete or irreversibly anonymise data that we are not legally required or permitted to retain.

15) Erasure Requests (Right to Deletion)

15.1 Account deletion requests (account holders)

If you request deletion of your account:

• We will take steps to delete or de-identify Personal Data associated with the account, subject to any retention obligations.
• We may refuse or delay execution where deletion is not permitted or where retention is required by law.
• Where a paid subscription is active, we may require billing to be cancelled/ended before the deletion request can be executed.

15.2 Patient deletion requests

If you are a patient, please contact your clinic/practitioner (the Controller), use the in-app Data Requests feature where available, or contact your provider directly. We may assist the Controller as a Processor. The Controller is responsible for responding to patient rights requests, subject to applicable laws and clinical recordkeeping obligations.

16) Your Rights (UK GDPR)

Subject to applicable law, including the UK GDPR and EU GDPR where applicable, you may have the right to:

• Access your Personal Data.
• Correct inaccurate or incomplete data.
• Request deletion (erasure) of your Personal Data.
• Restrict or object to certain processing.
• Request data portability (where applicable).
• Withdraw consent (where processing is based on consent).

To exercise rights, contact us at [email protected]. We may need to verify your identity. If you believe we have not addressed your concern, you may lodge a complaint with the UK Information Commissioner’s Office (ICO).

If we need more information to verify your identity or understand the scope of your request, we may ask you to clarify or provide the necessary information. Where applicable, the response period may pause while we wait for that information. We will carry out reasonable and proportionate searches for relevant Personal Data.

If you believe the billing country locked to your account is inaccurate, you may contact us to request review, correction, reset, and re-verification.

ICO contact: https://ico.org.uk/

17) Children’s Privacy

The Service is not intended for individuals under 18 to create accounts or use it directly. Clinics and practitioners may process minors’ Patient Data as part of care and are responsible for obtaining any required verified parental/guardian consent, authorisation, and complying with applicable laws.

18) Automated Decision-Making

We do not intend to use Personal Data for solely automated decision-making with legal or similarly significant effects (as defined under UK GDPR). If this changes, we will update this Policy.

19) Changes to how we use Personal Data

We currently use Personal Data only for the purposes described in this Privacy Notice, including providing and securing the Service, managing accounts, support, billing, subscriptions, legal compliance, service communications, and aggregated reporting intended not to identify individuals.

Before we introduce a new processing purpose, a materially different use of Personal Data, a new category of recipient, or a material change to this Privacy Notice, we will review the change under UK GDPR, the Data Protection Act 2018, and, where relevant, PECR.

Where required, we will update this Privacy Notice and provide appropriate information to affected users before the new or materially changed processing begins.

We will not rely on a Privacy Notice update alone where the change requires consent, a new lawful basis assessment, a data protection impact assessment, or another specific compliance step.

20) Changes to This Notice

We may update this Policy from time to time. When we do, we will update the “Last Updated” date and, where appropriate, provide additional notice.

21) Contact

Questions or requests regarding this Policy:

• Email: [email protected]
• Address: 128 City Road, London, EC1V 2NX, United Kingdom