Draft — to be reviewed by a solicitor before launch
Privacy Policy
Last updated:
The short version
We use practice staff and marketing-site visitor information to run OpenDent, support customers and keep the service secure. Your dental practice controls the patient and visitor enquiry data in its inbox; we process that data for the practice. Contact the practice about its use of your enquiry, or contact us about our own use of your information.
1. Who is responsible?
[Company legal name], trading as OpenDent (company number [Company number]), of [Registered address] is the controller for our customer administration, staff account administration and marketing-site visitor information. Contact us about privacy at hello@opendent.co.uk or at our registered address above.
For enquiries and related personal data collected through a practice’s widget or connected channels, the practice is the controller and OpenDent is its processor. The practice decides the purposes, lawful bases, recipients and retention of that information. Our DPA sets out how we process it. This policy does not replace the practice’s own privacy notice.
2. Information we use as a controller
- Practice contacts and staff: name, work email, practice details, role and account permissions, login and security records, and correspondence with us. We receive these from you, your practice administrator or your use of the service.
- Billing: billing name, address, subscription status, payment references and transaction records from you and Stripe. Card details are handled by Stripe; we do not need your full card number.
- Marketing-site visitors: IP address and technical request information, such as browser/device details, pages requested, time and referrer where supplied. These arise when your browser connects to our site and hosting providers. If you email us, we receive your contact details and message.
3. Why we use it and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Set up practice accounts, administer staff access, answer enquiries and provide support and service notices. | Legitimate interests in running and supporting a business service. Contract where the individual is themselves our contracting customer, including a sole trader, or requests steps before entering a contract. |
| Administer subscriptions, payments and billing queries. | Legitimate interests in administering business subscriptions; contract where you are personally a party to it. |
| Keep required accounting and tax records and respond to binding legal requests. | Legal obligation under applicable accounting, tax and other laws. |
| Deliver the website and its fonts, secure accounts, investigate misuse and resolve disputes. | Legitimate interests in a usable, secure service and protecting our business and users. We balance these interests against your rights. |
| Send optional promotional emails if we offer them. | Consent where required by PECR; otherwise legitimate interests in relevant business marketing where PECR permits it. You can unsubscribe or object at any time. |
Providing account and billing information is necessary to set up and administer your subscription. Without it, we may be unable to provide the service. Optional marketing is not a condition of using it. We do not sell personal information or make solely automated decisions with legal or similarly significant effects about you.
4. Information processed for practices
A widget asks about treatment interests and collects name, email and phone number. Finished chats become enquiries. A practice can also connect Facebook Messenger, Instagram DMs, Facebook Lead Ads, webforms and email. The inbox can hold messages, notes, tasks, files, staff activity and reports.
Enquiry records can include the page visited, referrer, ad click identifiers and UTM campaign tags, device information and a coarse city/region supplied by Cloudflare. This is approximate location, not GPS location. A treatment interest or free-text answer may reveal health information. Practices should avoid asking for clinical details and must establish an appropriate Article 6 lawful basis and, where applicable, an Article 9 condition and any required Data Protection Act 2018 safeguards.
We use this information on the practice’s instructions to deliver its inbox and related features. We do not use practice enquiries for our own marketing. Ask the practice about its follow-up communications, attribution, retention and your rights.
5. Providers and other recipients
Access is limited to authorised people and providers who need it for their work. We may disclose information to professional advisers, or to authorities where legally required, with appropriate confidentiality protections.
| Provider | Service and data | Location and safeguards |
|---|---|---|
| Cloudflare | Workers, Durable Objects, D1 database and Email Sending/Routing: hosting, storage and delivery of enquiries, messages, files and associated technical data. | Global infrastructure, including the US. UK IDTA or EU standard contractual clauses with the UK Addendum, with a transfer risk assessment and any necessary additional measures. |
| Provider | Purpose and role |
|---|---|
| Cloudflare | Also hosts and secures our marketing site and account administration data as our processor. |
| Stripe | Payment and subscription administration. Stripe acts as a processor for some services and as an independent controller for its own purposes, such as fraud prevention and legal compliance. It is not a recipient of patient enquiry content for payment processing. See Stripe’s Privacy Policy. |
| Meta and other practice-connected channels | A practice can choose to connect its social, advertising, form or email accounts. These providers handle data under their own terms and roles. They are not automatically our sub-processors simply because a practice connects them. |
6. International transfers
Cloudflare and Stripe may process information in the United States and other countries through their global operations. For restricted transfers we arrange, we use the UK International Data Transfer Agreement (IDTA), or the EU standard contractual clauses with the UK Addendum, as appropriate, and assess transfer risks and any additional protections needed. We do not rely on EU clauses alone for a restricted UK transfer.
Contact hello@opendent.co.uk for information about the safeguards relevant to your data and a copy, with confidential details removed where necessary.
Before launch: the owner must verify the contracted provider entities, actual processing locations and executed transfer safeguards. This draft is not evidence that an IDTA or Addendum has been signed. The ICO explains these transfer safeguards.
7. How long information is kept
Draft detail to complete before launch: the bracketed retention periods below must be replaced with the actual operational limits, including those of our providers.
- Unfinished chats: sessions expire after 24 hours. Abandoned data is cleaned up automatically. Cleanup completes within 180 days (7 days for test chats) after expiry.
- Completed enquiries and related practice data: kept under the practice’s instructions while the service is active. On exit, the practice may request an export within 30 days; live copies are deleted within [Post-termination deletion period] after the return/deletion process described in the DPA.
- Staff account and customer contact records: for the active relationship, then [Account record retention period], where needed for administration or claims.
- Support correspondence: [Support correspondence retention period] after the query is closed.
- Website and security logs: [Security log retention period], unless a specific incident or legal claim requires longer retention.
- Billing and accounting records: for the period required by the laws applying to our legal entity, to be confirmed as [Accounting record retention period].
- Optional marketing contacts: until you withdraw consent or object, or the contact is no longer relevant. We retain a minimal suppression record as necessary to honour an opt-out.
- Backups: rotate and are overwritten within 30 days. Data awaiting backup deletion is put beyond normal use. If restored for recovery, deletion instructions are reapplied.
If a legal duty or specific legal claim requires longer storage, we retain only what is needed, restrict its use and delete it when that reason ends.
8. Security
We use measures appropriate to the risks, including access controls and staff roles, confidentiality obligations and secure handling of data. The DPA describes our security commitments for practice data. No internet service can promise absolute security. Please protect staff accounts and report suspected misuse promptly.
9. Your rights and complaints
Depending on the circumstances, you can ask to access your personal information, correct it, delete it, restrict its use or receive a portable copy. You can object to processing based on legitimate interests, and you have an absolute right to object to direct marketing. Where we rely on consent, you can withdraw it at any time without affecting earlier lawful processing.
For information we control, email hello@opendent.co.uk. We may need proportionate information to confirm your identity. Requests are normally free and answered within one month, subject to lawful extensions or other rules; we will explain any that apply. For practice-controlled enquiries, contact the practice first. If we receive such a request, we will pass it to the practice and help it respond.
You can complain to us at the address above or by email. We will acknowledge your complaint within 30 days, investigate and keep you informed of the outcome. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to complete our complaints process before contacting the ICO. The ICO explains your data rights.
10. Cookies, fonts and updates
See our Cookie Policy for necessary app and widget storage, marketing demo storage and fonts. Our fonts are served from our own website, so no third party sees those requests. There are no analytics or advertising cookies on the marketing site.
We will update this policy when our processing changes and show the date above. We will bring material changes to customers’ attention and provide any new privacy information before using data for a new purpose.