Article 1 - General

Dentascribe (“we”, “us”, “our”, “Dentascribe”) provides an AI-powered clinical note-taking tool (the “Tool”) for dental professionals.

Under the UK General Data Protection Regulation (UK GDPR) we act in two roles:

1. As a Data Controller: for the personal data of our users (dental professionals) relating to their account, billing and use of the Tool.
2. As a Data Processor: for patient data submitted to the Tool. We process this data only on the instructions of the user (the dental professional or practice), who remains the Data Controller for their patients’ records. This processing is governed by our Data Processing Agreement (DPA).

Our websites and Tool are not intended for children.

Article 2 - What personal data does Dentascribe collect?

2.1 Data we collect about YOU (As a Data Controller)

Special categories: Dentascribe does not collect special category data about you as a user (for example, your race, religious beliefs or health data).

2.2 Data we process on your behalf (As a Data Processor)

When you use the Tool in clinical practice, we process the following on your behalf:

• Patient health data (special category data): audio recordings of consultations and dictation, transcripts, clinical notes, letters, tasks and dental history.
• Patient media: photos of daily appointment lists (daylists).
• Contact data: email addresses of patients or other recipients, used only to deliver letters when you choose to send them.

Article 3 - The legal basis and purposes of data processing

3.1 General purposes (User Data)

We process your User Data on the following lawful bases:

• Performance of a contract: to create your account, provide the Tool and process subscription payments.
• Legitimate interests: to analyse usage using pseudonymous IDs, improve our services, fix bugs and keep the Tool secure.
• Legal obligation: to keep financial records for tax and accounting purposes.

3.2 Processing Patient Data

We process Patient Data only to provide the Services you use (transcription, note and letter generation, encrypted sync and sending letters at your request), under our Terms of Service and DPA. As the Data Controller, you are responsible for having a lawful basis, and for health data an applicable Article 9 condition, for this processing, and for telling patients that you use an AI documentation tool.

3.3 Direct Marketing & Promotional Campaigns

• Registered users: we may email you about Dentascribe features or similar services, based on our legitimate interests. You can opt out at any time using the unsubscribe link in any email or by contacting us. We never use Patient Data for marketing.
• Promotions, events and offers (e.g. Foundation Dentist / DFT programme, conference lists): when you register for a promotional offer, event list, waitlist or educational campaign (such as the DFT offer or an event page), we process your name, contact email and any optional affiliation details you provide (such as academic affiliation and graduation year) based on your consent. We use this data to send the updates you asked for and, where relevant, to deliver promotional credits or vouchers (e.g. the £60 post-DFT credit). You can withdraw consent at any time using the unsubscribe link or by emailing contact@dentascribe.uk. Joining these lists is optional; you can also request promotional credits by email without subscribing. Promotional lists are kept separate from Dentascribe application accounts and patient data.

Article 4 - Transfer to Third Parties and Sub-processors

We do not sell or rent personal data. We only share data with third parties as necessary to run the Tool, for example cloud hosting, AI processing, email delivery and payment processing. Each of these providers is bound by a data processing agreement.

Our sub-processors for Patient Data, with their locations and transfer safeguards, are listed in Annex III of our Data Processing Agreement. We will give customers at least 14 days’ notice before adding or replacing a sub-processor.

Stripe processes your payment details and does not receive Patient Data.

4.1 Artificial Intelligence Sub-processors

To provide transcription and AI generation, we use carefully selected AI providers.

• No model training: our AI providers are contractually prohibited from using User Data or Patient Data to train, improve or fine-tune their models.
• Limited retention: data sent to AI providers is processed only to return a result and is not retained, except as strictly necessary for security or abuse monitoring under their contracts with us.
• No audio storage by Dentascribe: we do not keep audio after it has been transcribed.

4.2 International Transfers

Our primary hosting and storage are in the United Kingdom. Some sub-processors process data in the European Union or the United States. Transfers outside the UK are protected by UK adequacy regulations, the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or the UK Extension to the EU-U.S. Data Privacy Framework, as applicable.

4.3 Business Transfers and Legal Requirements

• Business transfers: if Dentascribe is reorganised, merged or sold in whole or in part, personal data may be transferred to the new entity. We will tell you in advance.
• Legal requirements: we may have to disclose personal data to comply with a court order or applicable law. Where legally possible, we will tell you beforehand.

Article 5 - Cookies and Analytics

Our website and Tool use cookies and similar technologies to keep you signed in, remember your preferences, keep the Tool secure and understand how it is used.

We use PostHog, hosted in the EU, for product analytics and error tracking. It is configured so that patient data and clinical text are not sent to it. You can set your browser to reject cookies, but some parts of the Tool may not work properly.

Article 6 - The duration of the processing (Data Retention)

6.1 Retention of User Data

• Account and billing data: kept while your account is active. After account deletion, financial records may be kept for up to 7 years to meet accounting and tax law.
• Marketing and promotional lists: kept until you unsubscribe or withdraw consent, or for the active duration of the relevant campaign (typically up to 6 months after the relevant training or graduation year, or 12 months from signup), after which your details are removed from our mailing lists.

6.2 Retention of Patient Data (Auto-Deletion)

Dentascribe is a clinical drafting tool, not a permanent patient management system. We keep Patient Data only as long as needed:

• Standard purge: appointments, clinical notes, daylists and generated letters stored on our servers are automatically and permanently deleted no later than 100 days after they were last updated.
• Local privacy mode: if enabled, clinical data is deleted from the application after 14 days.
• Secure links: links sent to patients expire after 30 days.
• Audio: not kept by Dentascribe after transcription.
• Daylist photo transfer: photos sent between your devices are deleted after transfer, and in any event within 24 hours.

Article 7 - Security and Client-Side Encryption

We use appropriate technical and organisational measures to protect data against unauthorised access, loss or destruction, including encryption in transit and at rest, access controls and multi-factor authentication for our staff.

Client-side encryption: clinical drafts that you sync (including notes, letters, tasks and appointment details) are encrypted on your device before they are uploaded, using a key derived from your encryption passphrase. Dentascribe staff cannot read these stored drafts.

AI processing: to transcribe audio or generate a draft, the relevant content has to be readable by the AI provider for the duration of the request. This processing is automated and is not viewed by Dentascribe staff.

You share responsibility for security: use a strong password and encryption passphrase, enable two-factor authentication and keep your devices secure.

Article 8 - Your Rights

Under the UK GDPR, you have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate or incomplete data.
• Erasure: ask us to delete your personal data where it is no longer needed and we are not legally required to keep it.
• Restriction and objection: object to processing (for example, direct marketing) or ask us to restrict it in certain circumstances.
• Data portability: receive your data in a structured, commonly used, machine-readable format.
• Withdraw consent: where processing is based on consent, withdraw it at any time.

Patient rights: patients who want to exercise their data rights (for example, a subject access request) should contact their dental professional or practice, who is the Data Controller. Because synced clinical drafts are encrypted with your key, Dentascribe cannot read them, but we will assist you in responding and provide in-app tools to export data.

Article 9 - Changes to our Privacy Policy

We may update this Privacy Policy from time to time. We will tell you about significant changes by email or in the Tool. The date at the top of this page shows when it was last updated.

Article 10 - Contact and Complaints

For questions about this Privacy Policy or to exercise your rights, contact us at:

Email: contact@dentascribe.uk

We aim to respond to all requests within one month. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection (ico.org.uk). We would appreciate the chance to address your concerns first.