Privacy policy

Who we are

practOS is provided by Gold Card Network Ltd, a company registered in England and Wales (number 17481974), at Unit 5 Flemming Court, Whistler Drive, Castleford, WF10 5HW, United Kingdom. We’re registered with the Information Commissioner’s Office, number ZC269572. You can reach us about anything in this policy at [privacy email address].

Our two roles

For patients’ information, the dental practice is in charge. Each practice decides what it records about its patients and why. It is the controller of that information under UK data protection law. We are its processor: we store and handle the information only to provide practOS to the practice, on its instructions, under a written data processing agreement. We never use one practice’s patient information for another practice or for our own purposes.

For the accounts of the people who use practOS (practice owners, managers, clinicians and reception staff), we are the controller.

What practOS holds for a practice

• Patients’ details: name, date of birth, contact details, address, NHS number, family links and contact preferences.
• Appointments, waiting lists, treatment plans and recall dates.
• Clinical notes and medical histories. These are health information, which the law treats as special category data. Practices hold it to provide dental care.
• Messages between the practice and its patients by WhatsApp, text message and Instagram, including photos and files either side sends, and the practice’s internal notes on those conversations.
• A record of each patient’s agreement or refusal to be contacted on each channel, and when they opted out.
• An audit trail of who viewed or changed what, and when.

Messaging through WhatsApp and Instagram

A practice can connect its own WhatsApp Business number and its Instagram professional account to practOS, using Meta’s own sign-in. When it does, practOS receives the following from Meta for that practice:

• Identifiers for the practice’s WhatsApp Business account, phone number and Instagram account, and their display names.
• Messages, photos and files sent to and from the practice’s number or account, with their delivery and read status.
• The WhatsApp number and profile name of each person who messages the practice. For Instagram, the account’s identifier for that person and their name or username.
• The practice’s message templates and Meta’s decision on each.
• If the practice keeps using the WhatsApp Business app on the same number: the recent chats and contacts it chooses to share from the app.
• An access token that lets practOS act for the practice on that number or account.

We use this only to run the practice’s inbox: to show and send its messages, to match a conversation to the right patient record, and to send the appointment reminders, confirmations and replies the practice has turned on. We do not sell it, use it for advertising or profiling, use it to train artificial intelligence, or share it with anyone except the service providers listed below, as the practice directs, or where the law requires it. Access tokens are encrypted with a key kept apart from the database. practOS keeps its own copy of photos and files, because Meta deletes its copies after about 30 days and they can form part of a patient’s record.

Meta also processes these messages to deliver them, under its own terms and policies. Patients choose to use WhatsApp or Instagram to talk to their practice, and can ask the practice to use another way instead.

Texts and email

Text messages are sent and received through a UK number provided for the practice. Sign-in, invitation and password reset emails go to the people who use practOS. Patients can reply STOP to any text or WhatsApp message to stop messages on that channel, and START to allow them again.

People who use practOS

For each person a practice invites, we hold their name, email address, job role and access level, which sites they can use, their sign-in and two-factor authentication details, and a record of what they do in practOS. We use this to let them sign in securely, to show the practice who did what, and to support and improve the service. Our lawful bases are our contract with the practice and our legitimate interest in running a secure service.

Who else handles information

We use these service providers (sub-processors), each under a contract that protects the information:

• Supabase: the database and sign-in, hosted in London.
• Vercel: runs the practOS website and its servers, in London.
• Meta Platforms: WhatsApp and Instagram messages, for practices that connect them.
• Twilio: text messages, for practices that use them.
• Resend: sign-in, invitation and password reset emails.

Patient records are stored in the UK. Some of these providers are based in the United States and may handle information there, for example to deliver a message. Where that happens we rely on the UK’s data bridge with the United States or the International Data Transfer Agreement, with the provider’s security commitments. We tell practices before adding or changing a sub-processor.

How long information is kept

A practice decides how long to keep its patients’ records, in line with the rules for dental records. practOS doesn’t quietly delete records: the practice can archive them, and anything removed stays in the audit trail. When a practice stops using practOS, we give it a full export of its data and then delete it within [90] days. Backups are overwritten within a further [35] days. Access tokens are deleted as soon as a practice disconnects a channel. To have information deleted sooner, see Deleting your data.

Keeping information safe

• Information is encrypted in transit and at rest, and stored in the UK.
• Each practice’s information is kept apart by rules in the database itself, not only by the screens.
• Everyone signs in with a password and a code from an authenticator app.
• People see only what their role and their sites allow, and their access ends when the practice removes it.
• Reading and changing records is recorded in an audit trail.

Your rights

You can ask to see the information held about you, to have it corrected, to have it deleted or its use restricted, to object to how it’s used, and to receive a copy to take elsewhere. Some rights are limited for health records a practice must keep.

If you’re a patient, please ask your dental practice first: it decides about your record, and practOS lets it export everything it holds about you. You can also write to us at [privacy email address] and we’ll pass your request to your practice straight away. If you use practOS at a practice, contact us directly.

If you’re unhappy with how your information has been handled, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We’d appreciate the chance to put it right first.

Cookies

practOS uses only the cookies it needs to work: ones that keep you signed in, one that remembers which practice you’re working in, and a short-lived one while a practice links its Instagram account. There are no advertising or analytics cookies, so there’s nothing to accept or decline.

Changes to this policy

When we change this policy we’ll update the date at the top, and tell practices about any change that affects them before it takes effect.