Data Processing Agreement

The Practice is the controller of the personal data it puts into Dent Dock, or that its patients give through Dent Dock. Dent Dock is its processor. "UK data protection law" means the UK GDPR and the Data Protection Act 2018. Words such as "controller", "processor", "personal data", "personal data breach" and "data subject" have the meanings given in the UK GDPR.

The details of the processing are in Annex 1.

We process personal data only on the Practice's documented instructions. Those instructions are this DPA, the Terms of Service, the Practice's use and settings of Dent Dock, and any other written instructions the Practice gives us that we agree to. We will tell the Practice straight away if we believe an instruction breaks UK data protection law. If the law requires us to process personal data for another reason, we will tell the Practice first, unless the law forbids it.

Only people who need access to provide, support or secure the service can access personal data, and they are bound by confidentiality. Our team signs in to a Practice's account only to help the Practice or to keep the service working, through a named "Dent Dock Support" user. Each support session is short, is recorded, and the record can be seen by the Practice.

We take the technical and organisational measures required by Article 32 of the UK GDPR. The main measures are listed in Annex 2. We may improve them over time, but we will not reduce the overall level of protection.

The Practice gives us general permission to use sub-processors. Those we use today are listed in Annex 3. We will tell the Practice at least 30 days before we add or replace a sub-processor, and the Practice may object on reasonable data protection grounds. If we cannot resolve an objection, the Practice may close its account. Each sub-processor is bound by a written contract with data protection obligations equivalent to this DPA, and we remain responsible to the Practice for its work.

Some sub-processors may process personal data outside the UK. We only allow this where UK data protection law permits it, for example under UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.

Taking into account the nature of the processing, we will help the Practice:

• to respond to patients and others using their rights, including by providing exports of a patient's records. If we receive a request directly, we will pass it to the Practice and not answer it ourselves;
• to keep personal data secure;
• with data protection impact assessments and any consultation with the Information Commissioner's Office, where they relate to Dent Dock.

We will tell the Practice without undue delay, and in any case within 48 hours, after we become aware of a personal data breach affecting the Practice's personal data. We will give the information we have about what happened, the data and people affected, and what we are doing about it, and keep the Practice updated. We will not tell patients or the regulator on the Practice's behalf unless the Practice asks us to or the law requires it.

When the Practice's account closes, we will, at the Practice's choice, return its personal data in a common electronic format or delete it, within 90 days, unless the law requires us to keep it. Dental records usually have to be kept for many years, so the Practice should ask for a copy of its patient records before its account closes.

We will give the Practice the information it reasonably needs to show that we meet this DPA. The Practice may audit our compliance, or have an independent auditor bound by confidentiality do so, once a year on at least 30 days' written notice, at its own cost, or more often after a personal data breach or if a regulator requires it. We may first answer a written questionnaire where that gives the Practice what it needs.

The Practice is responsible for having a lawful basis for the personal data it processes with Dent Dock, for telling its patients how their data is used (Dent Dock provides a standard patient privacy notice that the Practice can change), for the accuracy of the data, and for making sure its instructions to us are lawful.

Liability under this DPA is subject to the limits in the Terms of Service, except where the law does not allow it to be limited. This DPA lasts for as long as we process personal data for the Practice. It is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

We may update this DPA to reflect changes in the law or in the service. We will tell the Practice by email before any change that reduces its protection.

Subject matter — providing Dent Dock, practice management software for dental practices, to the Practice.

Duration — for as long as the Practice has an account, and until its data is returned or deleted under section 10.

Nature and purpose — storing and organising records; online booking and the patient portal; forms; appointment reminders, recalls and other messages; recording payments; reporting; support; and keeping the service secure.

Types of personal data — name, date of birth, contact details, address, appointments, dental and treatment notes, form answers, signatures, files and images, payment records, messages, and communication preferences.

Special category data — health data, including medical history, medicines, allergies and dental records.

Data subjects — the Practice's patients (including children), their parents, guardians or carers, and the Practice's staff.

• Data is stored in London, UK, and encrypted in transit (TLS) and at rest.
• Each practice's data is kept separate by database access rules, and staff permissions within a practice are set by role.
• Records of who did what are kept in the app.
• Our internal tools require two-factor sign-in and do not show patient records. Our team sees a practice's account only through a recorded support session, and direct access to the production database is limited to named administrators.
• Online booking and waitlist forms are protected against automated abuse.

• Supabase — database, sign-in, file storage and server functions. Data stored in London, UK.
• Stripe — subscription billing and patient payments.
• Resend — sending emails.
• Vercel — hosting the practice app and the online booking site.
• Cloudflare — protecting online booking and waitlist forms from automated abuse.

We do not send text messages yet. We will give 30 days' notice under section 6 before adding a text message provider.

Questions about this DPA: hello@dentdock.co.uk