DRAFT – for legal review. Not yet approved.

Privacy policy

Last updated: 28 September 2026

Who we are

UK Dental Care is operated by TODO: company legal name, registration number, registered address (Romania) (“we”, “us”). We are the data controller for the personal data described here. Contact us about privacy at TODO: privacy contact email.

Our UK representative under Article 27 UK GDPR is: TODO: UK representative name and address.

We do not provide dental treatment. Treatment is provided by TODO: clinic name, Istanbul, Türkiye, which is a separate controller for the data it uses to treat you.

What we collect

• Contact details you give us: first name, phone number, email address and how you’d like to be contacted.
• Your quiz answers: the kind of treatment you’re interested in and when you’d like to travel.
• Dental X-rays and photos of your teeth that you choose to send us by WhatsApp. These are health data (special category data). We process them only with your explicit consent, which you give by sending them to us.
• Your consent choices, with the wording and version you agreed to, and the time.
• Technical and marketing data: advert source (UTM parameters and Facebook click ID), the page you landed on, your browser’s user agent and IP address, and, if you accept marketing cookies, Meta cookie identifiers.

Why we use it, and our lawful basis

• To answer your enquiry and prepare your plan and quote: your consent, and steps at your request before a contract.
• To handle your X-rays and photos: your explicit consent (Article 9(2)(a) UK/EU GDPR).
• To send occasional updates and offers, only if you ticked the box: your consent.
• To measure our adverts (Meta Pixel and Conversions API): your consent for cookies; for the server-side lead event, our legitimate interest in measuring advertising, using hashed contact details.
• To keep records of consents and prevent spam: our legitimate interests and legal obligations.

Sharing with the clinic in Türkiye

To prepare your plan we share your details, answers and any X-rays or photos with TODO: clinic name in Istanbul. Türkiye does not have a UK or EU adequacy decision, so this is an international transfer. Safeguards: [TODO: e.g. UK International Data Transfer Addendum / EU Standard Contractual Clauses with the clinic].

Our processors

• Vercel (website hosting; functions run in the EU)
• Google (Google Sheets, where enquiries are stored)
• Resend (email notifications to our team)
• Meta Platforms (Meta Pixel, Conversions API, and WhatsApp)

How long we keep it

Enquiries: 24 months from your last contact. X-rays and photos: deleted once your plan is prepared, unless you book treatment.

Your rights

Under UK GDPR and EU GDPR you can ask to access, correct, delete or move your data, object to or restrict how we use it, and withdraw consent at any time (this doesn’t affect what we did before). To unsubscribe from updates, reply “STOP” or email TODO: privacy contact email.

Complaints

Please contact us first. You can also complain to the UK Information Commissioner’s Office (ico.org.uk, 0303 123 1113) or, in the EU, to your local data protection authority (in Romania, ANSPDCP).