Data Processing Agreement

“Controller”: you, the dental associate (and/or your practice) who connects a Dentally practice to Praxis. “Processor”: Praxis Health Technologies Ltd, a company registered in England & Wales (company no. 17294974, registered office 128 City Road, London, EC1V 2NX, United Kingdom), ICO registration ZC180094, trading as “Praxis”.

For patient-related data drawn from your Dentally system, you are the controller and Praxis acts only as your processor, on your documented instructions. (For your own account data, Praxis is the controller, see the Privacy Policy.)

Processing of patient-related data from your Dentally system to provide performance analytics, follow-up lists, patient letters and related features, for as long as you maintain a practice connection or account, plus the deletion period in clause 8.

Importing, storing, structuring, analysing and displaying the data categories in clause 3; generating AI-assisted drafts (letters, call summaries) at your request; never for our own purposes; no advertising; no sale of data.

Data subjects: your patients. Data: for each patient, Praxis holds only the Patient ID (your own internal Dentally reference number), it holds no patient names, titles, dates of birth, email, phone or address, together with appointment history (dates, types, attendance, cancellation reasons), recall dates, payment totals attributed to you, follow-up statuses/notes created by your team, and letters you choose to save. The Patient ID is meaningless without authorised access to your Dentally system, so the patient data we hold is pseudonymised, with the re-identification key held solely by you.

Excluded by design (whitelisted ingestion): patient names and contact details, date of birth, address, NHS numbers, NI numbers, medical alerts, ethnicity, clinical notes and clinical records. Appointment data in a dental context is treated as special-category (health) data; you confirm its Article 9 condition (Article 9(2)(h), management of health and care services).

We process only on your documented instructions (this DPA, the product’s documented features, and the settings you operate), unless required by law, in which case we’ll tell you first unless the law prohibits it.

Persons we authorise to process the data are bound by appropriate confidentiality obligations.

Technical and organisational measures including: EU data storage (Supabase, Ireland); database row-level security isolating each user’s data; encryption in transit (TLS) and at rest; AES-256-GCM encryption of practice API credentials; least-privilege access roles; audit logging of sensitive actions; and read-only integration with Dentally.

You give general written authorisation for the sub-processors listed in our Privacy Policy (currently: Supabase, Vercel, GitHub, Anthropic, Resend, Google, Upstash and AssemblyAI). We’ll give notice of changes and you may object on reasonable grounds. We flow down equivalent data-protection obligations, and any transfer outside the UK/EU occurs only under appropriate safeguards (UK IDTA / Addendum / SCCs).

On termination of a practice connection or your account, we delete the related patient data automatically 30 days after the last practice connection ends (sooner on written request), except where law requires retention. Patients deleted in your Dentally system are propagated and removed automatically. You may request a copy in a structured format first.

Taking into account the nature of processing, we assist you with data-subject rights requests, security, breach notification, and DPIAs (Articles 32-36).

We notify you without undue delay after becoming aware of a personal data breach affecting your data, with sufficient detail for your own ICO and data-subject obligations.

We make available information reasonably necessary to demonstrate Article 28 compliance, and allow for audits (for example, summaries of security measures, sub-processor DPAs and relevant certifications) in a manner proportionate to a small processor.

The liability provisions of the Terms of Service apply to this DPA. This DPA is governed by the laws of England & Wales.

Questions about this DPA? Email info@praxisdental.co.uk.