Legal
Draft documents for review by a solicitor. They will be finalised before launch.
Privacy notice
This notice explains how PracticeProof collects and uses personal data when you visit our website, use PracticeProof, fill in a form on our demo site, or are referred to us. It is written to meet Articles 13 and 14 of the UK GDPR and, because we are established in Portugal, of the EU GDPR.
1. Who we are
1.1 PracticeProof is a trading name of [owner's full legal name], a self-employed trader (trabalhador independente) registered in Portugal with tax number (NIF) [number], business address [address], Portugal. We are the controller for the personal data described in section 3.
1.2 Contact for privacy questions: [privacy email], or by post to our business address.
1.3 Because we are based outside the UK and offer our service to UK businesses, the UK GDPR also applies to us. Our UK representative under Article 27 UK GDPR is [name and UK address] [lawyer to confirm whether one is required]. [ICO registration or data protection fee: lawyer to confirm whether it applies to us.]
1.4 Our lead supervisory authority in the EU is the Comissão Nacional de Proteção de Dados (CNPD), Portugal.
2. When we are not the controller
2.1 Dental practices use PracticeProof to store documents and records, including information about their own staff and contractors (for example names, roles, training certificates, DBS check dates and immunisation status). For that information, the practice is the controller and we act as its processor under a data processing agreement. If you work at a practice that uses PracticeProof, your practice's own privacy notice explains how it uses your data, and you should contact your practice first to exercise your rights. We will help the practice respond.
2.2 Practices must not upload patient data to PracticeProof.
3. What we collect, why, and our lawful basis
| Who you are | Data we collect | Why we use it | Lawful basis (Art. 6 UK GDPR and EU GDPR) |
|---|---|---|---|
| Account owner or user at a customer practice | Name, work email, phone, role, login details, two-step verification settings, activity log in the Service | To create and secure your account, provide the Service, keep an audit trail of approvals | Contract with the practice; legitimate interests in running a secure service (Art. 6(1)(f)) |
| Billing contact | Name, billing email and address, purchase order reference, payment status. Card details are handled by our payment provider; we see only the card type, last 4 digits and expiry | To take payment, issue invoices, keep accounting records | Contract; legal obligation to keep accounting records (Art. 6(1)(c)) |
| Anyone contacting support | Name, email, your message and any attachments | To answer questions and fix problems | Legitimate interests in supporting customers |
| Website visitor | IP address, device and browser data, pages visited, cookie choices | To run and secure the website and, where you do not object, to measure how it is used (see Cookie Policy) | Legitimate interests; PECR regulation 6 exemptions |
| Person referred by a customer | Your email address, given to us by the referring practice, and whether you signed up | To send one invitation on the practice's behalf, and to credit the referral | Legitimate interests in operating the referral programme |
| Prospective customer or partner, including anyone who fills in the pilot or feedback form on our demo site | Name, work email, organisation, your form answers, notes of our conversations (the feedback form can be sent without a name) | To respond to your enquiry and, where allowed, send relevant updates about PracticeProof | Legitimate interests; for marketing emails, see section 6 |
| Consultant or partner working with us | Name, contact details, qualifications, payment details | To manage our relationship and pay you | Contract; legal obligation |
3.1 We do not intend to process special category data as controller. Where special category data (such as staff immunisation status) is stored in the Service, it is processed for the practice as processor, and the practice is responsible for the condition under Article 9 UK GDPR.
3.2 If your practice signed up through a partner's link or code, we tell that partner your practice name, the date you signed up, whether you are paying, and the commission earned. We do this under our legitimate interests in running the Partner Programme. We never share your documents, staff data or compliance status with partners.
4. Artificial intelligence
4.1 PracticeProof uses AI models to draft documents, answer questions from official sources and check uploaded documents. Documents you ask the agent to work on are sent to our AI model provider for that purpose only.
4.2 We do not use your data, or documents in the Service, to train AI models, and our contract with the AI model provider prohibits it from doing so [to confirm against provider terms].
4.3 We do not make decisions with legal or similarly significant effects about individuals using automated processing alone. Every document is approved by a person at the practice before it is added to the register.
5. Who we share data with
5.1 We share personal data only with:
- (a) our service providers (processors), who act on our instructions under contract: hosting [provider, location], AI model provider [provider, location], email delivery [provider], payment processing [provider], customer support tools [provider], website analytics [provider, if any], and the form and spreadsheet tools that receive the pilot and feedback forms on our demo site [Google Workspace];
- (b) independent compliance consultants whom we engage as subcontractors, when a practice accepts a Consultant Review. The consultant receives only the documents the practice chooses to send and is bound by confidentiality and data protection terms in its contract with us;
- (c) professional advisers, such as lawyers and accountants, under a duty of confidentiality;
- (d) the police, courts, regulators, tax authorities or other authorities in Portugal, the UK or elsewhere where required by law;
- (e) a buyer or successor if our business is sold or reorganised, under equivalent protections.
5.2 We do not sell personal data.
6. Marketing
6.1 We send marketing emails about PracticeProof to business contacts. Under PECR, emails to individual subscribers (including sole traders and partnerships) need consent unless you are an existing customer contact and the email is about similar services, with a chance to opt out at collection and in every message. Emails to employees at corporate addresses may be sent on the basis of legitimate interests, always with an easy opt-out.
6.2 You can unsubscribe at any time using the link in each email or by contacting us. Service messages, such as billing and security notices, are not marketing and continue while you have an account.
7. International transfers
7.1 We are based in Portugal, in the European Union. Personal data sent to us from the UK is covered by the UK's adequacy regulations for the European Economic Area. Our main hosting is planned in [the UK (London)], which the EU recognises as adequate [lawyer to confirm the EU adequacy decision for the UK is in force].
7.2 Some providers, including [the AI model provider], may process data in [the United States]. For those transfers we rely on: the EU-US Data Privacy Framework and, for UK data, the UK Extension to it, for certified organisations; or the EU Standard Contractual Clauses with the UK Addendum (or the UK International Data Transfer Agreement), together with a transfer risk assessment [lawyer to confirm]. You can ask us for a copy of the relevant safeguards.
8. How long we keep data
| Data | Retention |
|---|---|
| Account and user data | While the practice has an account, then up to [90] days after it ends |
| Customer content (as processor) | Export available for 30 days after cancellation (60 days if we close the Service), then deleted within [60] days, or sooner where we can; backups overwritten within [35] days |
| If we close the Service | We delete all personal data we hold within the same periods, except invoices and accounting records, which we must keep for the period Portuguese law requires |
| Invoices and accounting records | [10] years from the end of the year they relate to, as Portuguese tax and accounting law requires [accountant to confirm the period] |
| Support conversations | [2] years after the conversation closes |
| Referral invitation emails | [12] months if the person does not sign up |
| Marketing preferences and opt-outs | As long as needed to respect your choice |
| Website analytics | [14] months, aggregated afterwards |
9. Your rights
9.1 You have the right to: be informed; access your data; rectification; erasure; restriction of processing; data portability; object to processing based on legitimate interests or for direct marketing; and rights relating to automated decision-making.
9.2 To use your rights, contact [privacy email]. We will respond within one month of receiving your request. We may extend this by up to two further months for complex requests, and the time limit may pause while we wait for information we reasonably need to confirm your identity or to clarify the request. We will tell you if this happens.
9.3 If your data is in a practice's records, we will pass your request to that practice and help it respond (see section 2).
10. Complaints
10.1 If you are unhappy with how we have used your data, please complain to us first at [privacy email]. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated and tell you the outcome.
10.2 You also have the right to complain to a supervisory authority. If you are in the UK, that is the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113. Our lead authority in the EU is the CNPD in Portugal: www.cnpd.pt. You may also complain in the EU country where you live or work.
11. Security
11.1 We use technical and organisational measures appropriate to the risk, including encryption in transit and at rest, two-step verification, role-based access, logging, and regular backups. Details are in Annex 2 of our Data Processing Agreement.
12. Changes
12.1 We will update this notice when our processing changes, and tell account holders of significant changes by email or in the Service.
These documents are in English. The English version applies.