Compliance, Security & GDPR (UK/EU)
Last updated: 7 October 2026
At a glance
- GDPR compliant (UK GDPR & DPA 2018)
- You control patient data (you're the Controller; we operate as your Processor)
- UK/EU hosting on AWS (London: eu-west-2), with AI Notes processed by Microsoft Azure (UK South and West Europe) and Google Vertex AI (EU)
- AI Notes clinical content is processed in the UK and EU. Billing and email delivery may be processed outside the UK/EEA with appropriate safeguards (e.g., SCCs/UK addendum/DPF where applicable).
- Encryption: TLS in transit, encryption at rest
- Daily backups with rolling retention (UK database backups: 7 days)
- AI Notes: audio is never stored; Azure AI Speech transcribes it, and Gemini (Vertex AI, EU) drafts the note
- Registered with the MHRA as a Digital dictation system (GMDN 36216, UK MDR Class I; documentation support only)
- DSPT Standards Met (2025/26 v8, ODS V5P2T, valid to 30 June 2027)
- Cyber Essentials certified (whole organisation, certified 16 September 2026)
- Independent penetration test passed (Mondas Consulting, final retest 10 April 2026)
What we actually do with your data
AI Notes (documentation support):
Azure AI Speech turns your recording into text. Your audio is never stored: it is sent for transcription and discarded. We then use Google Cloud Vertex AI (Gemini), processed in the EU, to turn the transcript and your settings into a tidy draft. You review and edit before saving the final note into your practice's clinical system (PMS). Our AI providers do not use your content to train their models.
Boards, Rotas, Lab Tracker & CPD:
These are secure workspaces your team controls. Add what you need (tasks, logs, rota entries, lab cases, certificates). You can export, rename, or delete items whenever you like.
We never sell personal data. Ever.
Where your data lives
- Platform and clinical content for UK customers is stored on AWS in London (eu-west-2). AI Notes is processed by Microsoft Azure (UK South and West Europe) and Google Vertex AI (EU).
- Some services (e.g., billing and email delivery) may involve processing outside the UK/EEA. Where this applies, appropriate safeguards are used (e.g., SCCs/UK addendum/DPF as applicable). The full list is in our Data Processing Addendum.
Security, without the jargon
Encryption by default
TLS 1.2+ in transit, encryption at rest with cloud‑managed keys.
Access control
Role‑based permissions, individual accounts and multi‑factor authentication available on every account.
Resilience
Daily backups and region‑appropriate redundancy.
Good engineering hygiene
Secure development, change control, dependency monitoring, logging and alerts.
AI provider settings
AI Notes uses UK and EU endpoints. Google Cloud Vertex AI customer data is not used to train or improve Google's AI models.
Your choices & rights
- Rename or delete your Saved Chats in AI Notes any time.
- Ask to access, correct, delete, restrict, or port your personal data.
- Prefer fewer cookies? Use our cookie controls on the website.
- Need help? A human will respond at info@dentistrydashboard.com.
What Dentistry Dashboard is not
- We don't make clinical decisions. AI Notes is for drafting documentation only. Clinicians remain in charge.
- We don't store audio. It is sent for transcription and discarded.
- We don't move AI Notes clinical content outside the UK/EEA. Some services (billing, email delivery, website analytics) may involve processing outside the UK/EEA with safeguards.
UK Compliance & Clinical Safety
Dentistry Dashboard is developed and operated to support UK NHS and data protection expectations for safe, responsible use, including:
- DCB0129-aligned clinical safety for AI Notes with a named Clinical Safety Officer, safety case documentation, and hazard management
- DSPT Standards Met - 2025/26 (version 8), published 13 April 2026, valid to 30 June 2027 (ODS V5P2T)
- Cyber Essentials certified (whole organisation, 16 September 2026) with cyber liability insurance in force
- Independent penetration test passed - Mondas Consulting, final retest 10 April 2026, no remaining reportable findings in scope
- MHRA manufacturer & device registration - GMDN 36216 (Digital dictation system), UK MDR Class I
- UK GDPR / Data Protection Act 2018 compliant processing approach; ICO registered (ZC087154)
For practices & IG teams
Roles
Your practice = Controller (patient/practice data). Dentistry Dashboard = Processor for that data; Controller for our own account/billing data.
Hosting
AWS (London); AI Notes on Azure (UK South, West Europe) and Vertex AI (EU).
AI services
Azure AI Speech (STT), Vertex AI (Gemini) (LLM drafting), both in the UK/EU.
Sub‑processors
Core: AWS (hosting), Azure AI Speech (transcription), Vertex AI (Gemini) (draft formatting), Stripe (billing), Postmark (transactional email). Website analytics/ads may use services like Microsoft Clarity and Meta Pixel. Optional (you connect): Google Workspace, Zapier. The full list with regions and safeguards is in our Data Processing Addendum.
International transfers
AI Notes clinical content is processed in UK/EU regions. Billing, email delivery and website analytics may involve processing outside the UK/EEA under appropriate safeguards (e.g., SCCs/UK addendum/DPF where applicable).
Retention
Saved Chats stay until users delete them. UK database backups retain deleted data for up to 7 days. Application logs are retained for 14 days.
Breach response
As Processor we notify Controllers without undue delay, with a first notice within 24 hours, and support their ICO 72‑hour obligations.
Legal docs
Our Data Processing Addendum (Art. 28) is published; data exit/termination and continuity information is available for Trust procurement/IG review.