Privacy Policy

Dental Notes AI · Last updated: July 2026

1. Who We Are

Dental Notes AI is an AI-powered clinical note-taking tool designed for GDC-registered dental professionals in the United Kingdom. This service is operated by All Med AI Ltd, a company registered in England and Wales. ICO registration number: ZC171046.

For any privacy-related queries, contact us at: hello@dentalnotesai.co.uk

2. What This Policy Covers

This policy explains how we collect, use, store and protect personal data when you use Dental Notes AI at dentalnotesai.co.uk.

We are committed to handling all data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

3. Data We Collect

Account Data

When you create an account, we collect:

Full name
Email address
GDC registration number
Password (stored in encrypted form via Supabase — we never see your password in plain text)

Usage Data

We collect:

Number of consultations generated (for trial and subscription management)
Date and time of account creation and last sign-in
Browser type (for compatibility purposes)

What We Do NOT Collect or Store

      Patient names, dates of birth, or NHS/patient numbers — these must never be entered into the app
Audio recordings — microphone audio is processed locally in your browser only and is never transmitted to our servers
Consultation transcripts — transcripts are processed in memory during note generation and discarded immediately afterwards. They are never stored on our servers

    

What We Store Briefly

Generated clinical notes — most recent (recovery) — your most recent generated note is saved securely to your Supabase account to enable note recovery if you close your browser tab. Only the structured note text is stored — no audio, no transcript. It is automatically and permanently deleted 7 days after it is saved. You can also delete it at any time from within the app (Account → Data & Privacy → ‘Delete all notes’), or by contacting hello@dentalnotesai.co.uk. Notes are never shared with any third party.

Recent notes (entitled plans) — the clinical notes you generate are stored securely on UK servers so you can review them from the in-app notes list for up to 7 days. They are automatically and permanently deleted 7 days after the note is taken, by a scheduled process that runs inside our database regardless of whether you use the app.

End-of-day audit (entitled plans) — a list of the day's follow-up tasks is stored to power the end-of-day audit. Patients are referenced by number ('Patient 1, 2, 3…') or, at your choice, by initials only — a maximum of three letters. Full names cannot be stored: the database itself rejects any entry longer than three letters. It is automatically and permanently deleted 7 days after the note is taken.

All of the above is stored on UK servers (Supabase, London), restricted to your own account, and never shared with any third party.

4. How We Use Your Data

We use your data to:

Create and manage your account
Track your consultation usage for trial and subscription management
Send essential account communications (password reset, subscription confirmation)
Maintain the security and integrity of the service
Comply with our legal obligations

We do not use your data for:

Marketing to third parties
Advertising
Selling or sharing with any third party for commercial purposes

5. The Clinical Data Question

This is the most important section for dental professionals to understand.

Here is exactly what happens to the content you dictate, and why it should never contain identifiable patient data. Consultation transcripts and audio are never written to disk or stored in any database — they exist only transiently and are discarded immediately after note generation. Generated notes are stored briefly and securely on UK servers to provide note recovery and the in-app daily features (see 'What We Store Briefly' above) and are automatically deleted 7 days after the note is taken. All such storage is pseudonymised: patients are referenced by number ('Patient 1, 2, 3…') or, at your choice, by initials only — a maximum of three letters, enforced by the database itself. Full names are never stored.

Our AI provider (Anthropic) processes transcripts transiently to generate your note. This processing may take place outside the United Kingdom (including in the United States). Anthropic does not store the transcript and does not use it to train its models. No transcript is ever retained beyond the duration of a single API call.

However, you as the clinician are the data controller for any patient information you choose to dictate. You should:

Never dictate patient names, dates of birth, NHS numbers, or other directly identifying information
Refer to patients by tooth notation, presenting complaint, or initials only
Ensure any generated notes are stored securely within your practice management software in accordance with your own GDPR obligations

6. Legal Basis for Processing

We process your personal data on the following legal bases under UK GDPR:

Contract performance — to provide the service you have signed up for (Article 6(1)(b))
Legitimate interests — to maintain security, prevent fraud, and improve the service (Article 6(1)(f))
Legal obligation — to comply with applicable UK law (Article 6(1)(c))

7. Third-Party Services We Use

To deliver Dental Notes AI, we use the following third-party services:

Service	Purpose	Data Shared	Privacy Policy
Supabase	User authentication and account data storage	Name, email, GDC number, usage count; plus generated notes and follow-up tasks from the last 7 days (patients referenced by number or initials only, never by full name), automatically deleted after 7 days.	supabase.com/privacy
Anthropic	AI note generation	Consultation transcript (transient, processed outside the UK — never stored; Anthropic does not use it to train its models)	anthropic.com/privacy
Vercel	Website hosting and infrastructure	IP address (standard server logs)	vercel.com/legal/privacy-policy
Stripe	Payment processing (when active)	Payment details, billing name and address	stripe.com/gb/privacy
Resend	Transactional email delivery	Email address	resend.com/legal/privacy-policy
Sentry	Error monitoring	Technical and diagnostic error data (may include account identifiers)	sentry.io/privacy

All third-party providers are contractually bound to process data only as instructed and in accordance with UK GDPR requirements.

8. Data Storage and Security

Account data is stored securely by Supabase on servers located in the United Kingdom (London, AWS eu-west-2)
All data transmission uses TLS encryption (HTTPS)
Passwords are hashed using industry-standard bcrypt encryption
We do not store payment card details — these are handled entirely by Stripe
Access to account data is restricted to authorised personnel only

Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users without undue delay. Where the breach meets the reporting threshold under UK GDPR, we will report it to the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it.

9. Data Retention

Data Type	Retention Period
Account data	For the duration of your account, plus 90 days after deletion
Usage / consultation count	For the duration of your account
Consultation transcripts	Never stored — discarded immediately after processing
Generated notes — most recent (recovery)	Automatically deleted 7 days after saving
Generated notes — recent list (entitled plans)	Automatically deleted 7 days after the note is taken
End-of-day audit tasks	Automatically deleted 7 days after the note is taken
Payment records	7 years (legal requirement for financial records)

10. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right of access — request a copy of the data we hold about you
Right to rectification — request correction of inaccurate data
Right to erasure — request deletion of your account and associated data
Right to restrict processing — request that we limit how we use your data
Right to data portability — receive your data in a structured, machine-readable format
Right to object — object to processing based on legitimate interests

To exercise any of these rights, contact us at hello@dentalnotesai.co.uk. We will respond within 30 days.

Note: your stored notes and end-of-day audit data can be deleted immediately and in full without contacting us — use Account → Data & Privacy → ‘Delete all notes’ inside the app. This permanently removes every note held for your account, not only today's.

11. Cookies

We use only essential cookies necessary for the service to function, including:

Authentication session cookies (to keep you logged in)
Security cookies (to protect against cross-site request forgery)

We do not use advertising cookies, tracking cookies, or any third-party analytics cookies.

12. Children

Dental Notes AI is intended for use by GDC-registered dental professionals only. We do not knowingly collect data from anyone under the age of 18. If you believe a minor has created an account, please contact us immediately.

13. Changes to This Policy

We may update this policy from time to time. The date at the top of this page reflects the most recent update. We encourage you to review this policy periodically; it is your responsibility to remain aware of any changes. Your continued use of Dental Notes AI after an updated policy is published constitutes acceptance of the revised policy.

14. Complaints

If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO):

ICO
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
ico.org.uk/concerns
0303 123 1113

15. Contact

For any privacy questions or to exercise your data rights:

Email: hello@dentalnotesai.co.uk
Service: Dental Notes AI — dentalnotesai.co.uk