Privacy Policy
In plain English: We collect the professional contact, registration and billing details needed to provide our educational tools, RPD Rx software and RPD Rx Consult design review service. Our software tools run locally in your browser without storing patient details. When you submit a case to RPD Rx Consult, you must not include patient names or dates of birth, and our form clears binary STL file headers in your browser before upload. Uploaded case scans and photographs are deleted permanently 30 days after your review is completed.
1. Who we are and how to contact us
Dental Apptitude, RPD Rx and RPD Rx Consult are operated by Chet Geisel trading as Dental Apptitude , based in Cardiff, Wales, United Kingdom.
- Email for privacy and data protection queries: support@dentalapptitude.com
- ICO Registration Number: [Insert ICO Registration Number]
2. Our role under UK data protection law
We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Depending on how you use our services, our legal role is as follows:
- Clinician, student and educator accounts (Data Controller): We are the Data Controller for the personal information of the dental professionals, educators and students who create an account, subscribe to our software, or submit a consultation enquiry.
- RPD Rx software workspace (No patient data stored): When you survey a model or draw a prescription inside the self-service RPD Rx browser tools, your STL scan and PDF prescription are processed locally on your own computer. They are not uploaded to our servers.
- RPD Rx Consult case records (Data Processor / Record Keeping): When a prescribing clinician uploads de-identified scans, photographs and clinical notes to RPD Rx Consult for a design review, the submitting dental practice remains the Data Controller for the patient’s health record. We act as a Data Processor on the clinician’s instructions to provide technical design support (and as an independent Data Controller solely in respect of retaining our anonymised written design report for professional audit and indemnity purposes).
3. Information we collect and why
| Category | What we collect | Lawful basis (UK GDPR) |
|---|---|---|
| Account & professional verification | Your name, GDC registration number (or overseas equivalent), university or practice email address, practice name and address. | Contract (Art. 6(1)(b)) to provide the service; Legitimate interests (Art. 6(1)(f)) to verify that clinical tools and consultations are supplied only to registered dental professionals. |
| RPD Rx Consult case records | De-identified intraoral STL scans, study cast or clinical photographs, `.RPD` files, and clinical notes describing the prosthodontic challenge. | Contract (Art. 6(1)(b)) and Legitimate interests (Art. 6(1)(f)). Where records constitute pseudonymised health data, processing is permitted under Art. 9(2)(h) (health care provision and management by or under the responsibility of regulated health professionals bound by a statutory duty of confidentiality). |
| Billing & payment records | Subscription status, invoice history and payment confirmation. Card details are handled directly by Stripe and are never seen or stored by us. | Contract (Art. 6(1)(b)) and Legal obligation (Art. 6(1)(c)) for UK tax and accounting compliance. |
| Website analytics | Anonymised page visits and browser performance metrics via Google Analytics, only if you accept analytics cookies. | Consent (Art. 6(1)(a)). You can reject or withdraw cookie consent at any time. |
4. How patient privacy is protected in RPD Rx Consult
Because RPD Rx Consult provides technical design advice to the treating clinician, we do not need to know who your patient is. We apply four safeguards to every case submission:
- No direct identifiers: Clinicians are instructed not to enter patient names, dates of birth, addresses, telephone numbers or NHS/hospital numbers into the submission form, and to ensure labels are not visible in photographs.
- In-browser STL header clearing: Some intraoral scanners place a patient’s name or ID inside the first 80 bytes of a binary STL file. When you select a binary STL file on our form, our script overwrites that 80-byte header with zeros on your computer before the file is uploaded, and renames every file.
- Restricted access: Case records are held in a private, encrypted database and storage bucket. Access is restricted to the submitting clinician and the GDC-registered members of our review team assigned to your case.
- Strict 30-day deletion of raw scans and photos: We do not keep a permanent archive of your uploaded STL models or clinical photographs. All raw uploaded case files are permanently deleted 30 days after your consultation report is issued.
5. How long we keep information
- Uploaded STL scans and photographs (RPD Rx Consult): Permanently deleted 30 days after the review report is issued.
- Written consultation rationale, case reference and clinician details: Retained for 6 years from the date of the review to meet UK professional indemnity, regulatory audit and contractual limitation requirements, after which they are securely deleted.
- Software account details: Kept while your subscription or institutional account is active. You may request account deletion at any time.
- Financial and invoice records: Retained for 6 years plus the current financial year as required by HM Revenue & Customs (HMRC).
6. Who we share information with
We never sell your information or use clinical records for marketing. We only share data with trusted infrastructure providers ("sub-processors") who are contractually bound to keep it secure:
- Supabase: Provides encrypted database and private file storage infrastructure (configured in UK/EU data regions).
- Stripe: Processes subscription and consultation payments securely.
- Netlify: Hosts our web pages and secure server functions.
- Google Analytics: Provides optional, anonymised website usage statistics (only when you opt in via our cookie banner).
7. Your data protection rights
Under UK data protection law, you have the right to request access to the personal data we hold about you, to ask us to correct inaccurate information, to request erasure (subject to our legal and professional record-keeping obligations), to restrict or object to processing, and to request a copy of your data in a portable format.
To exercise any of these rights, please email support@dentalapptitude.com. We will respond within one month.
If you are unhappy with how we handle your data, please contact us first so we can put things right. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.