Legal

Privacy Policy & Data Processing Agreement

Last updated: 1 July 2026

1. Who we are

DentalDrop Shop (“we”, “us”, “our”) is operated by DentalDrop Shop Ltd, trading at dentaldropshop.com. We are a data processor acting on behalf of dental practices (the data controllers) to deliver personalised product recommendations to patients via our Smile Script service.

For questions about this policy or your data rights, contact us at: hello@dentaldropshop.com

2. Data we collect

We collect and process the following categories of personal data:

Patients

Name and email address (provided by your clinician to send your Smile Script)
Phone number (optional, provided by your clinician)
Delivery address (provided by you at checkout)
Order history and purchase records
Authentication data (your login session)

Clinicians & Practices

Name, email address, and practice details provided at registration
Login credentials (password stored securely, never in plain text)
Smile Script activity and commission records
Billing and subscription information (managed by Stripe)

All visitors

Cookies and usage data (see Section 8)

3. How we use your data

We use personal data only for the following purposes:

Generating and delivering personalised Smile Script product recommendations to patients
Processing and fulfilling orders placed through the shop
Managing clinician and practice accounts
Calculating and recording commission earnings
Sending transactional emails (order confirmations, Smile Script delivery, login links)
Improving and maintaining the platform

We do not use patient data for unrelated marketing, sell data to third parties, or process any special category health data (clinical records, treatment history).

4. Lawful basis (UK GDPR)

We process personal data under the following lawful bases:

Contract — to fulfil orders placed with us and to provide the Smile Script service to clinicians under their subscription.
Legitimate interests — to operate and improve the platform, prevent fraud, and send transactional communications.
Consent — for non-essential cookies (analytics). You may withdraw consent at any time.

Dental practices (as data controllers) are responsible for ensuring a lawful basis exists for sharing patient data with us, and for informing patients of this processing via their own privacy notices.

5. Data sharing & sub-processors

We share data only with trusted third parties necessary to operate the service:

Supabase — secure database and authentication hosting (EU/UK infrastructure)
Stripe — payment processing and subscription billing
Resend — transactional email delivery
Vercel — application hosting
Third-party logistics (3PL) — order fulfilment and dispatch

All sub-processors are bound by data processing agreements and operate under equivalent data protection standards.

6. Data retention

We retain personal data only for as long as necessary:

Patient account and order data: retained for 7 years for legal and financial compliance, then securely deleted.
Smile Script records: retained while the associated practice account is active, plus 12 months after termination.
Clinician account data: retained while the account is active, then deleted within 30 days of account closure.

On termination of a practice's account, we will, at the practice's instruction, securely delete or return all patient personal data associated with that practice, unless retention is required by law.

7. Your rights under UK GDPR

You have the following rights regarding your personal data:

Right of access — request a copy of the data we hold about you.
Right to rectification — ask us to correct inaccurate data.
Right to erasure — ask us to delete your data (subject to legal retention obligations).
Right to restriction — ask us to pause processing of your data.
Right to data portability — receive your data in a structured, machine-readable format.
Right to object — object to processing based on legitimate interests.
Right to withdraw consent — withdraw consent for cookies at any time.

To exercise any right, contact us at hello@dentaldropshop.com. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

8. Cookies

We use the following cookies:

Essential cookies

Required for the site to function. These include authentication session cookies and basket state. These cannot be disabled.

Analytics cookies (optional)

Help us understand how visitors use the site so we can improve it. These are only set with your consent.

You can manage your cookie preferences at any time using the cookie banner at the bottom of the page, or by clearing your browser's local storage.

9. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure, including:

Encrypted data storage and transmission (TLS/HTTPS)
Row-level security on all database tables
Passwords stored using industry-standard hashing
Access controls limiting staff access to data on a need-to-know basis

In the event of a personal data breach affecting patient data, we will notify the affected practice without undue delay and within 72 hours of becoming aware, in accordance with our obligations under UK GDPR.

Data Processing Agreement (Clinicians & Practices)

This section constitutes the Data Processing Agreement between DentalDrop Shop (Processor) and the registered dental practice (Controller) under UK GDPR and the Data Protection Act 2018.

1. Parties

This Data Processing Agreement (“Agreement”) is made between:

The Practice — the “Controller”: the dental practice that determines the purpose for which patient personal data is shared.
Dental Drop Shop — the “Processor”: the party that processes patient personal data on the Controller's behalf, solely to deliver the Smile Script personalised product recommendation and fulfilment service.

Under UK GDPR and the Data Protection Act 2018, the Practice remains the Controller of its patients' personal data at all times. Dental Drop Shop acts only as a Processor, on the Practice's instructions.

2. Purpose and scope

Dental Drop Shop will process personal data solely for the purpose of:

Generating and delivering a personalised Smile Script product recommendation to the relevant patient; and
Fulfilling and dispatching that recommendation to the patient by post or courier.

Dental Drop Shop will not use patient data for any other purpose — including marketing unrelated products, sale or disclosure to third parties, or any use outside the direct delivery of the Smile Script service — without the Practice's prior written consent.

3. Data shared and minimisation

The Practice will share only the minimum personal data necessary, expected to be limited to:

Patient name
Patient email address
Where relevant to fulfilment, a delivery address

No clinical records, treatment history, or special category health data will be shared.

4. Lawful basis

The Practice, as Controller, is responsible for ensuring a lawful basis exists for sharing patient data with Dental Drop Shop, and for informing patients of this processing via its privacy notice. Dental Drop Shop will rely on the Practice's confirmation that an appropriate lawful basis is in place.

5. Processor obligations

Dental Drop Shop agrees to:

Process personal data only on the documented instructions of the Practice, as set out in this Agreement;
Keep patient data confidential and ensure any staff or contractors with access are bound by equivalent confidentiality obligations;
Implement appropriate technical and organisational security measures to protect the data against unauthorised access, loss, or disclosure;
Not engage any sub-processor to handle this data without the Practice's prior written consent;
Assist the Practice, where reasonably required, in responding to patient requests to exercise their data protection rights;
Notify the Practice without undue delay, and in any event within 72 hours of becoming aware, of any personal data breach affecting patient data shared under this Agreement.

6. Data subject rights

Where a patient contacts Dental Drop Shop directly to exercise a data protection right (for example, a request for erasure or access), Dental Drop Shop will promptly inform the Practice and action the request within the statutory timeframe, in cooperation with the Practice.

7. Retention and return of data

Dental Drop Shop will retain patient data only for as long as necessary to deliver the Smile Script service and any associated support. On termination of the arrangement between the parties, Dental Drop Shop will, at the Practice's instruction, either securely delete or return all patient personal data, save where retention is required by law.

8. Duration

This Agreement takes effect from the date a practice registers with Dental Drop Shop and will remain in force for the duration of the arrangement between the parties, unless terminated earlier by either party in writing.

For any questions about this policy, contact hello@dentaldropshop.com.