Privacy Policy

PatientMail is a service operated by Kari Labs Ltd, a company registered in England and Wales (company number 17441859), registered office 105–111 High Street, Houghton Regis, Dunstable LU5 5BJ.

We provide software that dental practices use to send appointment reminders, recall notices and similar messages to their patients by email, text message and WhatsApp.

If you are a patient, your dental practice decides what messages are sent to you and why. In data protection terms the practice is the controller of your information and we are a processor acting on their instructions. We do not decide to contact you, and we never use your details for our own marketing or sell them to anyone.

If you are a practice using PatientMail, we are the controller of your staff account details, and your processor for everything relating to your patients. Our data processing agreement forms part of your contract with us.

If you work at a practice and sign in to PatientMail, we hold your name, your email address, a password hash, the code of any authenticator app you enrol, your role and which practices you may see, and a record of what you do in the application: every sign-in, every patient record opened, every export and every setting changed, with the time, your IP address and browser. We keep that record for six years. It exists so that your practice's owners can see who looked at what (they can read it at Settings → Access log) and so that we can investigate a security incident; that is our legitimate interest and our security obligation. It is not used for anything else, and it is not shared with anyone except your practice.

When you connect a WhatsApp account from Settings, a script from Meta runs in your browser to open Meta's own sign-up window. Meta receives your IP address and browser details for that purpose, under Meta's Platform Terms; nothing else on the site loads any third-party script.

If you simply visit these pages, our hosting provider records the request (IP address, page, time) for around an hour, to serve the site and to detect abuse. There is no analytics, no advertising, and no tracking of any kind.

We hold a copy of part of your dental record, taken from your practice's management system so that we can work out which messages to send you and when. Most of it is information about your health, which data protection law treats as especially sensitive.

Received from your practice's management system:

• Name (including a preferred name), title, date of birth, gender, email address and mobile number
• Your postcode, town, county and region — we do not hold your street address
• Whether an NHS number and a home telephone number are recorded for you. We do not hold the NHS number or the home number themselves
• Medical alert and special-needs flags recorded by your practice
• Whether your practice has flagged your account as in arrears, and whether you are recorded as a student
• Which dentist and hygienist you are assigned to, which payment plan you are on, and whether your practice has blocked online booking for you
• Appointment details — dates, type, practitioner, and whether an appointment was attended, cancelled or missed
• Treatment records — the treatments your dentist has planned or carried out, what they cost, whether they were completed, and the clinical notes written against them
• Recall dates and intervals, how you prefer to be reminded, and which practice site you belong to
• Contact preferences and marketing consent as recorded by the practice

Generated by us:

• A record of every message sent to you, and whether it was delivered or failed
• Replies you send back over WhatsApp, and the conversation they belong to
• Whether you have asked to stop receiving messages, and what that covers
• A record of any consent you have given, when it was given, how it was captured, and when it was withdrawn
• Bookings you make through a link we send you, and — where a deposit was required — a record of that payment: the amount, the date, and whether it was refunded
• If your practice uses them: a place on a cancellation waiting list, with any note made when you were added, and any short-notice appointment offered to you
• If your practice asks for feedback: whether you were asked after a visit, and the rating you gave
• A record of every occasion someone at your practice — or, rarely, our support team — opened, searched, exported or messaged your record, and when. Your practice can read this themselves, and it is part of what they can give you if you ask what we hold

This list is the whole list. If you ask your practice for a copy of what we hold, the file they can produce contains every one of these things, and nothing about you is kept anywhere else in our system.

We do not hold x-rays or any other clinical images, and we never see or store your card details: card payments are handled entirely by Stripe and reach us only as confirmation that a payment was made.

We process this data to deliver the messages your practice asks us to send, to show them what was sent, and to honour opt-outs.

Because much of it is health information, your practice needs a specific legal condition to use it. For messages about your care — appointment reminders and confirmations, recall notices telling you a check-up is due, and following up treatment your dentist has already discussed with you — practices rely on the provision of health care (Article 9(2)(h) of the UK GDPR), together with legitimate interests. Those messages are administrative, and are not marketing.

For promotional messages about treatments you have not asked about, your practice needs your explicit consent — both to send you the message, and to look at your treatment history in order to decide that the treatment might be relevant to you.

Where you have given that consent, your practice may use your treatment history — including the clinical notes recorded against your treatments — to identify treatments that may suit you, and tell you about them. For example, if a tooth has been removed, they may contact you about replacement options. You can withdraw that consent at any time, and withdrawing it will never affect the care you receive. Without it, we do not use your treatment history to select you for promotional messages.

We use a small number of specialist providers, each bound by contract to process data only on our instructions — the full list, with roles and safeguards, lives at /sub-processors:

• Resend — delivers email
• Twilio, or The SMS Works where a practice's messages are routed through it — deliver text messages
• Meta Platforms — delivers WhatsApp messages. Meta holds the content of those messages for up to 30 days in order to deliver them. For some aspects of its platform (its own security, its terms with the practice, the script described above) Meta is responsible in its own right, under its own terms
• Supabase and Amazon Web Services — database hosting, in the EU
• Vercel — application hosting
• Stripe — takes deposit payments where your practice requires one. Stripe is responsible in its own right for card and fraud-prevention data, under its own privacy policy

Some of these providers are based in the United States. Where your information is transferred there, we rely either on the UK Extension to the EU–US Data Privacy Framework — a UK government decision that certain certified US businesses offer equivalent protection — or, where a provider is not certified under it, on an International Data Transfer Agreement together with a documented assessment of the risks. We tell each provider that the information includes health data, so that it is treated as sensitive.

Your dental record itself is held by your practice, in their management system, not by us. What we hold is a working copy plus a record of the messages and bookings we handled, and each is kept on the schedule your practice has instructed — set to match how long dental records and their communications are kept under NHS guidance.

• Your contact details and the working copy of your record — while you remain a patient of a practice that uses PatientMail, mirroring their own record
• Message history, delivery records and bookings — eleven years, or for children until their 25th birthday if that is longer, matching the NHS retention period for the dental record these communications form part of
• Deposit and payment records — seven years, as tax law requires financial records to be kept
• The raw updates we receive from your practice's management system — six months, for investigating synchronisation problems; everything in them also lives in the working copy above
• Our own records of whether the service worked — that a message was accepted, that a nightly update ran — six months. These say what the software did, not what was said to you, and they do not name you
• Booking links expire quickly for security, but the record of the booking is kept with your message history
• Records of your consent — while relied on and for six years afterwards. Requests to stop receiving messages are kept indefinitely: deleting them would mean we could start messaging you again by mistake

When your practice deletes your record from their management system, we erase our working copy of it, keeping the log of messages already sent (and your opt-out) for the periods above. When a practice stops using PatientMail, their patients' data is returned to them and/or deleted as they instruct, within 90 days, except anything we must keep by law.

You can ask to see the information held about you, to have it corrected or deleted, or to object to its use. Because your practice controls that information, the quickest route is to contact your dental practice directly — they can act immediately. If you contact us instead, we will pass your request to them and support it.

To stop receiving messages, use the unsubscribe link at the bottom of any email we send, tap the Stop button or reply STOP to a WhatsApp message, or simply ask your practice. This takes effect straight away and across every channel, and we record it in your practice's own system too. The WhatsApp Stop button lets you choose to stop only promotional messages and keep your appointment reminders, or to stop everything; the email link and a typed STOP stop everything. Your practice can change either choice for you at any time.

To withdraw consent for your treatment history to be used for promotional messages, tell your practice or use the same opt-out — stopping promotional messages withdraws that consent at the same time, and we stop looking at your treatment history for that purpose straight away. It is as easy to withdraw as it was to give, and it does not affect your care.

If you are unhappy with how your information has been handled, please tell your dental practice first — it is the controller of your information and must have its own complaints procedure. For anything Kari Labs controls itself (staff accounts, the access log, this website) write to privacy@patientmail.co.uk. We will acknowledge your complaint within 30 days and respond without undue delay, and we will give your practice the facts it needs within its own 30-day acknowledgement period.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk, at any time.

Pages that patients receive links to — booking, unsubscribe, feedback and the cancellation form — set no cookies at all; everything they need travels in the link. The application that practice staff sign in to sets these first-party cookies, each strictly necessary for the function you asked for and used for nothing else:

• Sign-in session — keeps you signed in. It lasts up to 30 days on the device you signed in on, so you do not have to sign in every time; signing out removes it.
• Agreement tick — remembers, for the few minutes it takes, that an owner ticked the data processing agreement before connecting a practice management system.
• Two connection tokens — single-use codes that protect the “connect Dentally” and “connect Stripe” steps against forged requests; each lives for ten minutes at most.
• Support view — set only while a PatientMail administrator, at a practice's request, views the application as one of its users; it lasts 30 minutes and every action taken under it is recorded as the administrator's.

We use no advertising, analytics or tracking cookies, and patients receiving messages are not tracked. The one third-party script on the site is Meta's, on the WhatsApp connection page, described above.

Data is encrypted in transit and at rest. Credentials connecting to a practice management system are encrypted separately. Access is limited to staff who need it, and each practice's data is isolated from every other's.

Write to privacy@patientmail.co.uk, or to Kari Labs Ltd, 105–111 High Street, Houghton Regis, LU5 5BJ.

See also our data deletion instructions.