Privacy notice

This notice explains what personal information Toothfully collects, why, and your rights. Toothfully is the data controller. Contact us at hello@toothfully.co.uk.

Patients who leave reviews

• What we collect: your name, email address, the date of your visit, your review, and any proof of appointment you upload.
• Why: to check your visit, publish your review and contact you about it. Our lawful basis is legitimate interests in running a trustworthy review service.
• What’s public: your review and the display name you choose. Your email address is never shown.
• How long: proof of appointment is deleted once your review is decided. Your review stays published until you ask us to remove it.

Patients invited by a practice

If a practice invites you, it shares your name, email address and appointment date with us so we can send one invitation. The practice is the controller of that information and we process it on its behalf. Uncompleted invitations are deleted after 90 days.

Practice staff

If a practice adds you to its team page, we email you to ask for your agreement. Nothing about you is published until you confirm, and you can ask us to remove it at any time. We check GDC registration numbers against the public GDC register.

Practice account holders

We keep your name, email address and login details to run your account, and billing details through our payment provider, Stripe. We don’t store card numbers.

Cookies

We use an essential cookie to keep you signed in and protect forms. When you write a review, we also set a random ID in a cookie so we can spot fake reviews written from one device. These are needed for the site to work safely, so we don’t ask first.

See the companies that handle personal data for us on our sub-processors page.

With your agreement, we use Google Analytics cookies (_ga) to understand how people use the site, such as which pages are visited. Google processes this information for us. You can change your choice at any time with “Cookie settings” at the bottom of every page. If you don’t agree, Google Analytics sets no cookies; it only receives basic, cookieless information that a page was viewed (such as the page address and browser type), which can’t be used to recognise you.

When we email practices, we record whether the email was opened (using a tiny image) and whether its links were clicked, so we know which messages are useful. In emails to patients we only record link clicks, not opens.

We count how often practice pages are viewed and how often people call, email or visit a practice’s website from them, to show practices how their page is doing. These counts don’t use cookies and aren’t linked to you. We don’t use advertising cookies.

Your rights

You can ask for a copy of your information, ask us to correct or delete it, or object to how we use it, by emailing hello@toothfully.co.uk. You can also complain to the Information Commissioner’s Office at ico.org.uk.