Privacy
Three different things happen under one name, and this page keeps them apart: what this website collects about you, what we keep when a practice writes to us, and what the product reads on behalf of a dental practice.
Last updated 16 October 2026
The short version. This website stores nothing about you unless you say yes to analytics. If you email us, we keep your message to answer it and for no other purpose. The product reads a practice's Dentally data, never writes to it, and stores it in the United Kingdom, separate from every other practice. We do not sell anything to anyone, and there is no advertising on either.
Who we are
Dentavector is the trading name of Dental Performance Analytics Limited. For this website and for the messages people send us, we are the controller: we decide what is collected and why.
| Item | Detail |
|---|---|
| Company | Dental Performance Analytics Limited, registered in England and Wales, company number 17467092 |
| Registered office | 24a Watling Street, Llanrwst, Conwy LL26 0LS, United Kingdom |
| ICO registration | ZC257563 (Information Commissioner's Office, see the entry) |
| Contact | support@dentavector.co.uk — a person answers, usually within two working days. There is no form and no ticket number. |
We are a small company and have not appointed a Data Protection Officer, which the law does not require of us. The founders handle privacy matters directly through the address above.
This website
What it does without asking
Nothing that identifies you. The page is a single file with the text, the styles and the scripts inside it; the videos are files served from the same place. No fonts, scripts or images are fetched from anyone else, so no third party learns that you opened this page.
The server that hosts it keeps ordinary access logs — the time, the page, the browser string and the network address — because a server that logs nothing cannot be defended when something goes wrong. The lawful basis is our legitimate interest in keeping the site secure. These logs are deleted after 14 days and are not used to build any profile of you.
Analytics, only if you say yes
We would like to use Google Analytics to see which parts of this page people read, so we know what to write more of. It is off until you choose:
- Nothing is contacted and no cookie is stored before you answer. We deliberately do not use Google's consent mode, because that contacts Google anyway.
- Say yes and Google Analytics sets a cookie on your device and sends usage data to Google, which processes it for us in the United States under the UK extension to the EU–US Data Privacy Framework. IP addresses are not stored by Google Analytics, and the usage data is deleted after 14 months.
- Say no and nothing loads. Saying no costs you nothing on this site — every word of it stays readable.
- Your choice is kept in your browser for a year and can be changed at any time from the footer of the main page.
The lawful basis is your consent, and you can withdraw it as easily as you gave it.
If you write to us
Most people who write to us work at a dental practice — asking about a trial, about how the product works, or for help once connected. When you email us we keep:
- your name, email address, and any phone number you give us;
- the practice you work at and your role there, if you tell us;
- what you wrote and what we replied.
We use it to answer you, to arrange and run a trial if you ask for one, and to keep a record of what was agreed. We do not add you to a mailing list, and we do not send marketing you did not ask for. The lawful basis is our legitimate interest in replying to the people who contact us, and, once a practice starts a trial, the steps needed to enter into and perform that agreement.
Please do not send us patient information by email. If a question is about a specific patient record, describe it without names or dates of birth and we will look at it inside the product, where the practice controls access.
How long we keep it:
- If the conversation does not lead to a trial, we delete it 24 months after your last message.
- If your practice takes up a trial or becomes a customer, we keep the correspondence for as long as the practice uses Dentavector and then for 6 years, the period for which UK law expects companies to keep records of their agreements.
- You can ask us to delete it sooner, and we will, unless we need a specific part of it to meet a legal obligation — in which case we will tell you which part and why.
If we wrote to you first
We may email a practice that uses Dentally in Wales to tell it about Dentavector. We do that only to business contact details the practice publishes itself, such as the address on its own website, and every such email lets you tell us to stop. If you do, we keep only your address on a do-not-contact list, so that we never write again.
The product
This part applies to a dental practice that has connected Dentavector to its Dentally account, and to the staff who use it. If you are reading this as a visitor, none of it is about you.
Who the data belongs to
The practice. Under UK GDPR the practice is the controller of its patients' and staff's data in the product, and we are a processor acting only on its instructions. Every practice that uses the product has agreed our data processing terms, which set out those instructions in writing, and a new practice agrees them before it connects.
What it reads, and what it never does
| What | Detail |
|---|---|
| Reads | Appointments, treatment plans and items, claims, the practice's treatment catalogue, practitioners and rotas, and invoices and payment plans (to show what each dentist was actually paid). About patients: an identifier, the date of birth, gender, a family link, recall dates, contact preferences, and the assigned dentist. The date of birth is needed because NHS Wales care packages depend on the patient's age band at the start of the course. At present we also read free-text notes recorded against appointments and treatment plan items. These can contain names or other details typed by the practice's team. We are removing them: once that change is live, we will stop reading them, delete those already held, and update this policy. We also read the comments recorded on NHS claims, which are free text as well; we are removing these too. We currently read the patient's postcode, town and county; we are removing these as well, and will update this policy when that is done. |
| Never writes | The integration is read-only. Nothing we do can change, delete or add anything in a practice's Dentally account. |
| Never shows | We do not read patients' name fields from Dentally, and the dashboard does not display patient names. The screens show an identifier, not a person. |
| Never mixes | Each practice's data is held separately. One practice's data is never mixed with, compared against or visible from another. |
People who use the product
For each member of a practice's staff who signs in, we hold a name, an email address, the role the practice gave them, a password stored only as a one-way hash, and a record of sign-ins, of which parts of the product they open, and of which patient records they open, which the practice's administrators can see. We use the sign-in and usage records only to support the practice — for example, to see when an account last signed in when someone asks for help — and for no purpose of our own. The practice decides who has an account and can remove it at any time.
Where it lives
The practice's data is stored on Amazon Web Services servers in London (eu-west-2). Backups are kept in the same region and are encrypted at rest. Our directors may access the service remotely from the United Kingdom and from Portugal, which is in the European Economic Area; the data itself is stored in the United Kingdom. Connections to the product and to Dentally are encrypted in transit. The practice's Dentally API key is encrypted separately and is never shown back on screen after it is saved.
How long it is kept
For as long as the practice uses Dentavector. When the practice asks, or when its account ends, we delete its data within 30 days; copies inside our backups expire within a further 35 days. If the practice wants an export first, we provide it before deleting.
Who else sees it
Nobody outside our two directors and the providers listed below. We do not sell data, we do not share it with advertisers, and we do not use one practice's data to train anything or to inform another practice's numbers.
Who helps us run this
These are the only organisations that handle personal data on our behalf. If this list changes for the product, we tell the practices that use it at least 30 days before the change.
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services | Hosting the website, the application, the database and its backups | London, United Kingdom |
| Google (Google Workspace) | Our email, including support@dentavector.co.uk | Google's data centres, which may include the United States, under the UK extension to the EU–US Data Privacy Framework |
| Website analytics — only if you say yes | United States |
Dentally is not on this list: it is the practice's own software provider, and the practice chooses to let us read from it.
The videos on this site
The videos were recorded against a real practice with the product's demo mode on: the server replaces every practitioner name, patient reference, practice name, email address and NHS contract number before the response leaves it, and the browser blurs patient identifiers on top of that. The practice's totals — its contract value, the money delivered and the clinical hours — are blurred as well, because a practice's contract is its own business. The numbers are real; the people are not identifiable. This matters because one person can consent to appearing in a marketing video and cannot consent on behalf of colleagues or patients.
Your rights
Where we are the controller — this website and the messages you send us — you can ask us to give you a copy of what we hold about you, correct it, delete it, restrict what we do with it, or stop using it; and where the basis is consent, withdraw it at any time. Write to support@dentavector.co.uk. We answer within one month and do not charge for it.
If you are a patient of a practice that uses us, or a member of its staff, your rights over the data in the product are exercised through that practice, which is the controller. If you write to us instead, we pass your request to the practice straight away and support whatever it asks of us.
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office.
Changes
If this page changes in a way that matters, the date at the top changes with it. We do not quietly widen what we collect.