Privacy Policy & Data Governance

Mandatory Data Lock Notice: All digital enquiry, consultation, and patient-referral form inputs on this platform are currently fully disabled and locked down. Online transmission pathways will remain entirely inactive until our secure, end-to-end cloud relays to local practice systems (Dentally and Software of Excellence EXACT) are fully tested, penetration-checked, and signed off under formal Data Processing Agreements.

1. Data Controller Name & Contacts

The legal Data Controller responsible for your information under the UK GDPR is Dr Firas Daoudi (Operating as Firas Daoudi Ltd), located at 2 Upper Wimpole Street, London, W1G 6LD. For governance queries, contact our team via email at compliance@firasdaoudi.com or via phone at +44 (0)7935 600 9962. ICO Registration Number: ZC036261.

2. Hosting & Infrastructure Providers

Our data-split edge environment is deployed on Vercel Platform Infrastructure, protected by Cloudflare Edge Security Network firewalls. All technical system queries execute within our United Kingdom (Local Regional Node Edge Placement) framework using Industry-Standard Transit Encryption & Encrypted Rest Storage protocols.

3. Intended Data Processors & Destinations

Upon formal system activation, form submissions will map directly to our secure clinical practice management software databases:

Dentally (Chameleon Internet Ltd): Clinical practice management, patient record storage, and Central London scheduling integration.
Software of Excellence / EXACT (Henry Schein Inc.): Clinical practice management, referral tracking, and Teddington/Chigwell branch database storage.

4. Segregated Retention Periods

Data Category	Retention / Deletion Window
Website Enquiry Form Data	24-Hour Mirror Delete (Permanently wiped from website server logs once passed to primary CRM)
Professional Clinician Referrals	24-Hour Mirror Delete (Permanently wiped from website server logs once passed to primary CRM)
Uploaded Files (Scans / Photos)	Wiped instantly upon successful backend API validation and system transfer
Clinical Records (Inside CRM)	Statutory Minimum of 11 Years following the last patient entry, or until a minor patient reaches the age of 25

5. Lawful Bases for Processing

Processing Patient Enquiries: Consent & Contract: Essential to establish, arrange, and deliver private clinical consultations.
Processing Health Data (Photos/Scans): Special Category Data - Article 9(2)(h): For the provision of medical diagnosis, dental treatments, and specialist healthcare management.
Processing Peer Referrals: Legitimate Interests: Necessary to maintain professional dental continuity between general practitioners and our specialist team.

6. Patient Rights & ICO Information

Under the UK Data Protection Act, you maintain clear statutory rights regarding your records:

Right of Access: You have the right to request a complete copy of the private clinical records we hold on file.
Right to Rectification: You can request immediate modifications to correct any inaccurate biometric or biographical details.
Right to Erasure: You may request the deletion of non-clinical data where statutory healthcare archiving windows do not apply.
Right to Restriction: You can ask us to pause processing your data while a dispute or identity check is being evaluated.
ICO Complaint Right: You retain the legal right to file an inquiry or complaint directly with the UK Information Commissioner’s Office (ico.org.uk).

7. Cookies & Analytics Status

Privacy-Conscious Zero-Tracking Stand: This platform operates without third-party tracking scripts or advertising cookies. Analytical sweeps are strictly performance-conscious, anonymized, and self-hosted to maintain total speed and user anonymity.