Privacy Policy

Last updated: 5 May 2026

This Privacy Policy explains how B4MIND Brand Consulting and Digital Marketing Ltd ("CareDental", "we", "us", "our"), which operates the CareDental platform, collects, uses, and protects personal data in connection with the CareDental platform and website at caredental.ai (the "Service").

We are a company registered in England and Wales (company number 11296210), with our registered office at 66 Paul Street, London, England, EC2A 4NA. We are registered with the UK Information Commissioner's Office (ICO) under registration number ZB863194.

If you have any questions about this policy or your personal data, contact us at info@caredental.ai.

1. Our two roles: controller and processor

CareDental processes personal data in two distinct capacities:

• As a data controller — for personal data of the clinic staff and administrators who hold CareDental user accounts (e.g. name, email, role), and for visitors to our website. We decide how and why this data is processed.
• As a data processor — for personal data of patients and prospective patients ("leads") that a dental clinic ("Customer") uploads to, or generates within, the platform (e.g. names, phone numbers, treatment interests, WhatsApp conversation content). Here, the clinic is the data controller and CareDental processes this data only on the clinic's documented instructions, under a Data Processing Agreement (see our GDPR page).

This Privacy Policy primarily describes our processing as a controller. For data we process on behalf of clinics, the relevant clinic's own privacy notice and our Data Processing Agreement govern that processing.

2. Personal data we collect

Clinic users (controller):

• Identity and contact data: name, work email, telephone, job role
• Account data: login credentials (passwords are stored hashed), authentication tokens
• Usage data: log-in times, actions taken in the platform, IP address, device/browser information

Website visitors (controller):

• Information you provide via contact or demo-request forms (name, email, clinic name, message)
• Technical data: IP address, browser type, and similar collected via essential cookies (see our Cookie Policy)

Patient/lead data (processor, on behalf of clinics):

• Names, telephone numbers, preferred language, treatment interest, lead status
• WhatsApp message content exchanged between the lead and the clinic's AI coordinator
• Consent records relating to AI follow-up and messaging

Special category data: Information relating to a person's dental treatment may, in some contexts, constitute health-related data (a "special category" under UK GDPR). Where clinics input such data, they act as controller and are responsible for ensuring an appropriate lawful basis and condition for processing. CareDental processes it solely as processor on the clinic's instructions.

3. How and why we use personal data (controller)

You can object to processing based on legitimate interests, and withdraw consent at any time where consent is the basis.

4. Artificial intelligence processing

The Service uses AI (provided by Anthropic) to generate and assist with messaging to leads. AI processing is performed to deliver the core functionality clinics subscribe to. Message content may be transmitted to our AI sub-processor solely to generate responses. We do not use clinic or patient data to train third-party AI models, and our AI sub-processor processes data under contractual confidentiality and data-protection terms.

5. Sub-processors and third parties

We use carefully selected third parties to operate the Service. Current sub-processors include:

• Supabase — database hosting (EU/Ireland)
• Render — application/backend hosting
• Vercel — frontend hosting
• Anthropic — AI message generation
• Meta Platforms (WhatsApp Business Platform) — messaging delivery
• Resend — transactional email
• Google (Calendar API) — calendar integration, where enabled by a clinic

A current list of sub-processors is maintained and available on request. We require all sub-processors to provide appropriate safeguards for personal data.

6. International transfers

Where personal data is transferred outside the UK/EEA, we rely on appropriate safeguards such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision. Details are available on request.

7. Data retention

We retain personal data only as long as necessary for the purposes described, or as required by law. Clinic account data is retained for the duration of the subscription and a limited period afterwards. Patient/lead data is retained according to the instructions of the relevant clinic (controller) and is deleted or returned on termination, subject to legal retention requirements.

8. Your rights

Under UK GDPR, you have the right to: access your data; request rectification or erasure; restrict or object to processing; data portability; and to withdraw consent. You also have the right to lodge a complaint with the ICO (ico.org.uk).

To exercise any right, contact info@caredental.ai. If your request concerns data we process on behalf of a clinic (as processor), we will refer you to, or act on the instructions of, that clinic.

9. Security

We implement appropriate technical and organisational measures, including encryption of sensitive tokens, encrypted transport (TLS), access controls, tenant isolation, and the principle of least privilege. No system is completely secure, and we cannot guarantee absolute security.

10. Changes to this policy

We may update this policy from time to time. Material changes will be notified through the Service or by email. The "Last updated" date reflects the latest version.

11. Contact

B4MIND Brand Consulting and Digital Marketing Ltd (operating as CareDental)

66 Paul Street, London, England, EC2A 4NA

General enquiries and data protection enquiries: info@caredental.ai