Privacy Policy

1. Who we are — the data controller

Heritage & Castle Dental Care is the data controller responsible for your personal data.

• Trading name: Heritage & Castle Dental Care
• Address: 3 Spalding Street, Leicester, LE5 4PH
• Telephone: 0116 360 2111
• Email: Info@hc-dc.co.uk

2. Our AI voice assistant and website chatbot

To make booking easier, Heritage & Castle Dental Care uses AI-powered tools, built and operated for us by our technology provider, Oyik.AI:

• AI Voice Assistant — answers incoming calls, takes your details, books, reschedules and cancels appointments, and can take payment over the phone.
• Website Chatbot — available on our website to book, reschedule and cancel appointments, take payment, and answer questions using information you provide in the chat.

Calls to the practice may be answered, in full or in part, by the AI voice assistant rather than a member of staff. At the start of a call, you will be told that you may be speaking with an automated assistant and that the call may be recorded. Website chat sessions are clearly labelled as a chatbot.

3. What personal data we collect

3.1 When you call our AI voice assistant

• Full name, contact telephone number, and email address
• Date of birth (used to identify or set up your patient record)
• Appointment preferences: treatment type, preferred dentist, date and time
• A recording and/or AI-generated transcript of the call
• Payment details, where you choose to pay over the phone
• Any other information you choose to share with the assistant to help book, reschedule or cancel your appointment

3.2 When you use our website chatbot

• Full name, contact telephone number, and email address
• Date of birth, where requested for identification purposes
• Appointment preferences and messages you type into the chat window
• A transcript of your chat session
• Payment details, where you choose to pay through the chat

3.3 Special category data (health information)

Some information you share to book or describe an appointment — for example, mentioning a dental problem, medical condition, or medication — is “special category data” under UK GDPR because it relates to your health.

We only collect the minimum needed to schedule the right type of appointment. Full clinical records are created and held separately by our clinical team, not by the voice assistant or chatbot.

4. How and why we use your data, and our legal basis

Purpose	Legal basis (UK GDPR)
Booking, rescheduling and cancelling appointments	Performance of a contract (Art. 6(1)(b))
Taking payment for treatment or deposits	Performance of a contract (Art. 6(1)(b))
Identifying you as an existing or new patient	Performance of a contract / legitimate interests (Art. 6(1)(b)/(f))
Recording/transcribing calls and chats for accuracy, staff training and dispute resolution	Legitimate interests (Art. 6(1)(f)), balanced against your rights — you are notified before recording begins
Noting health information you volunteer, to route you to the right appointment type	Explicit consent (Art. 9(2)(a)) or provision of health/social care (Art. 9(2)(h))
Meeting our legal, regulatory and record-keeping obligations (e.g. GDC, NHS, tax and accounting rules)	Legal obligation (Art. 6(1)(c))
Preventing fraud and keeping our systems secure	Legitimate interests (Art. 6(1)(f))

We do not use your data for marketing without your separate consent, and we never sell your personal data.

5. How the AI voice assistant and chatbot process your data

When you speak to the voice assistant, your speech is converted to text, processed by an AI language model to understand your request, and (where you choose to speak rather than type) converted back to speech.

Chatbot messages are processed by the same underlying AI system. This processing is carried out on our behalf by Oyik.AI, acting as our data processor under a written data processing agreement.

The AI systems are configured to collect only the information needed to complete a booking, rescheduling, cancellation or payment, and to hand you over to a member of staff if you ask to speak to a person, or if your request falls outside what the assistant can safely handle.

6. Payment information

If you choose to pay for treatment, a deposit, or a cancellation fee by phone or through the chatbot, your card details are collected and processed by a PCI DSS-compliant payment processor.

Card payments taken over the phone or through the chatbot are processed by Stripe, a PCI DSS-compliant payment processor.

• We (and our AI voice assistant/chatbot provider) do not store your full card number, CVV or expiry date on our own systems.
• Payment data is transmitted securely (encrypted in transit) directly to Stripe.
• We keep only the minimum transaction record needed for accounting and refund purposes, such as amount, date, and a masked reference to the payment.

7. Who we share your data with

We share personal data only where necessary, with organisations who are contractually required to protect it:

• Oyik.AI — our AI automation provider, which builds and operates the voice assistant and chatbot on our behalf as a data processor.
• Aerona — our clinical/practice management and booking software, used to hold your patient and appointment record.
• Stripe — our payment processor, to securely handle card payments.
• Our telephone and hosting providers — who carry call and website traffic and host our systems, acting as data processors.
• Regulators and authorities — such as the General Dental Council, NHS bodies, or law enforcement, where we are legally required to.
• Professional advisers — such as our accountants, indemnity insurers or legal advisers, where necessary.

We do not share your data with third parties for their own marketing purposes.

8. International data transfers

Wherever possible, your data is stored and processed within the UK or European Economic Area (EEA).

Where a supplier we use, such as a cloud hosting, AI, or payment provider, transfers data outside the UK/EEA, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or transfer to a country covered by UK adequacy regulations.

9. How long we keep your data

• Adult patient and appointment records: retained for as long as you remain a patient, and typically for a further period after your last treatment in line with dental record-keeping guidance from the General Dental Council and our indemnity provider.
• Records for children/young patients: retained until they reach a specified age, in line with General Dental Council and NHS retention guidance for paediatric dental records.
• Call recordings and chat transcripts: kept for a limited period for quality, training and dispute resolution purposes, then securely deleted or anonymised.
• Payment/transaction records: kept as required for accounting and tax purposes.

10. How we protect your data

• Data in transit is encrypted (e.g. TLS) between the voice assistant, chatbot, our systems and our suppliers.
• Access to patient records and call/chat data is restricted to authorised staff and suppliers who need it to do their job.
• We use role-based access controls and require our processors to maintain equivalent technical and organisational security measures.
• Card payment data is handled by a PCI DSS-compliant processor and is not stored on our own systems.

11. Your rights

Under UK GDPR, you have the right to:

• Be informed about how your data is used (this policy)
• Access a copy of the personal data we hold about you
• Ask us to correct inaccurate or incomplete data
• Ask us to erase your data, where there is no legal or contractual reason for us to keep it
• Ask us to restrict how we use your data
• Receive your data in a portable format, where technically feasible
• Object to processing based on legitimate interests, including profiling
• Withdraw consent at any time, where we rely on consent
• Not be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you

To exercise any of these rights, contact us using the details in Section 1. We will respond within one month, as required by law.

If you are unhappy with how we have handled your data, you also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint , or by calling 0303 123 1113.

12. Children's data

Where a parent or guardian books, reschedules or cancels an appointment on behalf of a child using our voice assistant or chatbot, we collect the child's basic details (name, date of birth, appointment information) only for the purpose of providing dental care to the child, and we rely on the parent or guardian to provide accurate consent on the child's behalf.

13. Cookies and the website chatbot

Our website chatbot may use a small amount of browser storage (such as a cookie or local storage) to remember your conversation while you are on our site.

This is separate from any wider website analytics or marketing cookies, which are covered by our separate Cookie Policy.

14. Changes to this policy

We may update this policy from time to time, for example if we change how the AI voice assistant or chatbot works, or to reflect changes in the law.

The “Last updated” date at the top of this page shows when it was last revised. We encourage you to review this page periodically.

15. Contact us