Data protection and your rights
What UK GDPR gives you, how to use it here, and what we can and cannot do when you ask. Written against how the platform actually works, not boilerplate.
Who to ask
It depends which data you mean. Under UK GDPR the controller answers your request; for clinical records that is your practice, not us.
They are the controller of your clinical record. We process it for them. If they cannot help, write to info@alyner.com and we will assist them.
We control your staff account data: name, work email, role and sign-in history.
We control anything you sent us through a form, and any cookie preferences you set.
Your rights, and what happens here
Each right, and what exercising it actually does on this platform.
Access
A copy of your dataEverything we hold, in a readable format, within one month and free of charge. Because every read of a record is logged, we can also tell you who looked at it and when.
Rectification
Correcting something wrongContact details are corrected immediately. Clinical records are different: an entry believed correct at the time is not deleted, because the history of a clinical record is part of the record. A timestamped correction is added alongside it.
Erasure: “delete my data”
Has a legal limit- Contact details
- Marketing consent
- App sessions and devices
- Account data
- Clinical records, for 11 years from completion of treatment, or until a minor’s 25th birthday, whichever is later
That retention is a legal obligation on the practice and it overrides an erasure request. We record the request, act on everything we can, and tell you exactly what was kept and why.
Restriction
Stop using it, but keep itWe can flag a record so it is retained but not otherwise processed, for example while a dispute about its accuracy is resolved.
Portability
Take it elsewhereA machine-readable export of everything you gave us: demographics, scans, photographs, treatment plans and monitoring history. Practices can export their whole patient list at any time.
Objection
Stop processingMarketing stops immediately, no questions. Processing needed to deliver treatment you have consented to cannot stop without ending the treatment, and we will tell you if that is the consequence.
Automated decisions
None on this platformYou have the right not to be subject to a decision based solely on automated processing. Here there are none: AI produces measurements and a suggested verdict; a registered clinician makes every decision. That is enforced in the database, not merely promised.
How to make a request
Email info@alyner.com, or use the contact form and choose “Data protection”.
A sentence is enough. You do not need to quote an article number.
We are not going to hand someone’s dental records to whoever asks.
If a request is unusually complex we can extend by two months, and we tell you why within the first month.
For practices: your obligations as controller
You decide what is collected and why, and obtaining consent is your responsibility. This is what we give you to carry it.
- Data processing agreementMeets Article 28. Available on request.
- Audit log per patientAnswer a subject access request in minutes, including who viewed the record.
- Erasure endpointScrubs what can be scrubbed and records what was kept and why.
- Automated retentionApplies the statutory periods without anyone having to remember.
- Breach notificationWithout undue delay, so you can meet your own 72-hour duty to the ICO.
Sub-processors and transfers
Sub-processors
The full list, what each one sees and where it sits, is in the privacy notice. We give 30 days’ notice before adding one that would handle patient data, and you may object.
Transfers outside the UK
Patient data is stored in the EU. Where a supplier listed in the privacy notice operates elsewhere, the transfer relies on the UK International Data Transfer Addendum and a documented transfer risk assessment.
Complaints
Raise it with us first. You can also go to the regulator at any time, without asking us.
Our data protection contact. We acknowledge every complaint and tell you what we did about it.
0303 123 1113. The UK’s independent authority for data protection.
These pages are a specific draft written against how the platform works. They are not legal advice. Have a solicitor with UK data protection and medical device experience review them before real patients are onboarded, and confirm the company details and ICO registration number.
Exercise a right
One email starts every request: access, correction, erasure, restriction, portability or objection. Patients should go to their practice first; if that stalls, we will help them.
Plain language is fine.
Then act on everything we can.
Including a plain statement of anything we kept, and why.
Or use the contact form and choose "Data protection".
Make a requestThis page is reviewed with every material change to how we process personal data. Questions: contact us.