Privacy notice
What we collect, why, who sees it, how long we keep it, and what you can ask us to do about it. Written against how the platform actually works.
Who we are
INFONITO LTD, trading as Alyner, provides the cloud platform dental practices use to deliver clear aligner treatment.
- Company
- INFONITO LTD t/a Alyner, registered in England and Wales
- Regulator
- Registered with the Information Commissioner’s Office
- Registration no.
- To be confirmed before publication
For any question about this notice or your data.
Controller or processor?
This decides who you ask about what. For clinical records that is your practice, not us.
The practice is the controller. They decide what is collected and why; we process it on their instructions. Patient requests go to the practice first.
We decide how sign-in, audit logging and security work.
Anyone who fills in a form on this site or sets a cookie preference.
What we collect
Patients
On behalf of the practice- IdentityName, date of birth, patient reference, gender where recorded
- ContactMobile number, email, address
- ClinicalIntraoral scans, photographs, radiographs, treatment plans, tooth measurements, aligner schedules, clinician decisions and notes
- UsageWhen scans were taken, aligner wear time, app sign-ins
- ConsentTreatment and marketing consent, recorded separately with a timestamp
Practice staff
We are the controller- IdentityName, work email, role; professional registration number and regulator for registered clinicians
- SecurityPassword, stored only as an argon2id hash we never see, and two-factor secret
- ActivitySign-in history, IP address, device, and every action taken in the platform
Website visitors
We are the controller- EnquiryAnything you type into an enquiry or booking form
- NetworkYour IP address, briefly, to rate-limit those forms against abuse
Under UK GDPR it carries additional protection: a separate lawful basis under Article 9, stricter access controls, and a logged record of every read. We treat it accordingly.
Why we use it, and our lawful basis
- Delivering treatment on the practice’s instruction
Art. 6(1)(b)contractArt. 9(2)(h)health care provision - Keeping clinical records as the law requires
Art. 6(1)(c)legal obligation - Sign-in, audit logging, fraud and abuse prevention
Art. 6(1)(f)legitimate interests: securing health records - Replying to an enquiry you sent us
Art. 6(1)(f)legitimate interests - Marketing email
Art. 6(1)(a)consent: opt in, unsubscribe at any time
Where it is stored
Patient health data is stored in the EU
The platform, its database and its file storage run on one host in Helsinki, Finland.
Transfers outside the UK
We do not move patient data to a US-region service without a transfer risk assessment and appropriate safeguards, currently the UK International Data Transfer Addendum.
How long we keep it
Enforced by an automated nightly process, not by someone remembering.
Your rights
Access, correction, erasure, restriction, portability and objection. How each one works on this platform is on the data protection page.
One limit worth knowing now. Erasure does not remove clinical records; the practice is required to keep those for the periods above. We do erase contact details, marketing consent and account data, and we record the request and when we acted on it.
How to make a request- Encrypted in transit and at rest
- Tenant separation enforced by the database itself, not application code
- Every read of a patient record is logged
- Scans in a private bucket, reachable only by short-lived links that expire within minutes
Cookies
Nothing here identifies you. The site sets essential cookies only, so there is nothing to opt in to; clearing this site's data in your browser removes them.
Essential
Always setWhether you have dismissed the cookie notice, your theme preference if you change it, and the session cookies that keep you signed in to your account.
Analytics
Not usedThe site loads no analytics. If that ever changes, we will ask for your consent first.
Advertising
NeverNo advertising or cross-site tracking cookies, on the website or in the platform.
Complaints
Raise it with us first. You can also go to the regulator at any point, without asking us.
We acknowledge every complaint and tell you what we did about it.
0303 123 1113. The UK’s independent authority for data protection.
This is a specific draft written against how the platform works, not legal advice. Have a solicitor with UK data protection and medical device experience review it before real patients are onboarded, and confirm the company details and ICO registration number.
Questions about your data
One email reaches our Data Protection Officer. Patients should go to their practice first; if that stalls, we will help them.
Plain language is fine.
Then act on everything we can.
Including a plain statement of anything we kept, and why.
Or use the contact form and choose "Data protection".
Email the DPOIf we change this notice materially we will tell practices by email and update the version above. Continued use after a change means the new version applies.