Submit your case

Privacy Policy

01-01-2026

GDPR Updated Policy

Zenith Dental Labs Ltd is fully compliant with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This statement outlines how we process and protect personal data provided by dental practices.

1. Our Role

For patient-related information, Zenith Dental Labs acts as a Data Processor, processing data solely under the instructions of the referring dental professional.
For our own business operations (billing, communications), we act as a Data Controller.

2. Data We Process

We only process the minimum data required to manufacture dental restorations, which may include:

  • Intraoral scans, STL files, impressions
  • Clinical photographs and treatment instructions
  • Patient identifiers (initials, reference numbers – not full names unless required)
  • Clinician and practice contact information for communication and invoicing

We do not use patient data for marketing or any unrelated purpose.

3. Lawful Basis

We process data under:

  • Article 6(1)(b) – Performance of a contract
  • Article 6(1)(f) – Legitimate interest (case communication & traceability)
  • Article 9(2)(h) – Processing of special category data for healthcare purposes

4. How We Use and Protect Data

Data is used exclusively for:

  • Designing and manufacturing dental appliances
  • Case communication and clinical collaboration

Regulatory traceability requirements (MHRA)

Security measures include:

  • Encrypted digital workflows (3Shape, Medit, iTero, DS Core, Smilecloud, etc.)
  • Access-controlled systems and password protection
  • Encrypted storage and backups
  • Staff confidentiality training

All processing complies with medical device regulations and GDPR standards.

5. Data Sharing

Data is only shared when essential, such as:

  • Delivery couriers
  • Milling/printing partners under strict GDPR agreements
  • IT system providers (secure servers, encrypted platforms)

We never share identifiable patient data with third parties for marketing or non-clinical purposes.

6. Data Retention

To comply with medical device traceability:

  • Patient case data is retained for 10 years
  • Financial records: 6 years (HMRC)
  • Communications are retained as necessary for service provision

All data is securely deleted when no longer required.

7. Your Rights & Requests

Dental practices may request:

  • Confirmation of processing activities
  • Amendment or deletion of non-essential data
  • A copy of our Data Processing Agreement (DPA)

Requests should be sent to: info@zenithdental.co.uk

8. Data Breaches

In the unlikely event of a data breach involving patient information:

  • We will notify the referring dentist immediately
  • If required, the ICO will be informed within 72 hours
  • Full documentation and corrective steps will be provided