Privacy notice

1. Summary

We use personal information to answer enquiries, arrange consultations and treatment, coordinate appointments and travel, provide support before and after treatment, administer payments and records, protect our websites and services, comply with legal and regulatory duties, and, where permitted, improve our websites and communicate relevant offers.

• Dental and medical information is treated as sensitive health information and receives additional protection.
• Smile Savers coordinates care, but the London and Budapest treatment providers are separately responsible for the clinical records they create.
• We do not sell personal information.
• Optional analytics and advertising technologies are not intended to operate until you have made the relevant cookie choice.
• You can object to direct marketing, withdraw consent, and exercise the other rights described below.

2. Who is responsible for your information

Smile Savers

Smile Savers Hungary Limited, trading as Smile Savers, is the controller of personal information used for the two websites, enquiries, treatment coordination, customer support, administration and Smile Savers marketing.

Please mark postal correspondence for the attention of the Privacy Lead.

Clinical treatment providers

If you receive a clinical assessment or treatment, the provider delivering that care is normally a separate controller for its clinical records, diagnosis, treatment decisions and professional obligations:

• London: Implant and Aesthetic Center Ltd, 71 Grays Inn Road, London WC1X 8TR.
• Budapest: IMPLANTCENTER Szájsebészeti és Fogászati Korlátolt Felelősségű Társaság, company registration number 01-09-717362, 1024 Budapest, Margit krt. 67, Hungary.

Each provider may give you its own privacy information. That provider’s notice applies to its clinical records in addition to this notice. If care is provided in both countries, each provider is responsible for the records and decisions it makes. Smile Savers remains responsible for its own enquiry, coordination, communication and support records.

3. Information we collect

The information we collect depends on your relationship with us and the services you request.

Information you give us

• Identity and contact details: name, date of birth where needed, postal address, email address, telephone number and preferred contact method.
• Enquiry information: the treatment you are interested in, your questions, preferred location, availability and information included in a form, email, telephone call, WhatsApp message or other communication.
• Health and dental information: symptoms, dental and medical history, medication, allergies, smoking information, previous treatment, treatment plans, radiographs, scans, photographs, models, referrals, clinical correspondence and information needed to assess suitability or provide safe care.
• Appointment and coordination information: consultation and treatment dates, clinic and clinician, itineraries, flight details, airport transfers, accommodation arrangements, accessibility requirements and details needed to support treatment before and after a visit.
• Financial and administrative information: quotations, invoices, payments, refunds and records relating to guarantees, complaints or insurance. Card payments may be handled by a payment provider; we do not need you to send full card details by ordinary email, form or WhatsApp.
• Communications: emails, messages, support tickets, call notes, letters, appointment reminders and records of choices, instructions and consent.
• Reviews and media: a review, testimonial, interview, photograph, video or before-and-after material where you choose to provide it and any separate permission you give for its use.
• Marketing preferences: whether you wish to receive marketing and records of opt-in, opt-out or suppression requests.

Information collected when you use the websites

This may include your IP address, approximate location derived from it, device and browser information, pages viewed, referring page, date and time, website security logs, form-submission metadata and your cookie or consent choices. Optional analytics or advertising information is collected only where the relevant technology is permitted by your choice and applicable law.

Information from other people and organisations

We may receive information from a treating or referring dentist, the London or Budapest clinic, a laboratory, radiology or scanning provider, another healthcare professional, a person acting for you, a payment provider, or a travel or accommodation provider involved in arrangements you requested. We may also receive information when you interact with our pages or reviews on third-party platforms.

If you give us another person’s details, such as a travelling companion, emergency contact or family representative, please tell them and make sure you are entitled to provide the information.

Do you have to provide information?

You do not have to make an enquiry or provide optional information. However, we need enough identity, contact and treatment information to respond and arrange the service you request. A treating clinic will also need relevant health information before it can safely assess or treat you. If necessary information is not provided, we may be unable to arrange an appointment, prepare a meaningful treatment proposal or support your care.

Please do not place passwords, full payment-card details or unrelated sensitive information in a website message.

4. How and why we use personal information

UK data protection law requires a lawful basis for each use of personal information. Health information is “special category” information and also requires an additional condition. The bases most relevant to our work are described below.

Our legitimate interests

Where we rely on legitimate interests, those interests may include responding to requests, coordinating services, providing customer support, keeping proportionate business records, protecting systems, improving administration, recovering debts and protecting or defending legal rights. We consider whether the use is necessary, proportionate and consistent with what you would reasonably expect, and balance it against your interests and rights.

Consent and withdrawal

Where processing relies on consent, you can withdraw it at any time by using the relevant website control or contacting us. Withdrawal does not make earlier lawful processing unlawful. It may mean that we cannot continue an optional activity; for example, withdrawing permission to share information needed for a requested referral may prevent us from arranging it.

WhatsApp and other third-party communication services

If you choose WhatsApp or another third-party service as your preferred contact method, that provider also processes information under its own terms and privacy notice. We use the channel for the communications you request and do not treat a request for service messages as permission for unrelated marketing. Do not use website forms or messaging services for a medical emergency.

Automated decisions

We do not make decisions about your access to treatment or services solely by automated means where the decision would have a legal or similarly significant effect on you. Clinical decisions are made by appropriately qualified professionals.

5. Who we share personal information with

We share only what is reasonably necessary for the relevant purpose. Recipients may include:

• the London and Budapest treatment providers named above, their dentists, surgeons, nurses and authorised administrative staff;
• dental laboratories, imaging and scan providers, referring or aftercare dentists, pharmacies and other healthcare providers involved in your care;
• airport-transfer, accommodation or travel service providers where you ask us to make or coordinate those arrangements;
• payment providers, banks, accountants and financial advisers;
• companies providing hosting, email, telephone, messaging, customer-support, cloud storage, software, backup, cybersecurity, analytics or advertising services;
• professional advisers, insurers, indemnity providers, auditors, debt-recovery providers and legal representatives;
• regulators, courts, law-enforcement bodies, safeguarding authorities, tax authorities or other public bodies where disclosure is required or permitted by law; and
• a prospective buyer, seller or adviser if our business or assets are reorganised, sold or transferred, subject to appropriate confidentiality and data-protection arrangements.

Some recipients, including treating clinics and payment providers, use information as independent controllers under their own legal responsibilities. Service providers acting as our processors are required to protect information and use it only for the agreed services and instructions.

We do not sell or rent personal information to data brokers.

6. International transfers

Your information may move between the United Kingdom and Hungary because treatment and coordination can involve both countries. Hungary is in the European Economic Area. UK and EU adequacy arrangements currently allow personal information to flow between the UK and EEA without additional transfer safeguards being required solely because of that transfer.

Some technology, communications, analytics or support providers may process information in other countries. Where a restricted transfer is made, we use an approved mechanism as required, such as UK adequacy regulations, an International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful exception, together with additional safeguards where needed. You may contact us for more information about safeguards relevant to your information.

7. Cookies and similar technologies

Our websites use cookies and similar technologies for essential functions, security, remembering consent choices and, if you permit them, analytics, embedded content and advertising measurement. The consent panel may look different on the old and new websites, but both should provide a way to accept, reject or customise non-essential categories.

Essential technologies may operate without consent where they are strictly necessary for a service you request or for security. Analytics, marketing and other non-essential technologies are intended to remain disabled until the relevant consent has been recorded.

Depending on the website and your choices, providers may include Google services such as Google Tag Manager, Google Analytics or Google advertising services. Embedded video, maps, reviews, social-media content and links may also involve the relevant third party. Details of current cookies, providers, purposes and lifetimes are shown in the Cookie policy and/or consent panel available on the website you are using.

You can change or withdraw your choices at any time by selecting Cookie settings in the website footer or consent interface. Browser controls can also delete stored cookies, but they are not a substitute for the choice offered by the site.

8. Security

We use technical and organisational measures appropriate to the nature and risk of the information. These may include access controls, authentication, encryption in transit, backups, logging, staff confidentiality requirements, supplier checks and procedures for handling incidents. Access is limited to people who need the information for an authorised purpose.

No internet or storage system is completely secure. Please use appropriate care when sending information, follow any secure-upload instructions we provide, and contact us promptly if you believe information has been sent to the wrong person or an account has been compromised.

9. How long we keep personal information

We keep information only for as long as reasonably needed for the purpose described, legal and regulatory duties, patient safety, guarantees, insurance, complaints and the establishment or defence of legal claims. We review records and delete, anonymise or securely dispose of them when they are no longer required.

A legal hold, complaint, regulatory investigation or claim may require information to be preserved beyond the usual period. Backups are protected and removed through their normal secure rotation process.

10. Children’s information

The websites are primarily intended for adults arranging private dental services. A clinic may provide care to a child or young person where clinically appropriate. In that situation, information may be obtained from and shared with a parent, guardian or other person with authority, while also respecting the young person’s capacity, confidentiality and rights. The treating clinic’s privacy information and consent procedures apply to its clinical care.

11. Your data-protection rights

Depending on the circumstances and the lawful basis, you may have the right to:

• ask for confirmation that we use your information and receive a copy of it;
• have inaccurate or incomplete information corrected;
• ask for information to be erased where there is no overriding reason to keep it;
• ask us to restrict how information is used in certain circumstances;
• object to processing based on legitimate interests;
• object at any time to use of your information for direct marketing;
• receive information you supplied in a structured, commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller where the portability right applies;
• withdraw consent at any time where consent is the basis; and
• ask for human intervention where a qualifying solely automated decision is made. We do not currently make such treatment or service decisions.

These rights are not absolute. For example, clinical and financial records may need to be retained despite an erasure request. We will explain if an exemption or another person’s rights affect what we can provide.

To exercise a right, email team@smilesavershungary.co.uk with the subject Privacy request. We may ask for proportionate information to verify identity and locate records. We normally respond without undue delay and within one month, although the law allows an extension for a complex or numerous request. We do not normally charge a fee.

For a clinical record held by a treatment provider, contacting that provider directly will usually be the quickest route. We will help identify the appropriate controller where reasonably possible.

12. External websites, platforms and embedded content

Our sites may link to or display content from another organisation, including video, maps, review platforms, social media, payment services and news publications. When you follow an external link or allow third-party content, that organisation may process information under its own privacy notice. We do not control the privacy practices of independent third parties.

13. Changes to this notice

We review this notice when services, suppliers or law change. The current version and update date will be published on both websites. If a change materially affects how we use existing information, we will take reasonable steps to bring it to the attention of affected people before the new use begins where required.

14. Contact and complaints

Questions, requests and concerns about Smile Savers’ use of personal information should be sent to:

You also have the right to complain to the UK Information Commissioner’s Office (ICO). Details are available at ico.org.uk/make-a-complaint, or you can telephone 0303 123 1113. We would appreciate the opportunity to address your concern first, but you do not have to contact us before approaching the ICO.

A concern about clinical information held by the London or Budapest treatment provider should also be raised with that provider. The Budapest provider’s own privacy notice explains rights under EU and Hungarian law and how to contact the Hungarian supervisory authority.