GDPR
Updated 16 September 2026
This page describes how the service actually works today. The definitive contractual terms are being drawn up with legal counsel; where they differ, they prevail. No identifiable patient photograph is processed until the framework applicable to the practice's country has been validated.
Each party's role
The practice is the controller. NewSmile is a processor within the meaning of Article 28: it processes data only on the practice's documented instructions, in order to provide the service.
A processing agreement is signed with each practice before any identifiable patient photograph is processed.
Legal basis
On the public patient page, processing rests on the visitor's consent, collected before any photograph is sent and revocable at any time.
Chairside, the legal basis is the practice's, under the framework applicable to its country. The practice's country determines the regime: there is no single rule, and France is not the general case.
Location and transfers
Data is processed on Cloudflare infrastructure. Some processors operate outside the European Union; the corresponding transfers are covered by standard contractual clauses.
The list of processors, their role and their country of processing are available on request.
Health data
A dental photograph may constitute health data depending on the country and the use. Processing of real patient photographs remains disabled until the framework applicable to the practice's country has been validated, including, where required, the certified hosting demanded locally.
While that lock is in place, only example and demonstration photographs are processed.
Security
Files are never publicly accessible: every access goes through a verified authorisation or a short-lived signed link. One practice's data is partitioned from every other's.
Image metadata is stripped before storage. Technical logs contain no photograph, no token and no patient identity.
Exercising rights, reporting an incident
For any request about your data, write to the practice concerned, or to [email protected] which will pass it on.
A data breach is notified to the practice concerned without undue delay, with what it needs for its own notification to the competent authority.