Data Processing Agreement
Last updated: 2026-07-24
Practices using Virtual Consultant are the data controller for their patients' personal data — you decide why and how it's processed. We act as your data processor: we process patient data only on your instructions, to provide the platform, and in line with UK GDPR Article 28. For the wider picture of how we meet UK GDPR requirements, see our GDPR Compliance page.
1. Our Obligations as Processor
Process personal data only on your documented instructions, including transfers, unless required otherwise by law
Ensure staff who process data are subject to confidentiality obligations
Implement appropriate technical and organisational security measures
Only engage another processor (sub-processor) with your general authorisation, as listed below
Assist you in responding to data subject requests and meeting your own GDPR obligations
Notify you without undue delay after becoming aware of a personal data breach
Delete or return all personal data to you at the end of our agreement, unless retention is required by law
Make available information necessary to demonstrate compliance, and allow for audits
2. Sub-Processors
We use the following sub-processors to deliver the platform. Analytics/marketing providers are only engaged for a given visitor if they've accepted the relevant cookie category — see our Cookie Policy.
| Provider | Purpose | Data Involved |
|---|---|---|
| Microsoft Azure | Application hosting, database, and file storage | All patient and account data |
| Mailjet | Transactional and notification email delivery | Name, email address, message content |
| ClickSend | SMS delivery for appointment and treatment notifications | Name, phone number, message content |
| Stripe | Subscription billing for practices | Practice billing details (not patient clinical data) |
| OpenAI | AI-assisted oral health photo analysis and smile visualisation | Clinical photos and related treatment information, where these features are used |
| Google (Analytics, Ads) | Site analytics and advertising measurement — only with consent | Anonymised/aggregated usage data |
| Microsoft Clarity | Session analytics (heatmaps, recordings) — only with consent | Anonymised usage data |
| Ahrefs | Marketing analytics — only with consent | Anonymised usage data |
| Meta | Advertising measurement — only with consent | Anonymised usage data |
We'll give you reasonable notice of any intended change to this list so you can object if you have concerns.
3. International Transfers
Where a sub-processor is based outside the UK/EEA, we rely on an adequacy decision or Standard Contractual Clauses (or that provider's equivalent safeguards) to ensure your data continues to receive an equivalent level of protection. OpenAI, our AI photo-analysis sub-processor, is US-based: it's certified under the UK Extension to the EU–US Data Privacy Framework, backed by Standard Contractual Clauses and the UK International Data Transfer Addendum as a fallback mechanism.
4. Contact Us
For questions about this page, or to request a signed DPA, contact:
hello@virtualconsultant.online
Partnering with leading clinics, Virtual Consultant combines clinical expertise with advanced digital technology — making orthodontic care more efficient, accessible, and rewarding for both teams and patients.