GDPR Compliance
Last updated: 2026-08-22
Virtual Consultant is GDPR compliant. We are built and operated to UK GDPR and Data Protection Act 2018 standards, with a signed Data Processing Agreement, documented technical and organisational security measures, a working data subject rights process, and named lawful bases for every category of data we handle — including explicit, timestamped consent for special category health data. This page sets out exactly how, so your practice can complete its own due diligence without needing a separate compliance assessment. It should be read alongside our Privacy Policy, Cookie Policy, Terms & Conditions, and Data Processing Agreement.
1. Data Controller and Data Processor
GDPR responsibility on our platform is split, and it's important to be clear about which role applies where:
For patient clinical and personal data, your practice is the data controller — they decide why and how it's collected and used. We act as their data processor, handling that data only on the practice's instructions and under a Data Processing Agreement, per UK GDPR Article 28.
For practice and staff account data, billing records, and data collected from visitors to this website, we are the data controller — we decide why and how that data is used, and we're directly responsible for it.
The full terms of our processor relationship with practices, including our obligations and current sub-processors, are set out on our Data Processing Agreement page.
2. Lawful Basis for Processing
Depending on the data and the purpose, we (or your practice, as controller) rely on one of the following lawful bases under Article 6:
Contract — to provide the platform and orthodontic services you or your practice have signed up for
Consent — for marketing communications and non-essential cookies, which you can withdraw at any time
Explicit consent — dental and health photos and related clinical information are special category data under Article 9. Before any photo is submitted, you're asked to explicitly consent to that specific processing, timestamped and recorded against your account
Legitimate interests — for things like keeping the platform secure and improving our services, balanced against your rights
Legal obligation — for records we're required to keep, such as billing information under UK tax law
3. Your Data Subject Rights
Under UK GDPR you have the right to access, rectify, erase, restrict, or port your personal data, and to object to certain processing. How you exercise these rights depends on who you are:
Patients with a portal account can update their own name, phone number, and date of birth directly from Support Hub > Edit My Details (rectification), and can submit an access or erasure request from Support Hub > Privacy & My Data. Access requests are compiled into an export of your data; erasure requests anonymize your personal details (name, contact details, date of birth, and similar) while clinical records are retained only where your practice is legally required to keep them for treatment and record-keeping purposes.
Practice staff, referrers, and website visitors can exercise these rights by emailing us directly (below) — we'll action the request or, where a practice is the controller for the data involved, pass it on to them promptly.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you're unhappy with how your data has been handled.
4. Security Measures
We apply role-based access controls, audit trails, encryption in transit and at rest (our database uses Azure SQL Transparent Data Encryption, and file storage uses Azure Storage Service Encryption), optional passkey (FIDO2) sign-in for staff accounts, and vetted third-party infrastructure to protect the data we hold. For the full detail aimed at practices carrying out due diligence, see our Security Hub.
5. Sub-Processors and International Transfers
We use a small number of vetted sub-processors to deliver the platform — hosting, email/SMS delivery, billing, and (with consent) analytics. Where a sub-processor is based outside the UK/EEA, we rely on an adequacy decision or Standard Contractual Clauses to keep data protected to an equivalent standard. The full, current list is on our Data Processing Agreement page.
6. Data Retention
We keep personal data only as long as needed: clinical records for as long as your practice's professional record-keeping obligations require, account and marketing data while your account is active or until you withdraw consent, and billing records for the period required by UK tax law (currently 6 years). Full detail is in our Privacy Policy. Note that if a record is deleted or anonymized, it may still exist in our encrypted database backups for up to 28 days before those backups themselves expire — we can't selectively edit a backup, only let it age out on its normal schedule.
7. Breach Notification
If we become aware of a personal data breach, we notify affected practices without undue delay, and in any case within 72 hours of becoming aware, consistent with our own obligations under Article 33 where we act as controller — so practices can meet their own obligations to data subjects and, where required, the ICO.
8. Contact Us
For questions about this page or to exercise a data subject right, contact us at:
hello@virtualconsultant.online
Partnering with leading clinics, Virtual Consultant combines clinical expertise with advanced digital technology — making orthodontic care more efficient, accessible, and rewarding for both teams and patients.