Data Processing Agreement

Parties and status

This Data Processing Agreement ("DPA") is between the dental practice or business that holds a DenBrain account (the "Controller") and DenBrain Ltd, company number 17494466, registered office 3 Chrislea Close, Hounslow, TW5 0DL ("DenBrain" or the "Processor"). It forms part of the DenBrain Terms of Service (clause 15) and applies automatically from the date the Controller creates an account, for as long as DenBrain processes Controller personal data. Contact: hello@denbrain.co.uk. Last updated: 28 October 2026.

Terms defined in the UK GDPR (including controller, processor, personal data, special category data, data subject, processing and personal data breach) have the same meaning here.

1. Roles of the parties

For patient personal data that DenBrain processes through the DenBrain service on the Controller's behalf, the practice is the controller and DenBrain is the processor.

For personal data that DenBrain handles for its own purposes - managing the Controller's account and billing, securing and administering the service, complying with the law, and communicating directly with the Controller about its service - DenBrain is a separate controller, as described in DenBrain's Privacy Notice. Those activities are outside this DPA's processor obligations.

Neither party is described as universally a controller or a processor; the role depends on the data and the purpose.

2. Subject matter and duration

The subject matter is DenBrain's provision of the DenBrain service (including the dental reception widget, patient journey, Smile Preview and enquiry and booking-request records) to the Controller under the Terms.

The duration is the period for which the Controller has a DenBrain account, plus the period needed to return or delete the data under clause 14.

3. Nature and purpose of processing

Nature: receiving, collecting, recording, organising, storing, retrieving, transmitting to subprocessors, generating an illustrative image from a photo, displaying to the Controller's authorised users, and deleting personal data.

Purpose: to provide the service to the Controller, to enable the Controller to respond to patient enquiries and booking requests, to show the Controller how its widgets perform, and to keep the service secure and available. DenBrain does not use patient personal data for its own purposes, does not sell it, and does not use patient photos to train AI models.

4. Categories of personal data and data subjects (Annex 1)

Data subjects: the Controller's prospective and existing patients and website visitors who use the Controller's DenBrain widgets, and the Controller's own authorised users.

• Identity and contact details the Controller chooses to collect: first and last name, email address, mobile number and an optional message.
• Enquiry details: treatment of interest, smile concern, the goals or concerns the patient writes, appointment-request details, and records that a booking link or phone number was used.
• Technical identifiers used for advertising measurement only where the Controller's website signals consent: campaign and click identifiers and advertising or browser identifiers (never names, email addresses, phone numbers, photos or free text).
• Photographs of the patient's smile (the patient's face may be visible) and the illustrative preview generated from them. DenBrain treats these as special category data requiring explicit consent.
• Consent records, including photo consent, preview acknowledgement and any marketing preference.
• Technical and journey data: web page address and referrer, usage events, IP address and request logs.
• Controller user data: name, email, role and authentication data of the Controller's staff.

5. Documented instructions

DenBrain will process Controller personal data only on the Controller's documented instructions, which are this DPA, the Terms, and the Controller's use and configuration of the service. This includes instructions about transfers of personal data outside the UK. DenBrain will process otherwise only where UK law requires it, and will then tell the Controller of that legal requirement before processing unless the law prohibits it.

If DenBrain believes an instruction infringes data protection law, it will tell the Controller promptly and may suspend the affected processing until the instruction is confirmed or amended.

6. Confidentiality

DenBrain will ensure that people authorised to process Controller personal data are bound by a duty of confidentiality and will limit access to those who need it to provide the service.

7. Security

DenBrain will implement appropriate technical and organisational measures to protect Controller personal data, as required by Article 32 of the UK GDPR, taking into account the state of the art, costs, the nature, scope, context and purposes of processing and the risk. The measures in place at the date of this DPA are described in the Technical and Organisational Security Measures published at /security (Annex 2). DenBrain may update them, provided it does not materially reduce the overall level of protection.

8. Subprocessors (Annex 3)

The Controller gives DenBrain general written authorisation to use the subprocessors listed at /subprocessors, which at the date of this DPA are: Hostinger, Cloudflare R2, fal.ai, Stripe.

DenBrain will give the Controller at least 30 days' notice (by email to the account owner and by updating /subprocessors) before adding or replacing a subprocessor. The Controller may object on reasonable data-protection grounds within 14 days of the notice. If the parties cannot resolve the objection, the Controller may cancel the affected service under the Terms.

DenBrain will impose on each subprocessor data protection obligations no less protective than those in this DPA, and remains liable to the Controller for each subprocessor's performance of those obligations.

9. Data subject rights

Taking into account the nature of the processing, DenBrain will give the Controller reasonable assistance, by appropriate technical and organisational measures, in responding to requests from data subjects to exercise their rights. If DenBrain receives such a request directly about Controller personal data, it will not respond substantively except to direct the person to the Controller, unless the Controller instructs otherwise or the law requires. Requests to DenBrain are handled through hello@denbrain.co.uk.

10. Personal data breach notification and assistance

DenBrain will notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller personal data, and will provide, as information becomes available, the nature of the breach, the categories and approximate numbers of data subjects and records, the likely consequences, and the measures taken or proposed. DenBrain will help the Controller meet its own obligations to notify the Information Commissioner's Office and data subjects. The Controller remains responsible for deciding whether and when to notify.

11. Data protection impact assessments

DenBrain will give the Controller reasonable assistance with data protection impact assessments relating to the service, including information about how the service works, its security measures and its subprocessors.

12. Prior consultation with the ICO

DenBrain will give the Controller reasonable assistance in consulting the Information Commissioner's Office where a data protection impact assessment indicates a high risk that the Controller cannot mitigate.

13. International transfers

DenBrain will not transfer Controller personal data outside the UK except to its subprocessors, as described at /subprocessors and in the Privacy Notice, and only where a lawful transfer mechanism applies. The mechanisms in place at the date of this DPA, as published by each provider, are:

• Hostinger: Hostinger's data processing agreement applies the EU Standard Contractual Clauses and the UK International Data Transfer Addendum to transfers of UK personal data.
• Cloudflare R2: Cloudflare's customer data processing agreement applies the EU Standard Contractual Clauses with the UK Addendum, and Cloudflare states that it participates in the EU-US Data Privacy Framework and its UK Extension.
• fal.ai: fal.ai's data processing addendum applies the EU Standard Contractual Clauses (Module 2) and the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. DenBrain is not aware of a Data Privacy Framework certification by fal.ai and does not rely on one.
• Stripe: Stripe's Data Transfers Addendum applies the EU-US Data Privacy Framework (including its UK Extension) where available, and otherwise the EU Standard Contractual Clauses with the UK International Data Transfer Addendum.

14. Return and deletion

When the Controller's account ends, or on the Controller's written request at any time, DenBrain will, at the Controller's choice, return or delete Controller personal data within 30 days of the request, and delete existing copies unless UK law requires storage or a billing-record retention need described in Annex 4 applies. Copies in encrypted backups expire automatically within 35 days afterwards and are not restored into the live service solely to remove individual records.

Retention periods that apply before then (Annex 4):

• Original patient photo: Original uploaded photos are deleted immediately after successful processing where possible. Failed or abandoned uploads are removed by an automated cleanup process that runs hourly and deletes originals more than 24 hours old.
• Generated Smile Preview (and the 'before' image shown beside it): Generated Smile Preview images (the preview and the 'before' image shown beside it) are temporary: they are available for 24 hours and are then deleted automatically, unless the practice deliberately saves them from its DenBrain dashboard. Images a practice saves are held as that practice's own record, for as long as the practice keeps them, outside this temporary window.
• AI Teeth Scan photos and written scan summary: AI Teeth Scan photos are deleted as soon as the scan has been analysed. Photos from a failed or abandoned scan are removed by the same automated hourly cleanup that removes Smile Preview originals after 24 hours. The written scan summary is kept for 24 hours so the patient can read it and book, and is then deleted, unless the patient chooses to send it to the practice with an enquiry, in which case the practice holds it as part of that enquiry.
• Patient enquiries and appointment (booking) requests: Kept for as long as the practice's account is active, because they are the practice's records; deleted earlier if the practice deletes them or instructs us to; deleted or returned after the account ends as set out under 'Account closure'.
• Account data (name, email, practice name, hashed password, plan and usage): Kept while the account is active; deleted or returned after the account ends as set out under 'Account closure', except billing records.
• Practice configuration (Smile Preview settings, treatments, booking links, widgets): Kept while the account is active; deleted after the account ends as set out under 'Account closure'.
• Usage and journey events, and in-product audit records: Kept with the practice's account data while the account is active; deleted after the account ends as set out under 'Account closure'.
• Billing records (invoices, subscription and payment records): Kept for as long as necessary for accounting, tax, legal, fraud-prevention, dispute-resolution or other legitimate business requirements, subject to applicable law.
• Application and web-server logs (include IP addresses): Held in rotating log files capped at five files of 10 MB for each of the application, worker and web-server services; the oldest entries are overwritten automatically. In practice this is a short, size-bounded period rather than a fixed number of days.
• Rejected inbound webhook records: Deleted automatically after 30 days.
• Encrypted database backups: Backups older than 35 days are deleted automatically (a minimum number of the newest backups is always kept so a failed run cannot leave no backup). Data deleted from the live service therefore leaves backups within 35 days. Backups are encrypted and are not restored into the live service for the sole purpose of removing individual records.

15. Audit and inspection

DenBrain will make available to the Controller the information reasonably necessary to demonstrate compliance with this DPA, and will allow and contribute to audits, including inspections, conducted by the Controller or an auditor it appoints. Audits must be on reasonable written notice, during business hours, confined to systems and records relevant to the Controller's data, subject to confidentiality, and must not unreasonably disrupt the service or expose other customers' data. Where the information DenBrain provides in writing answers the Controller's questions, an on-site inspection will not normally be needed.

16. Records and cooperation

DenBrain will keep the records of processing that Article 30(2) of the UK GDPR requires of a processor, will cooperate with the Information Commissioner's Office on request, and will give the Controller reasonable assistance in demonstrating compliance.

17. Controller's responsibilities

The Controller is responsible for:

• having a lawful basis (and, for special category data, an Article 9 condition) for the processing it instructs;
• giving patients the privacy information the law requires;
• making sure patients give the explicit consent the Smile Preview flow asks for before a photo is processed, and any further consents the Controller needs, including for marketing, which is separate and optional;
• running the consent banner on its own website and making sure the consent signal it gives the embedded AI Smile Simulator is accurate (the simulator treats a missing, unclear or withdrawn signal as no consent), and choosing and configuring any analytics or advertising destinations;
• choosing how appointment requests are handled, and handling the enquiries it receives promptly, because DenBrain does not arrange or confirm appointments;
• the accuracy and lawfulness of the instructions and content it configures;
• keeping its users' credentials secure and removing access for people who leave; and
• deciding whether to notify the ICO and data subjects of a personal data breach.

18. DenBrain's responsibilities

DenBrain is responsible for processing only as instructed, for the security measures in clause 7, for the subprocessor arrangements in clause 8, and for the other obligations in this DPA. Original uploaded photos are deleted immediately after successful processing where possible. Failed or abandoned uploads are removed by an automated cleanup process that runs hourly and deletes originals more than 24 hours old. Generated Smile Preview images (the preview and the 'before' image shown beside it) are temporary: they are available for 24 hours and are then deleted automatically, unless the practice deliberately saves them from its DenBrain dashboard. Images a practice saves are held as that practice's own record, for as long as the practice keeps them, outside this temporary window.

19. Liability

Liability under this DPA is governed by the liability provisions of the Terms. Nothing in this DPA limits or excludes liability that cannot lawfully be limited or excluded, or the rights of data subjects against either party under data protection law.

20. Term and changes

This DPA continues for as long as DenBrain processes Controller personal data. DenBrain may update it to reflect changes in the law or the service, giving the notice the Terms require for material changes.

21. Governing law and jurisdiction

This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, as set out in the Terms.