Privacy Policy
Last updated 16 October 2026 · Version privacy-v1-2026-10
Who we are
The data controller is G Mehta Ltd, trading as GM Dental and Implant Centre, company number 09407124, 5 London Road, Rochester, ME2 3JA. Registered office: 24 Landgate, Rye, TN31 7LJ. ICO registration ZA751676. Contact: [email protected].
Our practices in Barnet, Rochester, Ashford and Bexleyheath are all locations of GM Dental and Implant Centre. This policy covers the GM Dental referral app and how we use your information within it.
What we collect
- Your account: your name, email address and mobile phone number.
- Referral details: if you were referred, the details you enter when you use a referral code: your name, phone number, email, the treatment you are interested in and your preferred practice. Referrers never enter anyone else's details.
- Practice matching: to tell when a referred person has booked or started treatment, we match their phone number and email against the practice's records in Dentally.
- Referral progress: where a referral is up to, for example whether your friend has booked or started treatment. This can reveal that someone is having dental treatment, so we treat it as health data. A referrer only ever sees their friend's first name and initial and the stage reached, never clinical details.
- Wallet and payout records: commission credited to you, your balance and any payout requests.
- Sign-in and device data: session and device information needed to keep you signed in securely.
- Notification records: a record of the service emails and notifications we send you.
Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Running your account, handling referrals, crediting commission and paying it | Contract (UK GDPR Art 6(1)(b)) |
| Keeping the app secure, preventing fraud and self-referral, improving the app | Legitimate interests (Art 6(1)(f)) |
| Keeping financial and audit records | Legal obligation (Art 6(1)(c)) |
| Health data: when a referred friend becomes a patient, the practice holds their records to provide care | Art 9(2)(h), provision of health care, with the Data Protection Act 2018 |
Notifications are service messages only, such as referral updates and payout readiness. We do not send marketing through the app. If we ever wanted to, we would ask for your separate opt-in first, as the Privacy and Electronic Communications Regulations (PECR) require.
Who we share it with
We do not sell your data. These providers process it on our behalf:
- Supabase: hosting, sign-in (authentication) and our database.
- Resend: sending service emails.
- Dentally: our practice management system, where a referred friend's patient record is held.
- Apple and Google: distributing the app through the App Store and Google Play.
International transfers
Some of these providers process data outside the UK, including in the United States. Where they do, we rely on safeguards such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK–US data bridge where the provider is certified.
How long we keep it
- Your account: until you delete it, plus a 30-day grace period.
- Financial records (wallet and payout records): 6 years.
- Audit records: 6 years.
- Notification records: 90 days.
- Analytics: 13 months.
Deleting your account
You can delete your account in the app under Profile, then Delete account. Your account is then scheduled for deletion and you have 30 days to change your mind: sign in during that time and you can restore it. After 30 days we remove your sign-in and anonymise your account.
Anonymised: your name, email, phone number and referral code are removed, and your notification content and analytics are cleared. Kept: wallet and payout records and audit records, for 6 years, with nothing that identifies you. Referrals that came through your code are kept, because those details belong to the referred person's own relationship with the practice. If you were referred and your referral has not yet earned commission, it ends and your details are removed from it. Deleting may mean losing commission; the app tells you before you confirm, and our Terms of Use explain the rules.
Deleting your app account does not delete clinical records a practice must keep. If you are or were a patient, you can ask the practice about those records separately.
Your rights
Under UK GDPR you have the right to: be informed; access your data; have it corrected; have it erased; restrict its use; data portability; object; and rights relating to automated decisions. Exercising them is free and we respond within one month. Email [email protected].
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.
Age
The app is for people aged 18 and over only.
Changes to this policy
If we change this policy we will update the date and version at the top of this page. For material changes, the app will ask you to read and accept the new version.