Privacy Policy

This website is operated by Nexa Vitae Ltd, trading as Twilight Dental (“we”, “us”, “our”). We respect your privacy and are committed to protecting your personal data when you use our website, contact us, or become a patient. This Privacy Policy explains how we collect, use, and protect your information.

1. Who we are

We are the data controller for the personal information described in this policy.

Registered company address: 167–169 Great Portland Street, 5th Floor, London, W1W 5PF

Practice address: 1 Moor View, Woodhouse, Leeds LS6 1AQ

ICO registration reference: ZC097696

Contact email: receptiontwilight@outlook.com

2. What personal data we collect

When you use our website or contact us, we may collect the following information:

  • Contact and enquiry details you give us through our contact form, booking requests, or the new patient waiting list: name, email address, phone number.

  • Information you tell us about why you’re getting in touch, including the reason for an enquiry (for example, whether it relates to a routine appointment or dental pain or an emergency). This can reveal information about your health and is treated as special category data, see section 4.

  • Clinical and treatment records, once you become a patient, including your dental and medical history, treatment notes, x-rays and images, and appointment history.

  • Technical data such as IP address, browser type, device information and pages visited, collected automatically for security, analytics and service improvement.

  • Communications you send us by phone, WhatsApp or email.

3. How we use your data, and our lawful basis

Under UK GDPR we must have a lawful basis for each purpose we use your data for. The table below sets these out.

Purpose What we do Lawful basis (Article 6)
Responding to enquiries Answering questions sent through our contact form or by email, phone, or WhatsApp Legitimate interests: running our practice and responding to people who contact us
New patient waiting list Storing your details and contacting you when we can offer an appointment Consent: you actively submit the form to join the list
Booking and delivering appointments Scheduling, reminders and delivering dental treatment via our booking system (Setmore) Performance of a contract with you, and (for the treatment itself) our health and social care basis under Article 9 (see section 4)
Clinical records Keeping accurate treatment records as required by dental regulation Legal obligation, and Article 9 health and social care basis (see section 4)
Marketing Sending updates about the practice, if you’ve opted in Consent: you can withdraw this at any time
Website analytics Understanding how visitors use our site, via Google Analytics Consent, gathered through our cookie banner (see section 8)
Site security Protecting the site from attacks and abuse (Wordfence) Legitimate interests: keeping our systems and your data secure

4. Special category data (health information)

Anything that reveals information about your health, including a note that you’re getting in touch about dental pain, an emergency, or any clinical detail, is “special category data” under Article 9 of UK GDPR, and needs a separate condition on top of the lawful basis in section 3.

Where you tell us about a health-related reason for contacting us (for example, selecting “emergency” or “dental pain” on our enquiry or waiting list forms), we rely on your explicit consent (Article 9(2)(a)), given by ticking the consent box on that form.

Once you are a registered patient and we are providing you with dental care, we process your clinical records under the health or social care condition (Article 9(2)(h)), read with the confidentiality safeguard in Article 9(3) and the equivalent condition in Schedule 1 to the Data Protection Act 2018.

5. How long we keep your data

Data Retention period
General enquiries and waiting-list entries that don’t lead to you becoming a patient 12 months from your last contact with us, then deleted
Adult clinical and patient records 11 years from the date of your last treatment
Children’s clinical and patient records Until your 25th birthday, or 11 years from the date of last treatment, whichever is longer
Website technical and analytics data As set by Google Analytics, typically up to 14 months, subject to your cookie consent

6. Who we share your data with

We share limited personal data with the following organisations, who process it on our behalf or in their own right as part of delivering our service. We don’t sell your data to anyone.

Organisation What we use them for Location
Setmore Appointment booking and scheduling United States
Meta Platforms (Facebook, Instagram, WhatsApp) Messaging via WhatsApp; advertising and page management on Facebook and Instagram Ireland (EU), with transfers to the United States
Google (Analytics) Website analytics Ireland (EU), with transfers to the United States
Trustindex Kft. (Trustindex.io) Displaying Google review content on our website Hungary (EU)
Brevo Sending transactional emails from our website (enquiry and booking confirmations) France (EU)
Wordfence (Defiant Inc.) Website security monitoring United States
WHG Hosting Services Ltd Hosting our website and its database United Kingdom

7. International transfers

Our hosting provider (WHG Hosting Services Ltd) is UK-based, and Trustindex and Brevo are both based in the EU, so no additional safeguard is needed for those transfers. Setmore, Meta and Wordfence are US-based, and Google’s EU entity transfers data to the US. Where we transfer personal data outside the UK, we rely on one of the following safeguards, as required by UK GDPR:

  • The UK-US Data Bridge, for US organisations that have certified under the UK extension to the EU-US Data Privacy Framework, or

  • The UK’s International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, incorporated into our contracts with these providers.

We check that each provider has an appropriate safeguard in place before sharing data with them. You can ask us for more detail about a specific transfer using the contact details in section 11.

8. Cookies

Our website uses cookies and similar technologies for essential site functions, analytics (Google Analytics) and, where applicable, advertising (Meta Pixel). We are updating our cookie banner to let you accept or reject non-essential cookies when you first visit, with an equally clear option to decline, and to change your choice at any time via a “Cookie settings” link in the site footer.

9. Your rights

Under UK GDPR, you have the right to:

  • Access: ask us for a copy of the personal data we hold about you.

  • Rectification: ask us to correct inaccurate or incomplete data.

  • Erasure: ask us to delete your data, where there’s no legal reason for us to keep it. This doesn’t apply to clinical records we’re required to retain.

  • Restriction: ask us to limit how we use your data while a query is resolved.

  • Portability: ask us to provide data you’ve given us in a portable, machine-readable format, or transfer it to another organisation, where technically feasible.

  • Object: object to processing based on legitimate interests, or to direct marketing at any time.

  • Withdraw consent: where we rely on consent, for example the waiting list or marketing, withdraw it at any time without affecting anything already done.

To exercise any of these rights, contact us at receptiontwilight@outlook.com. We’ll respond within one month.

You also have the right to complain to the Information Commissioner’s Office (ICO) if you think we’ve mishandled your data. You can reach the ICO at ico.org.uk/make-a-complaint or by calling 0303 123 1113. We’d appreciate the chance to resolve any concern directly first, but you’re not required to contact us before contacting the ICO.

10. Children’s data

We provide dental care to children as well as adults. Where a child is a patient, we collect and process their data as described in this policy, with consent obtained from a parent or guardian for anyone under 13, in line with our safeguarding obligations.

11. Contact us and changes to this policy

If you have any questions about this policy or how we handle your data, contact us at receptiontwilight@outlook.com or write to us at the registered address in section 1.

We may update this policy from time to time, for example to reflect changes in the services or processors we use. We’ll update the date below when we do.

Last updated: 26 July 2026