360 Whitening is a cosmetic teeth-whitening tracking service operated by 360Dent Ltd. This policy explains how we collect, use, store, share and protect your personal data when you use the 360 Whitening mobile application.
Who we are
360 Whitening is a cosmetic teeth whitening tracking service operated by 360Dent Ltd, a company registered in England and Wales.
- Legal entity
- 360Dent Ltd
- Trading name
- 360 Whitening
- Registered address
- Octagon House, Bradford Road, Sandbeds, West Yorkshire, BD20 5LY
- ICO registration
- ZB054701
- Privacy contact
- privacy@360whitening.co.uk
- General contact
- hello@360whitening.co.uk
360Dent Ltd is the data controller for all personal data processed through the 360 Whitening mobile application. We are registered with the Information Commissioner's Office (ICO) under reference ZB054701.
What this policy covers
This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use the 360 Whitening mobile application (the “App”). It applies to:
- Patients using the App to track their whitening treatment
- Dental professionals using the App to manage patient treatment
Please read this policy carefully. By using the App, you confirm that you have read and understood how we handle your personal data.
This policy should be read alongside our Terms and Conditions, which govern your use of the App.
The data we collect
3.1 Patient data
When you use the 360 Whitening App as a patient, we collect and process the following categories of personal data:
- Full name
- Provided at registration by your dental practice
- Email address
- Used for account access via magic link
- Treatment details
- Whitening formulation, start date, treatment protocol, notes added by your dentist
- Progress photographs
- Photos of your teeth taken during your treatment — see Section 5
- Shade analysis results
- AI-generated cosmetic shade estimates based on your photographs
- Top-up requests
- Records of gel top-up requests submitted through the App
- App usage data
- Login times, screens visited, session duration
- Device data
- Device type and operating system — collected automatically for App functionality
3.2 Dental professional data
When you use the 360 Whitening App as a dental professional, we collect:
- Full name
- Provided at registration
- Email address
- Used for account access
- Practice name
- Associated with your account and patient records
- Practice reference code
- Used to link patients to your practice
- Patient list
- Names and treatment records of patients you have enrolled
3.3 Special category data
Progress photographs of your teeth are classified as health data under UK GDPR Article 9. This is special category data and receives our highest level of protection.
We obtain your explicit consent to process this data before any photograph is taken or uploaded. You may withdraw this consent at any time.
Before any photograph is uploaded or processed, all embedded metadata is permanently removed from the image on your device. This includes:
- GPS location coordinates
- Device make and model
- Date and time the photo was taken
- Any other EXIF metadata
Only the pixel data — the image itself — is transmitted to our servers or processed by our AI system. This technical measure is in place for every photograph, without exception.
How we use your data and our lawful basis
UK GDPR requires us to have a lawful basis for every use of your personal data. Where we process special category data (your photographs), we must also satisfy an additional condition under Article 9.
| Purpose | Data used | Lawful basis | Article 9 condition |
|---|---|---|---|
| Providing your whitening treatment tracking service | Name, email, treatment details | Contract · Art 6(1)(b) | — |
| Storing and displaying your progress photographs | Progress photographs | Explicit consent · Art 6(1)(a) | Art 9(2)(a) |
| AI shade analysis of your photographs | Progress photographs | Explicit consent · Art 6(1)(a) | Art 9(2)(a) |
| Sharing your progress with your dental practice | Photographs, treatment records | Explicit consent · Art 6(1)(a) | Art 9(2)(a) |
| Sending you transactional emails (magic links, notifications) | Email address | Contract · Art 6(1)(b) | — |
| Enabling your dental practice to manage your treatment | All patient data | Legitimate interests · Art 6(1)(f) | — |
| Security monitoring and fraud prevention | App usage data, device data | Legitimate interests · Art 6(1)(f) | — |
| Improving the App and our services | Anonymised usage data | Legitimate interests · Art 6(1)(f) | — |
Where we rely on your explicit consent, you have the right to withdraw that consent at any time by contacting privacy@360whitening.co.uk. Withdrawing consent does not affect the lawfulness of any processing carried out before the withdrawal.
Progress photographs and AI shade analysis
5.1 How photographs are processed
When you submit a progress photograph through the App, the following process occurs:
- All metadata is stripped from the photograph on your device before it is transmitted anywhere.
- The cleaned photograph (pixel data only) is uploaded securely to our storage provider (Supabase).
- If you have consented to AI shade analysis, the photograph is transmitted to Anthropic's API for processing.
- The AI returns a cosmetic shade estimate using the VITA shade scale.
- The result is displayed in the App and stored in your treatment record.
- Your dental practice can view your photographs and shade results through their professional portal.
5.2 AI shade analysis — important information
The AI shade analysis feature provides a cosmetic estimate of your tooth shade. It is not a clinical measurement, not a diagnostic tool, and not a medical device. All clinical decisions remain the responsibility of your treating dentist.
You may use the App without consenting to AI shade analysis. This is an optional feature.
5.3 Anthropic as sub-processor
The AI shade analysis is powered by Claude, an AI service developed and operated by Anthropic, PBC. When you consent to AI shade analysis, your photograph (pixel data only, with all metadata removed) is transmitted to Anthropic's servers for processing.
Anthropic is listed as a sub-processor in our records. We have reviewed Anthropic's data processing terms and applicable safeguards. Anthropic processes the photograph solely for the purpose of returning a shade estimate and does not retain it for training purposes under their standard API terms.
You will be asked to consent to AI shade analysis separately during the App onboarding process. You may withdraw this consent at any time without affecting your ability to use the rest of the App.
Who we share your data with
6.1 Your dental practice
Your dental practice is an independent data controller. They access your treatment data, progress photographs, and shade analysis results through the 360 Whitening professional portal in their role as your treating clinician.
Your relationship with your dental practice — including how they handle your data — is governed by their own privacy policy. We recommend you ask your dental practice for a copy of their privacy policy.
We require all dental practices using the 360 Whitening platform to enter into a Data Processing Agreement with us before accessing the platform. This agreement governs how patient data may be used.
6.2 Sub-processors
We use the following third-party service providers (sub-processors) to deliver the 360 Whitening service. Each is bound by a data processing agreement and appropriate contractual safeguards:
| Sub-processor | Location | Purpose |
|---|---|---|
| Supabase Inc | US (EU region available) | Database, authentication, and file storage — all patient data and photographs are stored here |
| Vercel Inc | US | App hosting and serverless functions — processes request data and session tokens |
| Anthropic PBC | US | AI shade analysis — receives progress photographs (pixel data only, metadata stripped) where patient has consented |
| Resend Inc | US | Transactional email delivery — sends magic links and notifications using name and email address only |
| Zoho Corporation | US / EU | Email hosting for privacy@360whitening.co.uk and hello@360whitening.co.uk |
We do not sell your personal data. We do not share your data with any third party for marketing or advertising purposes.
We will disclose personal data to law enforcement or regulatory authorities if required to do so by law, or to protect the rights, property, or safety of 360Dent Ltd, our users, or others.
International data transfers
Some of our sub-processors are based in the United States. When personal data is transferred outside the United Kingdom, we ensure that appropriate safeguards are in place to protect your data to a standard equivalent to UK GDPR.
The safeguards we rely on include:
- Standard Contractual Clauses (SCCs) approved by the ICO — in place with Supabase, Vercel, Anthropic, and Resend
- Data Processing Agreements with each sub-processor
- Technical measures including encrypted transmission (TLS) and metadata stripping
You may request a copy of the transfer safeguards we have in place by contacting privacy@360whitening.co.uk.
How long we keep your data
We retain personal data only for as long as necessary to provide the service and comply with our legal obligations.
| Data category | Retention period |
|---|---|
| Patient account and treatment data | 2 years after account closure or last activity |
| Progress photographs | 2 years after account closure or last activity |
| Shade analysis results | 2 years after account closure or last activity |
| Consent records | 6 years after account closure (legal defensibility) |
| Email delivery logs | 12 months |
| App access and security logs | 12 months |
| Data Processing Agreements (dentist practices) | 6 years after contract end |
| Deletion request records | 12 months (name and date only — no personal data) |
At the end of the applicable retention period, personal data is permanently and securely deleted from all systems including our storage provider (Supabase).
You may request earlier deletion of your data at any time — see Section 9 for your rights.
Your rights under UK GDPR
You have the following rights in relation to your personal data. To exercise any of these rights, contact us at privacy@360whitening.co.uk. We will respond within one calendar month.
- Right of access
- You may request a copy of all personal data we hold about you (a Subject Access Request).
- Right to rectification
- You may ask us to correct any inaccurate or incomplete personal data.
- Right to erasure
- You may ask us to delete your personal data. We will do so unless we are required by law to retain it.
- Right to restriction
- You may ask us to limit how we use your personal data in certain circumstances.
- Right to data portability
- You may request your personal data in a structured, machine-readable format.
- Right to object
- You may object to processing based on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds.
- Right to withdraw consent
- Where processing is based on your consent, you may withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.
- Automated decision-making
- The AI shade analysis does not constitute automated decision-making that produces legal or similarly significant effects. It is a cosmetic guide only.
Consent
We obtain your explicit consent during the App onboarding process before processing any special category data. Consent is obtained separately for:
- Storage and display of your progress photographs
- Sharing your photographs and treatment data with your dental practice
- AI shade analysis of your photographs by Anthropic's Claude system
Each consent is recorded with a timestamp and version number against your patient record. You may withdraw any or all of these consents at any time by contacting privacy@360whitening.co.uk.
Withdrawing consent for photograph storage will mean we are no longer able to provide the progress tracking features of the App. Withdrawing consent for AI shade analysis will disable that feature only — you may continue to use the rest of the App.
Security
We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, or disclosure.
Our security measures include:
- Encrypted data transmission using TLS (Transport Layer Security) for all data in transit
- Encrypted storage — all data stored by Supabase is encrypted at rest
- Metadata stripping — all photograph metadata is removed on your device before transmission
- Magic link authentication — no passwords are stored for patient accounts
- Role-based access controls — dental professionals can only access their own patients' data
- Regular security reviews of our infrastructure and sub-processors
- Access logging — all access to patient data is recorded
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it and will notify affected individuals without undue delay where required.
Children
The 360 Whitening App is intended for use by adults aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18.
Patient accounts are created by dental practices. Dental professionals are responsible for ensuring that patients enrolled on the platform are aged 18 or over and have capacity to provide informed consent.
If you believe we have inadvertently collected data from a person under 18, please contact us at privacy@360whitening.co.uk and we will delete the data promptly.
Cookies and tracking
The 360 Whitening App uses session tokens to keep you logged in. These are essential for the App to function and are stored securely on your device.
We do not use advertising cookies, tracking pixels, or third-party analytics tools that share your data with advertisers. We do not serve advertising within the App.
Basic anonymous usage analytics may be collected by our hosting provider (Vercel) to monitor App performance. This data is not linked to your identity.
How to make a complaint
If you are unhappy with how we have handled your personal data, please contact us in the first instance:
- privacy@360whitening.co.uk
- Post
- Data Protection, 360Dent Ltd, Octagon House, Bradford Road, Sandbeds, West Yorkshire, BD20 5LY
We will acknowledge your complaint within 5 working days and aim to resolve it within one calendar month.
If you are not satisfied with our response, or if you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website
- ico.org.uk
- Telephone
- 0303 123 1113
- Post
- ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Changes to this policy
We may update this Privacy Policy from time to time to reflect changes to our practices, technology, or legal requirements.
We will notify you of any material changes via the App or by email to the address associated with your account. The version number and date at the top of this document indicate when it was last updated.
Continued use of the App after notification of changes constitutes acceptance of the updated policy. If you do not agree with the changes, you should stop using the App and contact us to request deletion of your data.
Contact us
For any questions about this Privacy Policy or how we handle your personal data:
- privacy@360whitening.co.uk
- Post
- 360Dent Ltd, Octagon House, Bradford Road, Sandbeds, West Yorkshire, BD20 5LY
- ICO registration
- ZB054701